What is the ACF2 syntax to run IBM azfbulkcmd.sh command using /bin/tsocmd in a unix shell?

Products

• ACF2 - z/OS

Issue/Introduction

Using MFA bulk provisioning unix program provided by IBM for converting users to MFA.  A configuration file azfbulkcmd.sh is provided but gives all directive to ESM equivalents with RACF translation.

In order to convert the translation to ESM=ACF2, the commands to ACF2 need to run using the unix tsocmd program.

What is the syntax to run the same command using /bin/tsocmd in a unix shell to ACF2?

Sample command in azfbulkcmd.sh

/bin/tsocmd "ALU $2 MFA(FACTOR($3) NOACTIVE NOPWFALLBACK NOTAGS)"

Where $2 would be the userid/logonid; $3 would be the MFA factor name -- variables specified as arguments on the unix command.

 

Environment

Release : 16.0

Resolution

ACF2 equivalent to  'IBM Sample command in azfbulkcmd.sh'.

/bin/tsocmd "ALU $2 MFA(FACTOR($3) NOACTIVE NOPWFALLBACK NOTAGS)"

Where $2 would be the userid/logonid; $3 would be the MFA factor name -- variables specified as arguments on the unix command.
What is the syntax to run the same command using /bin/tsocmd in a unix shell to ACF2?

The ACF2  ACFUNIX Utility in USS can be used similar to the TSO command, but there is USS configuration that needs to be done, which consists of creating a symbolic link to find the utility and adding the directory that contains the symbolic link to the PATH:

1. Create a symbolic link from the ACFUNIX load module to a USS file named acfunix from a directory that you have write access:
   
   ln -e ACFUNIX ./acfunix
   
   
2. Add the directory that contains the symbolic link to the PATH:
   
   export PATH=$PATH:/u/users/acf2cmd
   
   
3. Run the command from OMVS:
   
   acfunix "list user"
   
   As with the TSO command, you can also string multiple commands together using the MULT keyword and tilde character. For example:
     acfunix "MULT set control(gso)~list opts"   
   or
    acfunix "MULT set control(gso)~list opts~set lid~list user_here"

Once USS is configured the appropriate ACF commands can be issued from OMVS, for example.

Create an MFA user profile data record:

From TSO:

SET PROFILE(USER) DIVISION(MFA)
INSERT USER01.FACTORNAME ACTIVE TAGS(TSTUSERID:BobS)

From OMVS:

acfunix "MULT SET PROFILE(USER) DIVISION(MFA)~INSERT USER01.FACTORNAME ACTIVE TAGS(TSTUSERID:BobS)"  

To allow or prevent password fallback during factor authentication downtime, issue the following command:

From TSO:

SET LID
CHANGE userid FALLBACK|NOFALLBACK

From OMVS:

acfunix "acfunix "CHANGE userid NOFALLBACK"