Access required for ESP started tasks to submit a job with USER=xxxx

Products

• ESP Workload Automation

Issue/Introduction

What kind of RACF authority ESP started tasks possess that allow them to submit jobs on behalf of other users? On MVS, in general user A can submit a JCL that has USER=B in its jobcard only if User A has READ access to the SURROGAT class profile B.SUBMIT. How does this work in case of ESP? what kind of RACF access owners of ESP started tasks should possess in order to be able to schedule jobs on behalf of users.

Environment

Release :  11.4 &12.0

Component : CA ESP WORKLOAD AUTOMATION

Resolution

ESP is an APF authorized application, so it can pretend to be any user. It will determine the proper user ID and pretend to be this user ID as the submitting user ID (like your user ID when you submit the JCL manually), and submit the JCL to JES. Then it's JES that may need to validate if the submitting USER ID can submit the JCL with/without the USER=xxxx on the JOB card.