How can I implement DB2 GroupID in ACF2 for DB2 resource rules?

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• PanApt
• PanAudit

Issue/Introduction

Does ACF2 for DB2 supports the DB2 Groupid so that resource rules can be written for multiple SYSIDs when the SYSIDs are not maskable?

 

Environment

Release:
Component: ACF2DB

Resolution

Yes, the support for the DB2 Groupid is called GSYSID in ACF2 for DB2. Using a masked sysid allows sharing of rules across multiple DB2 regions. If the SYSID's of the individual DB2 subsystems do not allow masking to be used for rule sharing, a group SYSID can be created to allow sharing of rules.

GSYSID is an optional field that specifies a one to four character string that will be used as the group SYSID. This field can be specified so that if multiple DB2 subsystems have the same value for the group SYSID, all of the subsystems will use the same resource rules. The value of the group SYSID (GSYSID) will be substituted as the SYSID() for a resource rule validation.

In the DB2 OPTS record for a DB2 region, the Group sysid is specified in field GSYSID.

Record ID

Fields

OPTS

ACTIVE|NOACTIVE GSYSID(1-4 character string-optional) BPLMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) DBSMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) FNCMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) PLNMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) PRCMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) SCHMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) SEQMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) STGMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) SYSMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) TBLMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) TSPMODE(ABORT|LOG|QUIET|RULE,norule,no$mode) TYPMODE(ABORT|LOG|QUIET|RULE,norule,no$mode)

 

A value can be assigned to the GSYSID field of the DB2 OPTS record. You will need to create rules using this value as the value of the $SYSID() field. If there is more than one DB2 subsystem with the same Group SYSID, each subsystem will be accessing the same rules.

Here is an example of a $SYSID in a rule:

$KEY(xxx.yyyyyy) 
$TYPE(TBL) 
$SYSID(sys1) 
UID(uid of user) SHIFT(test) - 
SERVICE(UPDATE) COLUMN(NAME,EXMPTION) ALLOW