How IBM® Z Workload Scheduler verifies access authority
To verify access authority, IBM® Z Workload Scheduler uses the RACROUTE macro. This macro has a general-purpose interface to a security product through the system authorization facility (SAF). The security product can be RACF® or any other product that works with SAF. In this chapter, RACF® commands show how IBM® Z Workload Scheduler interfaces with a security product.
To verify a user's authority, IBM® Z Workload Scheduler uses the RACROUTE macro to invoke the SAF z/OS router. This conditionally directs control to RACF®, if present.
The RACROUTE options that IBM® Z Workload Scheduler uses
invoke these RACF® functions:
- RACINIT
- Provides RACF® user identification and verification when IBM® Z Workload Scheduler services are requested. (IBM® Z Workload Scheduler does not have its own logon panel or user IDs.)
- RACLIST
- Builds in-storage profiles for resources defined by RACF®, which improve performance for resource
authorization checking. Note: Some security products do not support this function. If you are using such a product, RACLIST is effectively a no operation.
- RACHECK
- Provides authorization checking when you request access to a RACF-protected
resource, for example, when you access:
- Data (such as the current plan)
- A function (such as REFRESH)
- FRACHECK
- Provides authorization checking in the IBM® Z Workload Scheduler subsystem.
Note: Security products that do not support RACLIST convert FRACHECK requests to the corresponding RACHECK request. This could have a severe impact on the performance of some IBM® Z Workload Scheduler dialog functions.