Controlling access to IBM Z Workload Scheduler using Dynamic Workload Console

Read the following information if you are using the Dynamic Workload Console to access IBM Z Workload Scheduler using TCP/IP.

The Z connector performs a security check when a user tries to use the Dynamic Workload Console of IBM Z Workload Scheduler, by checking the user ID and password. The Z connector associates each user ID and password with an administrator.

IBM Z Workload Scheduler resources are currently protected by RACF®.

The Dynamic Workload Console user should have to enter only a single user ID and a password combination, and not provide two levels of security checking (at Z connector level and again at IBM Z Workload Scheduler level).

The security model is based on Z connector security handling initial user verification, and, at the same time, obtains a valid corresponding RACF® user ID. This makes it possible for the user to work with the security environment in z/OS®.

z/OS security is based on the mapping of the administrator with a RACF® user ID. When a Z connector connects to IBM Z Workload Scheduler, the Z connector administrator is mapped to the corresponding user ID. Therefore, make sure that the administrator ID is associated with a RACF® user ID in one of the following ways:
  • USERMAP parameter of the SERVOPTS initialization statement
  • EQQADMIN class
  • TMEADMIN class