Hi,

We use IBM Security zSecure Admin. CKGRACF is APF. And I updated the TSO command table. I added the CKGRACF program name to the authorized AUTHCMD and AUTHPGM tables in the SYS1.PARMLIB member IKJTSO00. After updating the table, I applied the updated version of IKJTSO00 using the TSO command PARMLIB UPDATE((00).

When I tried using the CKGRACF command to verify security resources with following commands

alloc reuse file(systerm) dataset(*)

ckgracf show myaccess

The result is:

IKJ56500I COMMAND CKGRACF NOT FOUND

***

D IKJTSO,AUTHCMD

RESPONSE=VBT1

IKJ738I TSO/E PARMLIB SETTINGS : 016

SYS1.VBT1.PARMLIB(IKJTSO00) on volume SYSP01

Activated by **IPL** on 2021-04-10 at 01:00:18 from system VBT1

Applies to : VBT1

CURRENT PARMLIB SETTINGS FOR AUTHCMD:

CKGRACF DITTO DITTOA MVPXDISP CSFTTKE TRACERTE

PING LPQ LPR LPRM RSH MODDVIPA

And I also tried to give update privileged to my group in XFACILIT class to ** profile

It looks like you are trying to issue the CKGRACF command from outside of the zSecure Admin UI, and the module cannot be found.

If you enter the zSecure Admin UI and then issue:

TSO ckgracf show myaccess

it should work.

If you wish to run CKGRACF from outside the zSecure ISPF environment, the program must be available from either LINKLIST, STEPLIB or JOBLIB (just like any other authorized program).

Using STEPLIB or JOBLIB will have a performance penalty and this method works only when all data sets in your STEPLIB or JOBLIB concatenation are APF-authorized.Running TSO CKGRACF commands from within the zSecure Admin ISPF environment does not have any extra requirements.

Regards, Mike

CKGRACF command is automatically found when you are in zSecure Admin's ISPF interface. If you wish to use CKGRACF in normal TSO or ISPF screen 6 environment, you must add the zSecure SCKRLOAD data set to linklist, or as STEPLIB for your TSO session.