hi can anyone here please help me find a way to automate or make our task easier for deleting IDs in RACF? Is there a way when given an Excel file to delete hundreds of User IDs (terminated users)  in RACF in different LPARs that we can do it in batch so it's easier and faster?  Someone told me about doing it in batch using JCL?? I am not familiar with JCL.

there's gotta be a way we can automate this. Please help. thank you

Hi Maria,

What are you using for RACF profile management?  zSecure Admin?  This has a user interface where you can view RACF user IDs (RA.U), select those users by a mask (U123*) or other criteria, and type a D in front of one (or more) of the users to delete them.  Well, zSecure Admin generates the required RACF commands and shows them to you, so you can decide to enter RUN to run the commands, or SUBMIT to run them with JCL.

If you have hundreds of IDs that you want to remove, you can also copy/paste these in ISPF edit like so:

On the command line enter CARLA, this brings you to an ISPF edit session.  Clear all lines by typing D9999 in the first line number.
Enter one line with the text  REMOVE USER=  and repeat this line (as many times as you have users to delete).
Paste the user IDs immediately after the = sign (no space in between).  The CARLa program looks like:

REMOVE USER=U123456
REMOVE USER=U234567
REMOVE USER=ABCDEFG

In the command line type RUN and press Enter.  This generates all the PERMIT DELETE, DELDSD, DELUSER commands you need in a data set.  You can type RUN to execute the commands (or SUBMIT to generate a batch job).

If you have a recent CKFREEZE data set, zSecure Admin is even able to delete the catalog aliases and remaining data sets for these users.  There are some more tweaks to this process, but those only make sense for zSecure installations.

Also, if you have the zSecure Network Server installed, zSecure Admin can pull profile information from multiple RACF databases, and generate appropriate commands for each database.  After inspection, you can execute the commands (back) on the originating database.

However, do you happen to use an Identity Management program for you platforms, that was used to give you the Excel list of users?  Wouldn't it be easier if the IAM called zSecure as a sort of agent on z/OS?  I know of several zSecure customer that do this with file transfer and JCL.  In fact, I implemented a similar solution just months ago using Rexx and file transfer.

------------------------------
Rob van Hoboken
------------------------------

Thank you Rob

------------------------------
Maria Rasner
------------------------------

Another approach would be this:

• Use the Excel list of user IDs to tag the users that have to be deleted.  For example, change their OWNER value to a reserved group name @@PURGE or connecting them to this holding group.  This should be easy to do, just generate ALTUSER uuuuuuuu OWNER(@@PURGE) REVOKE for each entry in the list, and execute these commands from a data set or in a batch job.
• Next, use RA.U and select all users with this OWNER value.  Since zSecure Admin works from the active RACF database, the changes from step 1 are immediately visible.
• Use the DD line command to select a range of users to be deleted (or select all of them).  Relevant RACF commands are generated to a data set, use the RUN or SUBMIT commands to finalize the cleanup.

This approach can also work if your HR feed sends the purge requests at random times of the day, and the final purge step needs to be run at a fixed time, e.g., after the backups completed.

------------------------------
Rob van Hoboken
------------------------------