How can a help desk user to be setup to unsuspend users and change PASSWORD, PSWD-VIO, and any other fields?
Beginning with Rel 15.0 CA-ACF2 was enhanced to allow end users who do not have any special logonid privileges to issue
the ACF CHANGE subcommand in TSO/E or batch (including ACFBATCH) to change certain user related fields
if they have the proper access to the ACFCMD.USER.fieldname resource in the CASECAUT class.
An end user can only change user related fields for other end users. An end user is a user who does not have SECURITY, ACCOUNT, AUDIT, LEADER or CONSULT, special ACF2 logonid privileges. This is described in the CA-ACF2 documentation set (https://techdocs.broadcom.com/) in section, "Identifying Who Can Maintain Logonid Records".
Here is a list of lid fields that can be changed and the resource name that is validated:
PASSWORD ACFCMD.USER.PASSWORD
PWPHRASE ACFCMD.USER.PWPHRASE
PWP-VIO ACFCMD.USER.PWP-VIO
PSWD-VIO ACFCMD.USER.PSWD-VIO
PSWDCVIO ACFCMD.USER.PSWDCVIO
KERB-VIO ACFCMD.USER.KERB-VIO
CANCEL ACFCMD.USER.CANCEL
SUSPEND ACFCMD.USER.SUSPEND
To implement the CASECAUT validations...
Step 1. Add AUT to the INFODIR:
TSO ACF
SET CONTROL(GSO)
CHANGE INFODIR TYPES(R-RAUT) ADD
F ACF2,REFRESH(INFODIR)
Step 2. Write the resource rules:
$KEY(ACFCMD) TYPE(AUT)
USER.PASSWORD UID(uid string of user) ALLOW
USER.PSWD-VIO UID(uid string of user) ALLOW
Step 3. After you compile the records, load the new rules into storage:
F ACF2,REBUILD(AUT)
Note that a user with authority to the casecaut resource can only change other users at the same level or lower.
which would mean that a user with account authority can only modify users with account or lesser authority.
e.g. ACCOUNT, AUDIT, LEADER, or CONSULT will be needed
There should always be at least two un-scoped security administrators defined in an ACF2 database so that there is
always someone available that can change an unscoped security administrator if needed. .