Preprocessing exits (ICHRFX01 and ICHRFX03)

There are two RACROUTE REQUEST=FASTAUTH preprocessing exits. In general, ICHRFX01 is used for non-cross-memory calls and ICHRFX03 is used for cross-memory calls.

Exceptions: ICHRFX03, if present, is always called instead of ICHRFX01, even in non-cross-memory mode, in the following situations:

A FASTAUTH request is invoked for the UNIXPRIV or FSACCESS class.
The ACEEALET or ENVRIN operand is specified.
A supervisor state or system key caller provides a nested ACEE on a FASTAUTH request. It does not matter whether the nested ACEE is processed; for example, if the client is authorized or the resource is not delegated, ICHRFX03 is still called. For information about nested ACEEs and delegated resources, see the section on delegated resources in z/OS Security Server RACF Security Administrator's Guide.

The preprocessing exits are entered before the RACROUTE REQUEST=FASTAUTH service routine performs authorization checking.

Note: Although RACF® might perform two authorization checks for a nested ACEE, ICHRFX03 is only called once, before either check occurs.