I'm looking to update the CARLa posted at https://www.ibm.com/support/knowledgecenter/SS2RWS_2.4.0/com.ibm.zsecure.doc_2.4.0/zSecure_wiki/grpdef.txt to only generate define / permit commands when the profile doesn't currently exists

 /* Generate REF2GRP profiles for groups that have connected users.
    These profiles are used to interpret connect group usage from
    CA Cleanup in the simulated ACCESS file.
 */
n type=racf nopage dd=ckrcmd
 select class=group (aclcnt>0 or universal)
 sortlist 'rdefine ref2grp' profile(0) 'owner(zsecmon)' /,
          'permit' profile(0) 'class(ref2grp) id(' | profile(0) | ')'​

What's the best way to go about doing so?

------------------------------
Adam Klinger
------------------------------

You could use a two pass process:
pass 1 generates EXCLUDE KEY=xxxxx for each profile in the REF2GRP class.
pass 2 includes these EXCLUDE commands to weed the list of group names.
Something like:

//STEP1    EXEC C2RC
//CKR2PASS DD DISP=(NEW,PASS),DSN=&&CKR2PASS
//SYSIN    DD *
alloc type=racf active
print dd=CKR2PASS nopage
newlist type=racf
  define once(nd) boolean where class==class
  define every(nd) count
  select class=ref2grp segment=base
  summary once  'exclude key=(,'
  summary every key(0) | ','
  summary once  ')'
//STEP2    EXEC C2RC
//COMMANDS DD SYSOUT=*
//EXCLUDES DD DISP=(OLD,PASS),DSN=&&CKR2PASS
//SYSIN    DD *
alloc type=racf active
print dd=COMMANDS nopage
newlist type=racf
  select class=group (aclcnt>0 or universal)
  include dd=excludes
  sortlist 'rdefine ref2grp' profile(0) 'owner(zsecmon)' /,
           'permit' profile(0) 'class(ref2grp) id(' | profile(0) | ')'

Great, this works perfectly!

------------------------------
Adam Klinger
------------------------------

Original Message:
Sent: Thu February 27, 2020 09:38 AM
From: Rob van Hoboken
Subject: zSecure CARLa: REF2GRP Profile Definitions

You could use a two pass process:
pass 1 generates EXCLUDE KEY=xxxxx for each profile in the REF2GRP class.
pass 2 includes these EXCLUDE commands to weed the list of group names.
Something like:

//STEP1    EXEC C2RC
//CKR2PASS DD DISP=(NEW,PASS),DSN=&&CKR2PASS
//SYSIN    DD *
alloc type=racf active
print dd=CKR2PASS nopage
newlist type=racf
  define once(nd) boolean where class==class
  define every(nd) count
  select class=ref2grp segment=base
  summary once  'exclude key=(,'
  summary every key(0) | ','
  summary once  ')'
//STEP2    EXEC C2RC
//COMMANDS DD SYSOUT=*
//EXCLUDES DD DISP=(OLD,PASS),DSN=&&CKR2PASS
//SYSIN    DD *
alloc type=racf active
print dd=COMMANDS nopage
newlist type=racf
  select class=group (aclcnt>0 or universal)
  include dd=excludes
  sortlist 'rdefine ref2grp' profile(0) 'owner(zsecmon)' /,
           'permit' profile(0) 'class(ref2grp) id(' | profile(0) | ')'