AO command security and system definition

Make specifications that affect AO command security in the TRANSACT macro or with initialization EXEC parameters.

For type-1 AO commands, the specifications that you make in the TRANSACT macro can be overridden using the AOI1= keyword in the startup procedure.

AOI=NO is ignored by type-2 AO application programs that use ICMD calls. You cannot disable the ability of a transaction to issue commands through type-2 AO application programs.

For both type-1 and type-2 AO application programs, you can specify the following user IDs for RACF and DFSCCMD0 to use for AO command authorization:

• The user ID that is signed on to the terminal that is issuing the transaction. Specify this with AOI=YES. Because a user ID is not always available for security checking, IMS™ can substitute an LTERM name, PSB name, or other identifier as the user ID. For more information, see User ID substitutions for AO application programs.
• The transaction code. Specify this with AOI=TRAN.
• The first three letters of the command name. Specify this with AOI=CMD.

To increase your options when implementing AO command security, you can define any one of the three elements involved in security checking—the user ID, the transaction, or the command—as the user to be authorized.

For AO security, commands issued through CMD and ICMD calls are typically defined as a resource and either the signed-on user or the transaction code is defined as the user. However, you can instead choose to define the command name as the user to be authorized and the transaction code as the resource to be protected. Changing which element is defined as the user might be beneficial when, for example, you have so many different transactions that it becomes impractical to add them all to the RACF security class for a command defined as a resource.

Related reading: For detailed information about the TRANSACT macro and the AOI= keyword parameter, see IMS Version 13 System Definition.