How To Split Owned Resource Among Other Top Secret Departments?

book

Article ID: 18153

calendar_today

Updated On:

Products

CA Web Administrator for Top Secret CA Top Secret CA Top Secret - LDAP

Issue/Introduction

A TSS1621W ORG ACID (acid) has reached 99% of maximum allowed size message was received, so all owned resources except one were moved to other departments. Unfortunately, after doing this, the maximum allowed size was reached again. How can this single resource be split among other departments?

Environment

Release: TOPSEC00200-15-Top Secret-Security
Component:

Resolution

To split an ownership for a resource, all permits have to be revoked and then remove the ownership. Once that is done, multiple ownerships with longer resource names can be added to several different departments.

For example:

MYCLASS(AAA.) is owned and there are so many permits that the owning acid has reached the maximum allowed size, so this has to be split into multiple ownerships among several departments.

  1. REVOKE all permits first. (Use TSS WHOHAS MYCLASS(AAA.) to find all the permits. Save this output for step 4.)

  2. REMOVE the ownership from the acid that owns MYCLASS(AAA.). (Use TSS WHOOWNS MYCLASS(AAA.) to find the owner.)

  3. Add more granular ownerships.

    TSS ADD(DEPT00A) MYCLASS(AAA.A)
    TSS ADD(DEPT00B) MYCLASS(AAA.B)
    TSS ADD(DEPT00C) MYCLASS(AAA.C) etc...

  4. Redo all of the permits that were revoked in step 1.

    Since this involves a lot of administration, it is recommended to setup batch jobs to handle it.

    The alternative to this is use the BIG ORG ACID feature, but to do that, a new security file must be allocated with ORGACIDSIZE= specified. Here is an example of the options to specify when allocating the new security file using the TSSMAINT utility. See the SECPARMS member in the CA Top Secret r16 CAKOJCL0 library.
    CREATE SECURITY 
    ACCESSORS=5000
    VOLUMES=200
    BLOCKSIZE=8192
    RESBLOCKS=20 <----OPTIONAL
    SDTBLOCKS=20 <----OPTIONAL
    PIEBLOCKS=20 <----OPTIONAL
    MLSBLOCKS=20 <----OPTIONAL
    MAXACIDSIZE=512 <----OPTIONAL
    ORGACIDSIZE=1024 <----NEW SIZE FOR DEPT ACID
    SCA=BIGBOSS/XE52 INITVSAM=DIGICERT AESENCRYPT