IBM Security Z Security

Instead of EMPTY='Undef User'

I think you could make it EMPTY='user " | AUSER(0) | " does not exist' 

or something like that.

Where everything between the double quotes[1] is generated literally for the next pass, '|' concatenates (so prevents intermediate blanks) and AUSER(0) would be the user you are looking for.

[1] Note I am only showing closing and reopening double quotes in this snippet.

Marco,

The following should do what you want:

newlist type=dsn f=ckrcmd                   
 define auser as word(dsn,2,'.')
 select dsn=OMVSUSER.**.ZFS not(auser:entype=2)      
 list 'DELETE' dsn                          

"auser:entype" is a lookup into the RACF database, where we obtain the entity type of the resource "auser".    1 = GROUP, 2 = USER, 4 = DATASET. 5 = GENERAL
By eliminating all the "auser" records that are not valid USERs, we can do your query in one run.

Hello Ronald and Jeroen

That was really helpful and super fast! I was already able to incorporate that into my program and it works as expected. I'll run few manual checks before triggering this automatically.

Your quick answer and providing working solution is much appreciated. Got it working with the entype, that was the smart solution I was looking for :-)!

thanks to both of you

kind reagrds
marco

Hi Ronald

You might be able to help with another addition to the selection of filesystems to delete.
Can this "select dsn=OMVSUSER.**.ZFS not(auser:entype=2)" be extended to generate as well the 'DELETE' for users not part of a specific group?

Would something like that work as well?
newlist type=dsn f=ckrcmd                   
 define auser as word(dsn,2,'.')
 select dsn=OMVSUSER.**.ZFS (not(auser:entype=2) or not(auser:CGGRPNM=GROUP1))      
 list 'DELETE' dsn 

Marco,

Unfortunately no, CGGRPNM is a repeat field in type=RACF, my trick only works for single value fields, like ENTYPE, OWNER, etc.
It would be nice if the lookup function would be able to change a single field into a repeat field, but this could quickly result in chaos, if you could do something like repeatfield:repeatfield:repeatfield, The source field can be a single or repeat field, but all the other fields should have one single value.

Very useful information.

If you want to check that a user is connected to a group, you can use the following two step process.

//* Write users connected to GROUP1 into &&USERS
//LISTGRP  EXEC C2RC
//USERS    DD DISP=(,PASS),DSN=&&USERS
//SYSIN    DD *
alloc type=racf active
newlist type=racf dd=USERS nopage
  select class=user cggrpnm=GROUP1
  sortlist profile(8)
//*
//LISTDSN  EXEC C2RC
//USERS    DD DISP=OLD,DSN=&&USERS
//SYSIN    DD *
deftype type=$users
alloc   type=$users dd=USERS
define  type=$users userid(8) as word(record,1)

newlist type=dsn f=ckrcmd                   
 define auser as word(dsn,2,'.')
 select dsn=OMVSUSER.**.ZFS not(auser:entype=2 and exists(auser:$users.userid.record))      
 list 'DELETE' dsn 
//*

I added an Idea for making the list of users connected to your GROUP1 accessible without using an external data set.  See if you like this approach and Vote for it if you do.
IBM Z Software Ideas portal

Hello Everyone

Thanks for all the valuable feedback and suggestions how to optimize my process, much appreciated! @Rob van Hoboken thank you for raising the idea, you have my vote on it.