New to Z

 View Only

 Protected User and a TSO Segment

Stephan Reichelt's profile image
Stephan Reichelt posted 03/10/25 10:29 AM

Hello everyone,
We had an interesting discussion at work today. We have a batch user that is protected and started as a surrogate user. It has now been determined that this user has a TSO segment.
Now the questions: Does a TSO segment even make sense for a protected user? Isn't the TSO segment used to log on to the interactive dialog interface in the TSO (Linecommands or ISPF)? And can the user still execute REXX scripts via the IKJEFT01 program without a TSO segment, for example?
I couldn't find anything about this in the literature and would be grateful if someone could answer my questions.
Kind regards
Stephan

SAUL MAURICIO CHAGOLLA HERREJON's profile image
SAUL MAURICIO CHAGOLLA HERREJON posted 03/10/25 05:17 PM

Interesting question @Stephan Reichelt

I don't know if this information is useful to you:

https://www.ibm.com/docs/en/zos/3.1.0?topic=profiles-tso-segment-in-user

Shashank Dewangan's profile image
Shashank Dewangan IBM Champion posted 03/11/25 02:14 AM

No, a TSO segment is not strictly required to execute REXX scripts via the IKJEFT01 utility. IKJEFT01 is a batch utility that allows you to run TSO commands and REXX scripts in a batch environment. It does not rely on the user having a TSO segment defined in the security system, as it operates independently of the interactive TSO/E environment.

J Robert Garrett's profile image
J Robert Garrett posted 03/15/25 10:03 AM

Another setting in the RACF TSO segment is establishing the location of the user's USS home directory.  So, if the batch user you're talking about is ever used to run anything under OMVS/USS (via the BPXBATCH facility for instance), then having a TSO segment on the id not only makes sense, it's required. 

oops... you clearly said TSO segment but for some reason my mind heard OMVS segment.  Please ignore what I said about USS and SH above.

Saurabh Banerjee's profile image
Saurabh Banerjee IBM Champion posted 03/20/25 01:47 PM

TSO segment is primarily used for interactive logon to TSO, including line commands and ISPF. For a protected user, who typically doesn't log on interactively, having a TSO segment might seem unnecessary. However, it could be there for specific administrative purposes or legacy configurations.

Despite this, you can still run REXX scripts via the IKJEFT01 program without needing a TSO segment. IKJEFT01 allows you to execute TSO commands and REXX scripts in batch mode, which bypasses the need for an interactive TSO session. This is quite handy for automated tasks and batch processing.

Related Content