SSM SHUTCICS fails due to RACF authorization errors in OPS/MVS

Products

• OPS/MVS Event Management & Automation

Issue/Introduction

This article addresses authorization failures encountered when utilizing System State Manager (SSM) within OPS/MVS to automate the shutdown of CICS regions, specifically when RACF authorization errors prevent the execution of shutdown procedures.

Symptoms

• SSM SHUTCICS procedure fails.
• RACF authorization errors (e.g., insufficient authority to execute CEMT transactions or system commands).
• Errors occur across multiple CICS regions when automated shutdown is initiated.

Environment

• OPS/MVS Event Management & Automation
• CICS Transaction Server
• RACF/External Security Manager

Cause

When issuing a MODIFY command to CICS, the task executes under the CICS region user ID by default, unless explicit sign-on configurations are utilized. The CICS region ID often lacks the necessary security clearances to execute system commands like CEMT or access required consoles.

Resolution

To force the CICS command to execute under a specific authorized ID rather than the default CICS region ID, leverage both CA OPS/MVS and CICS Console Security configurations.

1. Route via a Dedicated Console in OPS/MVS Target a dedicated console name defined to CICS using the CONNAME keyword in your OPS/MVS rule or REXX program: ADDRESS OPER "COMMAND(F CICS####,CEMT I TAS) CONNAME(OPSCICS1)"

2. Bind the Console to the Authorized ID in CICS Explicitly instruct the CICS region to treat that specific MVS console as an autoinstalled console terminal mapped permanently to the desired user ID. Define this in the CICS System Initialization Table (SIT) or via CEDA:

   • Define a terminal console profile where USERID is explicitly hardcoded to the authorized user.
   • Alternatively, configure CICS Console support to sign on dynamically using USERID(*EVERY).
     This forces CICS to intercept the z/OS security context transmitted by the system command and run the transaction (CEMT) under the specific ID that initiated it.

3. Grant ESM Security Clearances (RACF) Configure security rules across three layers:

   • MVS Operator Console: Authorize the ID passed from CA OPS/MVS to execute the MVS MODIFY command targeting the CICS region address space (OPERCMDS class).
   • CICS Transaction Execution: Grant execution clearance for CEMT within the CICS transaction resource class (e.g., TCICSTRN).
   • Console Identity: Ensure the console definition contains USERID(*EVERY). This allows CICS to trust the identity passed from the z/OS system console, bypassing the need for surrogate user checks (SURROGAT class).

NOTE: Security configurations must be reviewed and verified by your CICS and security teams.