Audit ALT-ACID Resource Class

Products

• Top Secret

Issue/Introduction

How do you audit the ALT-ACID resource class, which is used for acid cross-authorization?

TSS ADD(AUDIT) ALT-ACID(acid) is accepted, but nothing is audited.

Resolution

Here is the way to audit cross-authorization:

1. Set LOG(ACCESS) control option on submitting facility
   
   
2. AUDIT attribute on submitting facility
   
   
3. AUDIT attribute on submitting user
   e.g. TSS ADD(acid) AUDIT
   
   
4. ACTION(AUDIT) on the permit granting access
   e.g. TSS PER(ACID1) ACID(ACID2) ACTION(AUDIT)
   
   
5. NOSUBCHK on submitting user.
   e.g. TSS ADD(acid) NOSUBCHK

There are no other ways to create audit records for cross authorization checks.

In particular, there is no way (and never has been any way) to use the AUDIT record to audit these checks.

The resource class ALT-ACID simply exists to support resource checking for acid cross authorization.

Since ALT-ACID is in the RDT, issuing a PERMIT in the class or adding it to the AUDIT record is accepted as valid syntax.

The entry in the RDT allows the resource class to be used in a RACROUTE call, but is treated as a request to check the acid cross authorization and not to treat the call as a resource check in the ALT-ACID resource class.

Additional Information

See Maintain the RDT Record for more information about the Top Secret RDT.