IBM Security Z Security

Hi,
I need a zsecure dataset report, groups exploded (to see users) and sorted by groups.    I'd like the output to go to a dataset.

------------------------------
Maria Mason
------------------------------

Hi Maria,

If I am reading that right, you are looking for something like

newlist type=racf
select class=dataset segment=base
sortlist key acl(explode sort(id))

And to send that to a data set, you could make it

alloc type=output dd=mydd dsn=my.data.set
newlist type=racf dd=mydd
select class=dataset segment=base
sortlist key acl(explode sort(id))

Note that this technically sorts on the ACL id. That will be a group insofar the access is being given through a group.

Also note that this is EXPLODE output, so showing all paths that could give access, not just the ones that "do". You might want to check the book if you would prefer RESOLVE or EFFECTIVE output.

Regards,

------------------------------
Jeroen Tiggelman
Software Development and Level 3 Support Manager IBM Security zSecure Suite
IBM
------------------------------

Original Message:
Sent: Mon May 10, 2021 11:20 AM
From: Maria Mason
Subject: dataset report

Hi,
I need a zsecure dataset report, groups exploded (to see users) and sorted by groups.    I'd like the output to go to a dataset.

------------------------------
Maria Mason
------------------------------

Maria, you can also get these reports from RA.D.  For reports into a data set, use the "Print format" option.
To get the permits printed, select "Print ACL" and to get a list of users also select "Resolve to users" and "Print names."
The result goes to a REPORT data set, you can save this into a data set of your choosing with the W line command in front of REPORT.

The zSecure Wiki has samples of writing your own CARLa, one is a report with the users and groups on the ACL of selected profiles, followed by the groups exploded:
https://www.ibm.com/docs/en/szs/2.4.0?topic=programs-profile-report-group-member-list

------------------------------
Rob van Hoboken
------------------------------

PS. the links in the index page of the Samples are currently broken, so use the scrollable Table of Contents to navigate.

For the SORT order of the ACL, RA.D follows the specification in SETUP VIEW (SE.5). So you want to set 'ACL/Connect sort' to 1. Id beforehand.

There is also a setting 'Access list format' there, but note that this is ignored by this report; when you tag 'Resolve to users' RESOLVE is used.

If you would really want, say, EXPLODE format, you could E(dit) the COMMANDS file afterwards (which contains the CARLa from the last query), do a FIND for RESOLVE and change that to EXPLODE.

Regards,

------------------------------
Jeroen Tiggelman
Software Development and Level 3 Support Manager IBM Security zSecure Suite
IBM
------------------------------

Original Message:
Sent: Tue May 11, 2021 01:29 AM
From: Rob van Hoboken
Subject: dataset report

Maria, you can also get these reports from RA.D.  For reports into a data set, use the "Print format" option.
To get the permits printed, select "Print ACL" and to get a list of users also select "Resolve to users" and "Print names."
The result goes to a REPORT data set, you can save this into a data set of your choosing with the W line command in front of REPORT.

The zSecure Wiki has samples of writing your own CARLa, one is a report with the users and groups on the ACL of selected profiles, followed by the groups exploded:
https://www.ibm.com/docs/en/szs/2.4.0?topic=programs-profile-report-group-member-list

------------------------------
Rob van Hoboken
------------------------------

PS. the links in the index page of the Samples are currently broken, so use the scrollable Table of Contents to navigate.