RACF

RACF profiles must be defined to protect the local application objects that you define for your queue managers.

This example shows that the WebSphere MQ classes in RACF do not provide as granular of access for MQI operations as the OAM does.

RACF implements security through classes, which are RACF entities used to secure a specific type of resource.

In CICS TS, the link user ID must be a valid RACF user ID on this region.

This requires RACF to use several different profiles in various classes to control access to a resource.

Access to protected resources on this region is based on the RACF user profile and its group membership.

Here is an example of a RACF PERMIT command to grant the user ID for the channel initiator permission to connect to queue manager CSQ1.

Finally, RACF provides some features that the OAM does not.

In reality, few organizations have an organization-wide naming convention that mandates their AD users have the same ID as their RACF users.

We assume that the signing certificate (cert) is already created in RACF.

Also, authority in RACF is granted in a cumulative way.

The user ID that is issuing the binary deploy is not defined to the RACF program control The _login function to switch users failed.

A collection of RACF users who can share access authorities for data sets.

On the other hand with RACF, UPDATE access supersedes any access which had previously been granted to GROUP1, since access is cumulative.

TOPIC objects and the RACF profiles that match them secure topic trees.

Instead, the administrator must know how to translate these commands into RACF commands.

RACF matches strictly on the resource name.

Here is a nearly equivalent RACF command, assuming there is a MQQUEUE class profile defined specifically for queue APP1. QUERY.

Create a keyring in RACF database called ringcicsb, using the commands in Listing 6.