IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Quick Group membership check

    Posted 02/19/21 05:38 PM

    I know there is a quick access check via a z/Secure command (ckgracf ACCESS userid class profile) but is there a command to check if a user is in a GROUP ??

    thanks !


    #ZSecurity
    #SupportMigration
    #Support


  • 2.  RE: Quick Group membership check
    Best Answer

    Posted 02/19/21 07:38 PM

    As far as I know there is not a direct CKGRACF command to do what you want. However, you can use "CKGRACF LIST USER userid RACF" to see to what groups a user ID is connected.

    The following CARLa code will also show you the groups of a user named ALAN01

    newlist type=racf_access select class=group newlist type=racf_access select id="ALAN01" summary id(8,"User ID") id:name("User Name") profile(8,"Group")

    Alan


    #ZSecurity
    #SupportMigration
    #Support


  • 3.  RE: Quick Group membership check
    Best Answer

    Posted 02/19/21 08:04 PM

    Thanks, i gave it a try as a command. That output is better to parse than a RACF LU. thanks.


    #Support
    #ZSecurity
    #SupportMigration


  • 4.  RE: Quick Group membership check
    Best Answer

    Posted 02/22/21 11:07 AM

    It depends what your runtime environment is. If you are within zSecure's ISPF environment, then a CARLa is the quickest. If your environment is a Rexx or batch job, then CKGRACF LIST USER xxxx TAG is the easiest for post processing. This is what the output looks like:

    ckgracf list user ibmtrob tag

    U-AUTHDATE CREATIONDATE 25Apr2016 U-AUTHOR OWNER IBMT U-DFLTGRP DEFAULTGROUP IBMT U-EXPIRED EXPIRED N U-PASSEXP PASSWORD_EXPIRED N U-PHREXP PHRASE_EXPIRED Y U-FLAG1 ADSP N U-FLAG2 SPECIAL Y U-FLAG3 OPERATIONS N U-FLAG4 REVOKE N U-FLAG5 GRPACC N U-FLAG6 AUDITOR Y U-FLAGROA ROAUDITOR N U-INACTIVE REVOKEINACTIVE ACTIVE U-INSTDATA INSTALLATIONDATA U-LCDATE LASTCONNECTDATE 22Feb2021 U-LCTIME LASTCONNECTTIME 11:52:36.07 U-LJDATE LASTLOGINDATE 22Feb2021 U-LJTIME LASTLOGINTIME 11:52:36.07 U-LOGDAYS LOGDAYS SMTWTFS U-PASSCHG PASSWORD_CHANGED 29Dec2020 U-PASSDATE PWDLASTCHANGED 29Dec2020 U-PASSINT PWDINTERVAL 90 U-PGMRNAME USERNAME ROB VAN HOBOKEN U-PHRCHG PHRASE_CHANGED U-PROTECT PROTECTED N U-RESTRICT RESTRICTED N U-REVOKE REVOKESTATUS NOT REVOKED U-REVOKECT PWDTRIES 0 U-SECLABEL SECLABEL ........ U-SECLEVEL SECLEVEL 255 G-AUTH AUTHORITY USE G-AUTHDATE CREATIONDATE 25Apr2016 G-CAUTHOR CONNECTAUTHOR IBMT G-CONGRPNM GROUPNAME IBMT G-FLAG1 ADSP N G-FLAG2 SPECIAL N G-FLAG3 OPERATIONS N G-FLAG5 GRPACC N G-FLAG6 AUDITOR N G-INSTDATA INSTALLATIONDATA IBM TEACH G-LJDATE LASTCONNECTDATE 22Feb2021 G-LJTIME LASTCONNECTTIME 11:52:36.07 G-NOTRMUAC NOTERMUACC Y G-GRPREVOK CONNECTREVOKE N G-CGREVKDT CONNECTREVOKEDT G-CGRESMDT CONNECTRESUMEDT G-AUTH AUTHORITY USE G-AUTHDATE CREATIONDATE 25Apr2016 G-CAUTHOR CONNECTAUTHOR IBMB G-CONGRPNM GROUPNAME IBMB G-FLAG1 ADSP N G-FLAG2 SPECIAL N G-FLAG3 OPERATIONS N G-FLAG5 GRPACC N G-FLAG6 AUDITOR N G-INSTDATA INSTALLATIONDATA IBM BUILD G-LJDATE LASTCONNECTDATE G-LJTIME LASTCONNECTTIME G-NOTRMUAC NOTERMUACC Y G-GRPREVOK CONNECTREVOKE N G-CGREVKDT CONNECTREVOKEDT G-CGRESMDT CONNECTRESUMEDT

    You can see base fields with a prefix of U- and the template name, a description and the value. After the base fields, connect group information is shown, separate by an empty line.


    #Support
    #ZSecurity
    #SupportMigration


  • 5.  RE: Quick Group membership check
    Best Answer

    Posted 02/22/21 01:43 PM

    Hello -- using a REXX.

    I absolutely love the TAG on the CKGRACF command !!!! Such a great idea to come up with that.

    thanks !!!


    #Support
    #ZSecurity
    #SupportMigration


Related Content