RACF violation on BPX.SMF CL(FACILITY) OM Web Viewer 14.0 startup task

Products

• Output Management Web Viewer

Issue/Introduction

Seeing RACF violations in the Web Viewer Startup task for users accessing reports using OM Web Viewer to view reports.

ICH408I USER(EAXXXXX  ) GROUP(<group> ) NAME(<firstname>, <lastname>

  BPX.SMF CL(FACILITY)

  INSUFFICIENT ACCESS AUTHORITY

  ACCESS INTENT(READ   )  ACCESS ALLOWED(NONE   )

The RACF team is reluctant to grant universal read access to BPX.SMF profile as there is some risk as indicated below:

"There is some risk associated with the profile and you would not typically grant a UACC of READ. We are exploring applying the STIG standards and they have a control specifically for BPX.SMF (The IBM z/OS BPX.SMF resource must be properly configured.). If the SMF records do need to be created and we can figure out what type they are, we could at least limit the access to only that SMF type as per the link."

According to documentation:

SMF Records

If you want OM

Web Viewer 

to create SMF records to monitor usage, appropriate security permissions are required for the IBM BPX1SMF service. Both the

Web Viewer 

application server and the logged in user must have permission to the BPX.SMF resource profile in the FACILITY class. Use the following commands:

 

RDEFINE FACILITY BPX.SMF UACC(NONE) PERMIT BPX.SMF CLASS(FACILITY) ID(

stcid

) ACCESS(READ) PERMIT BPX.SMF CLASS(FACILITY) ID(

userid

) ACCESS(READ) SETR RACLIST(FACILITY) REFRESH

• Is there a way to limit the access to a specific SMF record type for Web Viewer?
• Can you turn off the option of creating SMF records for Web Viewer users?

Environment

• Output Management Web Viewer 14.0
• Output Management Web Viewer™ for z/OS
• IBM RACF

Resolution

It is not possible to limit the access to a specific SMF record type for Web Viewer.
It is not possible to turn off the option of creating SMF records for Web Viewer users.