IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  SCOPE report for multiple users

    Posted Tue October 21, 2025 06:11 AM

    Hi,

    I generated the report of inactive users and I want to generate the inactive users - access report. 

    I tried using the select likelist=xyz & report scope=xyz(xyz - refers to previous step users list) but unfortunately the report is showing different class, profiles and access. 

    It will be great helpful if someone guide me to generate the desired report. 

    Regards

    Madhukar



    ------------------------------
    nmr ksa
    ------------------------------


  • 2.  RE: SCOPE report for multiple users

    Posted Tue October 21, 2025 06:20 AM

    Hi Madhukar,

    It is not entirely clear to me what you are referring to exactly.

    LIKELIST copies a SELECT clause, but that requires the report to be of the same type, and I am guessing the earlier report is not a REPORT_SCOPE one.

    SCOPE= expects an ID, not a clause.

    So you might be looking to generate SCOPE=id1 SCOPE=id2 etc.

    Regards,



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development Manager IBM zSecure
    Delft
    ------------------------------



  • 3.  RE: SCOPE report for multiple users

    Posted Tue October 21, 2025 06:39 AM

    Hi Jeroen,

    sorry for the confusion.

    My code: it generates the report of inactive users: 

    N TYPE=RACF NAME=XYZ DD=CKR2PASS 

    S S=BASE C=USER PASSINT_EFFECTIVE<>255 LJDATE<TODAY-90 

    SORTLIST KEY

    N TYPE=RACF NAME=ABC1 DD=CKR2PASS 

    SELECT LIKLIST=XYZ 

    SORTLIST CLASS KEY 

    REPORT SCOPE=XYZ 

    Instead of manually providing the list of users in SCOPE, whether I can code with complete list of users? 

    Regards

    Madhukar



    ------------------------------
    nmr ksa
    ------------------------------



  • 4.  RE: SCOPE report for multiple users

    Posted Tue October 21, 2025 07:02 AM

    Hi Madhukar,

    You have three queries there, two of TYPE=RACF and a scope report. 

    Since you did not specify a REPORT_SCOPE layout yourself, I take it SCKRCARL(CKRRSCOP) will be embedded there.
    (You should be able to see that in SYSPRINT.)

    Assuming you don't have an ID XYZ in your database, I take it the REPORT SCOPE=XYZ cannot produce any output.

    ===

    If you are looking to run a scope report in a second pass, I think you are looking for something more like this:

    N TYPE=SYSTEM OUTLIM=1 DD=CKR2PASS
    SORTLIST "REPORT ,"

    N TYPE=RACF NAME=XYZ DD=CKR2PASS 

    S S=BASE C=USER PASSINT_EFFECTIVE<>255 LJDATE<TODAY-90 

    SORTLIST "SCOPE="| KEY(0) ","

    N TYPE=SYSTEM OUTLIM=1 DD=CKR2PASS
    SORTLIST "SCOPE=XYZ"     /* need to put something to close command... */

    Since this does not specify a REPORT_SCOPE layout, the CKRRSCOP default one will be used.
    If you want to define your own N TYPE=REPORT_SCOPE layout, you need to include that in the input before the REPORT statement.

    I hope this begins to help.

    Regards,



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development Manager IBM zSecure
    Delft
    ------------------------------



  • 5.  RE: SCOPE report for multiple users

    Posted Tue October 21, 2025 08:15 AM

    Hi Jeroen,

    Thank You for your suggestion. 

    Regards

    Madhukar



    ------------------------------
    nmr ksa
    ------------------------------



  • 6.  RE: SCOPE report for multiple users

    Posted Wed October 22, 2025 04:44 AM

    Hi Jeroen,

     Thanks a lot..!

    I used INCLUDED statement and desired report is generated.  

    Regards

    Madhukar



    ------------------------------
    nmr ksa
    ------------------------------



  • 7.  RE: SCOPE report for multiple users

    Posted Wed October 22, 2025 05:44 AM
    Edited by Rob van Hoboken Wed October 22, 2025 05:45 AM

    Good to hear,  Madhukar.

    Note, Jeroen provided CARLa that writes to the CKR2PASS file.  If you run his CARLa program under ISPF, it writes to the predefined dd name and the ISPF interface presents the generated REPORT SCOPE command.  When you see this command in ISPF Edit, you can type RUN in the command line to generate the report, or you can back out to the RESULTS list and type R in front of CKR2PASS to run the report.  In this way there is no need to use an INCLUDE statement.

    ------------------------------
    Rob van Hoboken
    ------------------------------