z/OS Security Server RACF System Programmer's Guide
Previous topic | Next topic | Contents | Contact z/OS | Library | PDF


Profile mismatch

z/OS Security Server RACF System Programmer's Guide
SA23-2287-00

A mismatch can occur between an identity mapping profile and the corresponding USER profile if you specify an application user name for a user, and that name has already been specified for another user. The USER profile for the second user is updated, but the identity mapping profile is not. This results in two USER profiles pointing to the same identity mapping profile, but the identity mapping profile refers only to the first user for whom the application user name was specified. If ADDUSER or ALTUSER command processing detects a profile mismatch, it issues message IRR52154I, identifying the mapping profile and USER profile that conflict. To correct the situation:
  1. Determine the first user ID that was assigned the application user name.
    • If the application user name contains lowercase letters, use the RLIST NOTELINK * command or the RLIST NDSLINK * command in the background and direct the command output to a data set. You can then use the TSO EDIT FIND command to locate the application user name in the data set. You can find the user ID in the application data field of the resource profile for the NOTELINK or NDSLINK class.
    • If the application user name contains only uppercase letters, issue the RLIST NOTELINK application-user-name or RLIST NDSLINK application-user-name command, using the terminal monitoring program (TMP). You can find the user ID in the application data field.
  2. Issue an ALTUSER command with the NOLNOTES or NONDS operand for the first user ID to temporarily delete the user's identity mapping profile.
  3. Select a new application user name for the second user ID and issue an ALTUSER command to associate the user ID with the new application user name.
  4. Issue an ALTUSER command again for the first user ID and specify the user's original application user name. This command recreates the original user's identity mapping profile that was deleted in step 2.

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014