Endevor default parameter UIDLOC implications

Products

• Endevor

Issue/Introduction

Parameter UIDLOC in C1DEFLTS TYPE=MAIN macro is documented in the defaults table description .

It consists of two subparameters, UIDLOC=(start,length), which define a substring of the endevor userid (the TSO userid or the security ID assigned to the batch job) .

The manual states that this substring (also known as "masked userid") is used to determine element ownership for element signin/signout processing.

This is not the only use of the masked userid.

 

Environment

Release : 19.0

Resolution

The masked userid is used for other purposes in the endevor logic

SMF recording

The masked userid defined as per UIDLOC is written to the SMF records which endevor creates at the completion of actions when SMF action recording is enabled for the environment affected by the action.

These SMF records are subsequently used to print report CONRPT42 (Element Activity Profile). 

This may be a bit confusing because:

• Depending on the UIDLOC setting, the userid reported by CONRPT42 could not be easily matched with the userid reported by CONRPT40 (Security Violation Profile) which shows the MVS userid who incurred the violation.
• The same consideration applies to the records extracted by functions LIST SMFDATA ACTIVITY and LIST SMFDATA SECURITY of the CSV (comma-separated value) utility, which contain the same information than reports CONRPT42 and CONRPT40 respectively.
• If the UIDLOC parameter is changed, this will affect the SMF records written after the change while previous SMF records will remain unchanged. Consequently, report CONRPT42 as well as LIST SMFDATA ACTIVITY will produce inconsistent results when the reported date range includes the point in time when UIDLOC was changed

Package processing

The masked userid is used to set the package owner (creator) as well as any package approvers.

Apart from package approval (that needs to be done by the approvers), if C1DEFLTS parameter PKGSEC= is set to APPROVER, this might influence who can edit non-sharable packages before CAST and action a package after it has been cast

User exits

The masked userid is passed to user exits and package exits in fields:

• ECBUSER (assembler) or ECB-USER-ID (cobol) for non package exits (exit numbers 01 to 06)
• PECBUSER (assembler) or PECB-USER-BATCH-JOBNAME (cobol) for package user exits (exit number 07)

*** IMPORTANT ***

User exit 05 (which is called during endevor initialization) has the possibility of setting the endevor userid to be used in the run. If this happens, the userid set by the exit is used unchanged and is NOT edited with whatever is set in the UIDMASK parameter.

Email messages

Whenever endevor sends an email to another user (for example, for regression alerts or signout override warnings), the masked userids are used to set the email recipient and are placed in the message body.