CAS9034E and SVCA-06 errors with SASSTRLR after RACF conversion - CA 7 Workload Automation

Products

• CA 7 Workload Automation

Issue/Introduction

Receiving the SUBMIT SECURITY NOT DEFINED, OPID CHECKING BYPASSED error messages in the trailer step processing or job logs:

CAS9034E - FUNCTION(RESCHECK) CLASS SPECIFIED IS NOT DEFINED
SVCA-06 (####) SUBMIT SECURITY NOT DEFINED, OPID CHECKING BYPASSED

This issue occurs even after updating the SCLASS parameter in the CA 7 initialization SECURITY statement.

Environment

Release: 12.0, 12.1

Component: WA CA 7 Edition

Cause

This issue occurs because the mandatory resource class for CA 7 SU@MIT is not defined in the RACF environment after the CA 7 product security converted from ACF2 to RACF.

The external programs like SASSTRLR run outside of CA 7. These programs make security calls using the default SUBMIT resource class (which translates to SU@MIT) and do not honor the SCLASS parameter defined in the CA 7 initialization file.

Resolution

To resolve the security errors, perform the following:

1.  Add the SUBMIT resource class SU@MIT rule to the IBM RACF Class Descriptor Table (CDT).

2. Ensure the user ID submitting the job (e.g., ####) has explicit RACF authority to submit jobs on behalf of the user ID used in the trailer step (e.g., #####).

 

Additional Information

Refer to the Knowledge article for additional details on adding the SU@MIT rule:

A CAS9034E message may be generated when using CA-7 resource class(es) after converting to RACF