Mapping RSA userid to ACF2 userid

Products

• ACF2 for z/OS

Issue/Introduction

This document outlines how to set up the mapping between the RSA userid and the ACF2 userid. For example, the RSA userid could be userFirstName.userLastName and the ACF2 userid is USER001. 

Resolution

Sometimes the RSA userid and the ACF2 logonid do not match for a user. RSA mapped userids can be up to 64 bytes long. Optionally, an RSA userid can be mapped to an ACF2 logonid. A user-defined logonid field can be used to store the RSA userid in the ACF2 logonid record for the user. 

The steps are as follows:

1. Make the appropriate logonid update via usermod UM99901 then issuing the following command: F ACF2,NEWMOD(ACFFDR). A NEWMOD of the ACFFDR cannot be used to update the UID string, SVC or SMF numbers, an IPL is required to modify these ACFFDR options.
   
   Use extreme caution when adding fields to the logonid record since this record is used to determine resource access. For example, when adding fields to the logonid record, ensure that this change does not alter the order, length, or offset of the fields that comprise the UID string or any other field that was previous defined.
   
   The safest way to add a site-defined field to the ACF2 logonid record is to add the field at the end of the user portion of the logonid record - in either USERLID or USERXLID sections. This way, the field is only using unused blank bytes at the end of the user portion of the logonid record.
   
   Never add any user-defined fields to the ACFLID or ACFXLID sections of the logonid record as these are reserved for ACF2 defined fields only.
   
   For example, to create new a user-defined logonid field LIDRSAID:
   
   Create the new LIDRSAID internal field in the USERLID or USERXLID DSECT:
   
   LIDRSAID DS    CL64      *** RSA USERID
   
   Next update the USERCFDE to include a new @CFDE definition for the USERLID or USERXLID field (LIDRSAID)
   
   @CFDE  RSAID,LIDRSAID,CHAR,ALTER=SECURITY+ACCOUNT,LIST=ALL,PRTN=1,
                RRTN=1,GROUP=0,ZERO=YES
   
   Note: RSAID is the external field name. LIDRSAID is the internal DSECT field name.
   
   
2. The user-defined logonid field is then referenced in the $USERDATA line of a resource rule called RSAUMAP in the CASECMFA class, as follows:
   
   $KEY(RSAUMAP) TYPE(CAS)
   $USERDATA(user_defined_logonid_field_name)
   
   For example, if the user-defined logonid field is called RSAID, the rule would be:
   
   $KEY(RSAUMAP) TYPE(CAS)
   $USERDATA(RSAID)
   
   After the RSAUMAP rule is stored, issue the F ACF2,REBUILD(CAS) command to make it active.
   
   
3. Add the RSA userid in the ACF2 logonid record for the user.
   
   ACF
   CHANGE USER001 RSAID(RSA userid)
   
   NOTE: ACF2 reverts to using the regular ACF2 logonid for the RSA signon validation when one of the following conditions is true:
   
   - There is no RSAUMAP rule.
   - There is no $USERDATA in the RSAUMAP rule.
   - The Logonid field defined in the $USERDATA is not defined as type character.
   - The Logonid field defined in the $USERDATA is empty.
   
   RSA mapped userids can be up to 64 bytes long.