IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  ACL compare

    Posted Fri September 15, 2023 05:37 AM

    Hi
    I need to compare the ACLs of many pairs of CICS Transaction profiles in a single database as part of  a hygiene effort.

     

    Can anyone suggest a good way to do that?

     

    Thanks

     

     

     

    James Lumsden, Vice President  
    Morgan Stanley | ENTERPRISE TECH & SERVICES   
    122 Waterloo Street | Floor 03   
    Glasgow, G2 7DP   
    Phone: +44 141 245-8160   
    James.Lumsden@morganstanley.com   
    http://mgstn.ly/glasgow   
       

     


    NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. By communicating with Morgan Stanley you acknowledge that you have read, understand and consent, (where applicable), to the Morgan Stanley General Disclaimers found at http://www.morganstanley.com/disclaimers/terms. The entire content of this email message and any files attached to it may be sensitive, confidential, subject to legal privilege and/or otherwise protected from disclosure.



  • 2.  RE: ACL compare

    Posted Fri September 15, 2023 06:47 AM

    I should add that I need this at the level of an exploded acl, so that Userids missing in one can be added to the other



    ------------------------------
    James Lumsden
    ------------------------------

    Original Message


  • 3.  RE: ACL compare

    Posted Mon September 18, 2023 10:21 AM
    Edited by Rob van Hoboken Tue September 19, 2023 03:16 AM

    Hi James

    One obvious approach would use 2 CKRCARLA steps, first step writes the PROFILE(RETAIN) and the ACL(RESOLVE) values for 2 profiles into 1 flat file.  The 2nd step would read the flat file, parse out the fields for PROFILE, USERID and ACCESS, and uses SUMMARY to identify single user IDs (that do not occur on both profiles).

    The other approach relies on newlist type=trusted to convert all permits/connects into the effective user IDs.  But first you have to tell trusted that 2 profiles are of interest and should be reported.  This is achieved with the SIMULATE CLASS=cicsclass command, and must reference the profile through a resource that is protected by the profile.  Note, SIMULATE ... RESOURCE= must have an exact case match (type your resource in all uppercase), same as the senstype value.

    suppress auto_resource
    defsens SiteTransac access=read concern="Comparison" prio=9 class=tcicstrn 
    simulate class=tcicstrn senstype=SiteTransac resource=CICSPROD.CEMT
    simulate class=tcicstrn senstype=SiteTransac resource=CICSTEST.CEMT

    newlist type=trusted
      define profile1(8,access_nz,"CICSPROD") max(access) where resource=CICSPROD.CEMT
      define profile2(8,access_nz,"CICSTEST") max(access) where resource=CICSTEST.CEMT
      select class=tcicstrn
    summary userid profile1 profile2 count(<2,nd)

    The summary command uses count(<2) threshold to suppress user IDs that have 2 matching profiles.  It shows the access value for the matching profile, using access_nz to print missing access values with a blank, instead of NONE.

    I have not tested this, so cannot be sure it works.  Let me know the result.

    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 4.  RE: ACL compare

    Posted Tue September 19, 2023 03:28 AM

    TRUSTED may show more than one trust path to the resource, for example, when the user has a permit, but also group special privilege over the profile.  As such, COUNT(<2) may overlook a permit.  You can fix this by making SELECT more restrictive

      select class=tcicstrn userid_privilege=(permit,permitGrp,permitUsr)

    I cannot test this, so test and tweak until it works...



    ------------------------------
    Rob van Hoboken
    ------------------------------

    Original Message


Related Content