Alternative for XML-service USERSEC

Hello,

we use the USERSEC XML to check the CMN authorizations 'online' (during execution of rexx-programs). Only this XML service is not allowed to be used.  

Would it be possible to provide a  alternative  for this XML-service so we are able to check the CMN-rights of users in our processes. 

As I'm not an expert in Rexx-programs (nor assembler programs) : Is it possible to call this assembler exit SERLCSEC also from rexx and pass the same arguments as in USERSEC
user / entity / resourceClass / access ?

If possible ... can you give an example on how to call ?

Kind Regards 

Hi Peter, 

thx for this reply .... 

What if .... I want to check for a dedicated user ?  

Is there any alternative then ?  

Kind regards, 
Priem Wim 

Hi Wim,

We don't provide the ability to do 3rd party security checks to users for security reasons.  If you can provide a use case, perhaps there is a solution that does not require doing a 3rd party security check.

Hi Peter, 

I did some testing with calling SERLCSEC via coding you gave ...  
I'm not 100% sure but I think  by default it's checking the userid of started task (because the rexx is call in HLLX-exit) because the result I receive is not correct (I expect 08 but receive 00). 

I do read however in SERLCSEC itself .... 


 Parameter list:  +00  Address of security function                  
                       CHECK    - User authorization checking        
                       VERIFY   - User authentication                
                       DELETE   - Delete ACEE                        
                       USERTYPE - Query if userid is started task    
                       SAFAUTH  - Return SAF resource and class      
                       XMLAUTH  - Return XML resource and class      
                  +04  Local security option flags mapped as follows:
                       1... .... Suppress logging security violation 
                       .1.. .... Check password (SAF only)           
                       ..1. .... Started task user ID                
                       ...1 .... Change password (SAF only)          
                       .... 1... Specific userID checked, not STC    
                       .... .1.. Suppress WTOs                       
                       .... ..1. If on, passphrase was provided      
                                 If off, password was provided       
                       .... ...1 MFA repeated logon                  

I assume that i should change parm2 = x2c('00')   into something else if i want to check  Specific userID checked, not STC    .... 

How can this be achieved  ? 

Kind Regards 
Wim

Hi Wim,

I thought we were dealing with a user's TSO/ISPF session, which runs the user's authority.  HLL exits running in the HLL exit started task.  The environment is different and allows the following.  Note the change in parm2 and the addition of the USER parameter.  It is important for security reasons that the REXX library (or libraries) allocated to ddname HLLXREXX be secured so that user do not have UPDATE access to it.  

class = '$CHGMAN'                                                      
prof  = 'CMNLCADM'                                                     
access = 'UPDATE'                                                      
user = userid                                                          
class   = left(class,8)      /* Class    e.g. $CHGMAN         */       
prof    = left(prof,44)      /* Profile  e.g. CMNLCADM        */       
access  = left(access,8)     /* Access   e.g. UPDATE          */       
                                                                       
parm1 = 'CHECK   '                                                     
parm2 = x2c('88')            /* Suppress logging. Specific user ID */  
                                                                       
say "Class/Prof/Access/="class"/"prof"/"access"/"user"/"               
                                                                       
ADDRESS LINKPGM "SERLCSEC PARM1 PARM2 PROF CLASS ACCESS USER"          
                                                                       
say "Return code =" rc                                                 

Hi Peter,   

first of all thx for the replay and all the help.  

Can you please elobarte more why you last code will/can not work under TSO/ISPF environment or do I understand this wrongly ?  

Because I want to able to check the authorizations of users in both environments 
(HLLX = under started task and no TSO environment available and REXX TSO-environment).  

Many thx in advance ! 

Kind regards
Wim

Hi Peter, 

meanwhile I did some test with the changed code .... but still I don't receive the correct result via SERLCSEC  ...  

for the testcase that 'fails' : 
parm2 = x2c('88')     however the user has authorization of admin  I receive rc 08 ....  

SILCSEC stared                                                                 
Class/Prof/Access/user : $CCMNTST/CMNYGBAD                                    /UPDATE  /U78048
RC  8                                                                          
SILCSEC ended        

using XML ENVIRON,SERVICE,LIST and checking hasAdminAccess I receive Y as value. 

any idea which log I coud check  to figure out what's going wrong ? 

Regards,  

Wim                                                       

Hello,

we use the USERSEC XML to check the CMN authorizations 'online' (during execution of rexx-programs). Only this XML service is not allowed to be used.  

Would it be possible to provide a  alternative  for this XML-service so we are able to check the CMN-rights of users in our processes. 

As I'm not an expert in Rexx-programs (nor assembler programs) : Is it possible to call this assembler exit SERLCSEC also from rexx and pass the same arguments as in USERSEC
user / entity / resourceClass / access ?

If possible ... can you give an example on how to call ?

Kind Regards