IBM Security Z Security

 View Only
  • 1.  IRRMIN00 does not run with RACF based on VSAM cluster

    Posted Tue May 16, 2023 03:27 AM
    Hello all,
     
    we have the following problem:
     
    We are building a new system from scratch with RACF (so far we use TSS - Broadcom TopSecret). Since IBM says it should be possible, we created the RACF DB as a VSAM cluster. Next we ran IRRMIN00. However, this always ends with an error that we can't do anything with.
     
    For testing, we created the RACF DB as a NON-VSAM, and there the IRRMIN00 worked.
     
    Unfortunately we didn't find anything about it in the whole IBM documentation.
     
    Does the IRRMIN00 basically not work with VSAM clusters. But then how should the templates get into the DB? Is this a bug of the IRRMIN00?
     
    I hope someone can help us further.

    Here the error message and the JCL:

    $HASP373 M5250041 STARTED - INIT 1    - CLASS A        - SYS T1A1       

    IEF403I M5250041 - STARTED - TIME=17.19.11                              

    IRR05417I MMCONNLPALOC  160                                             

     stat=0x000174B0 asid=202 M5250041 Func: IRRMIN00(7000) Lib:            

     IRRDSET(5000) Opr:MMConnect(5007) Svc:lpaLoc(20) Rty:0 rc:0x00000008   

     rs:0x00000000 d1:0x00000000 d2:0x00000000 d3:0x00000000 d4:0x00000000  

     d5:0x00000000                      

    JCL:

    //IDCAMS   EXEC PGM=IDCAMS                                   

    //SYSPRINT DD SYSOUT=*                                       

    //SYSIN    DD *                                               

     DEFINE CLUSTER (NAME('SYS1.T2S2.RACF.PRIM')     -           

       LINEAR                                   -                

       NONSPANNED                               -                

       DATACLAS(NODATACL)                       -                

       ERASE                                    -                

       REUSE                                    -                

       SHAREOPTIONS(3,3)                        -                

       VOLUMES(SFTSC2))                         -                

       DATA    (                                -                

          NAME('SYS1.T2S2.RACF.PRIM.DATA')           -           

          CISZ(4096)                            -                

          CYLINDERS(100 0)                        -              

          FREESPACE(0 0)                        -                

          ) CATALOG(SYS1.MASTER.SFTSC2)                          

    /*                                                           

    //*                                                           

    //INITALZE EXEC PGM=IRRMIN00,PARM=NEW                        

    //STEPLIB  DD  DSN=SYS1.LINKLIB,DISP=SHR,                    

    //             UNIT=3390,VOL=SER=SFS1T7                      

    //SYSPRINT DD  SYSOUT=*                                       

    //SYSRACF  DD  DSN=SYS1.T2S2.RACF.PRIM,                      

    //             DISP=SHR,UNIT=3390,VOL=SER=SFTSC2             

    //*                                                          

                                         
     
    Thanks in advance 
     
    Kind regards
     
    Stephan


    ------------------------------
    Stephan Reichelt
    ------------------------------


  • 2.  RE: IRRMIN00 does not run with RACF based on VSAM cluster

    Posted Tue May 16, 2023 04:01 AM

    Hi Stephan,

    I believe the RACF VSAM support was a new feature with z/OS 2.5, so I guess my first question is if you are current with z/OS. 

    Regards,



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development and Level 3 Support Manager IBM Security zSecure Suite
    Delft
    ------------------------------



  • 3.  RE: IRRMIN00 does not run with RACF based on VSAM cluster

    Posted Tue May 16, 2023 07:04 AM

    Hi Jeroen,

    yes, we having the newest Version (2.5) and the newest, recommended PTFs installed on this system.

    Regards,

    Stephan



    ------------------------------
    Stephan Reichelt
    ------------------------------



  • 4.  RE: IRRMIN00 does not run with RACF based on VSAM cluster

    Posted Tue May 16, 2023 09:49 AM
    Edited by RENE van TIL Tue May 16, 2023 09:49 AM

    Hi stephan

    it works for me with this job

    //CRMBRT1A JOB MSGLEVEL=(1,1),CLASS=A,MSGCLASS=A,REGION=256M,     
    //    NOTIFY=&SYSUID                                              
    //DEFINE  EXEC PGM=IDCAMS                                         
    //SYSPRINT DD SYSOUT=*                                            
    //SYSIN DD *                                                      
      DELETE CRMBRT1.RACFBACK.VSAM                                    
      DEFINE CLUSTER (NAME('CRMBRT1.RACFBACK.VSAM') -                 
                      LINEAR                          -               
                      NONSPANNED                      -               
                      SHAREOPTIONS(3,3)               -               
                      CYL(60 0)                      -                
                      CISZ(4096)                      -               
                      REUSE                           -               
                      ERASE                           -               
                      FREESPACE(0 0))                                 
    /*                                                                
    //INITALZE EXEC PGM=IRRMIN00,PARM=NEW                             
    //STEPLIB  DD  DSN=SYS1.LINKLIB,DISP=SHR                          
    //SYSPRINT DD  SYSOUT=*                                           
    //SYSRACF  DD  DSN=CRMBRT1.RACFBACK.VSAM,DISP=SHR                 

    But i cant reproduce your issue. Is the DATA part of this cluster on a NONSMS managed volume ? That would require the PTF for OA62267.

    cheers

    rene


    OA62267



    ------------------------------
    RENE van TIL
    ------------------------------



  • 5.  RE: IRRMIN00 does not run with RACF based on VSAM cluster

    Posted Wed May 17, 2023 01:15 AM
    Hello Rene,
     
    the RACF DB is located on a NONSMS managed catalog disk.

    VOLUME CACHE FW  DUPLEX    OTHER   SUBSYS  PHYSICAL 

    SERIAL STATUS    STATUS    DEVICE  ID      STATUS   

    -(2)-- --(18)--  --(19)--  -(20)-  -(21)-  --(22)-- 

    SFTSC2 ACTIVE    SIMPLEX     ----    0900  NONSMS   

    ------ ----------------------------------------------

     
    Many greetings
    Stephan


    ------------------------------
    Stephan Reichelt
    ------------------------------



  • 6.  RE: IRRMIN00 does not run with RACF based on VSAM cluster

    Posted Wed May 17, 2023 06:10 AM

    Hi stephan

    so support for a RACF VSAM databases on a NONSMS managed volumes was introduced with OA62267 with PTF UJ08531 for z/OS 2.5. Is that applied to your system ? If it is i think you have to open a CASE with the RACF group.

    cheers

    rene



    ------------------------------
    RENE van TIL
    ------------------------------



  • 7.  RE: IRRMIN00 does not run with RACF based on VSAM cluster

    Posted Wed May 17, 2023 07:40 AM
    Hello Rene,
     
    yes, we have also installed. Was checked again today by my colleagues.
    Nevertheless, thanks for your help.
    Have a nice rest of the week.
    Many greetings
    Stephan



    ------------------------------
    Stephan Reichelt
    ------------------------------



  • 8.  RE: IRRMIN00 does not run with RACF based on VSAM cluster

    Posted Thu May 18, 2023 03:29 AM
    remove your STEPLIB, and make sure you run the job on the 2.5 system
    with the required maintenance