The Set KGUP JCL Job Card panel appears. When you create the control statements and specify the data sets for KGUP processing, you submit the job to run KGUP. You submit a KGUP job stream to process control statements which modify a CKDS and output information to other data sets. The names of the data sets that KGUP uses are specified in the job stream.

1. To access the panels to create the KGUP job stream, select option 3 on the Key Administration panel, as shown in Figure 160, and press ENTER.
   Figure 160. Invoking KGUP by Selecting the Submit Option on the Key Administration Panel

    CSFSAM00 ----------------- ICSF - Key Administration ---------------
    OPTION ===> 3
   
   
       Enter the number of the desired option.
   
       1  Create         - Create key generator control statements
   
       2  Data Set       - Specify data sets for processing
   
       3  Submit         - Invoke Key Generator Utility Program (KGUP)
   
       4  Refresh        - Activate an existing cryptographic key data set
   
   
       Press ENTER to go to the selected option
       Press END   to exit to the previous panel
    

   See Figure 161. The first time you access this panel, the panel displays a JOB statement similar to the one that is shown in this example. ICSF displays your userid as the job name. From this panel you can create a job to run KGUP.

   Figure 161. Set KGUP JCL Job Card Panel

    CSFSAE30 --------------- ICSF - Set KGUP JCL Job Card --------------
    COMMAND ===> _
   
       S  - Submit the KGUP job stream for execution
       E  - Edit the KGUP job stream and issue the TSO SUBMIT command
   
            Note:  If you choose E, and want to submit the job stream with
            your changes, issue the TSO SUBMIT command before you leave the
            edit session; your updates to the job stream will NOT be saved.
   
       Enter or verify job statement information:
   
       ===> //LARSON  JOB (ACCOUNT),'NAME',MSGCLASS=C_____________________________
       ===> //*___________________________________________________________________
       ===> //*___________________________________________________________________
       ===> //*___________________________________________________________________
   
       Enter dsname of library containing Installation Exit Module:
   
       ===> ______________________________________________
   
       Special Secure Mode       ===> NO_  NO or YES
   
       Press END to exit to previous panel

2. Change the job statement according to the specifications of your installation.

   The line of the job control language that appears on this panel contains the job card that is needed to submit the job on the Job Entry Subsystem (JES). This panel displays some commonly used parameters that are installation dependent. A job name and the word JOB are the only required parameters on a job statement. All the other parameters are only required depending on your installation. You can delete or specify these parameters and add more parameters depending on the requirements of your installation. When you change the information that is displayed, ICSF saves these changes so they appear every time you display the panel.

   1. In the ACCOUNT parameter, enter accounting information as specified by your installation.
   2. In single quotes, enter the name that appears on the output of the job.
   3. In the MSGCLASS parameter, set the output class for the job log.

      When you specify the JOB statement information, the panel displays three comment lines where you can include any information about the job.

   4. If all the parameters do not fit on the first line, delete the * on the second line and continue the JOB statement parameters.
3. If your installation calls an installation exit during KGUP processing and the library containing the exit load module is not in the link list, specify the library in the “Enter dsname of library containing Installation Exit Module” field.

   Because the library must be an authorized library, the library must be defined in your installation's IEAAPFxx member.

4. If any of the control statements contain the CLEAR keyword, specify YES in the Special Secure Mode field. Otherwise, ICSF does not have to be in special secure mode, and you should specify NO in the Special Secure Mode field.
5. When you specify the necessary information, you can either:
   • Enter S to submit the job.

     KGUP creates the job stream and automatically submits the job to run the program.

   • Enter E to edit the job.

     KGUP creates the job stream and then displays the job stream on a panel in ISPF edit mode. Figure 162 shows an example of a panel in ISPF edit mode that contains a job stream to run KGUP. When ICSF creates the job stream, ICSF defines the data sets that KGUP uses in the job. It defines these data sets according to the information you specified on the Specify KGUP Data Sets Panel. Refer to Figure 159.

     1. On this panel, you can view the job stream ICSF created and make any necessary changes to the job stream.
     2. To submit your job with the changes, you must use the TSO SUBMIT command from the edit session. Type SUBMIT on the command line and press ENTER to submit the job and run KGUP.
     3. To return to the Set KGUP JCL Job Card panel without submitting the job stream, press END.

        The job stream is not saved when you leave this panel.

   Figure 162. KGUP JCL Set for Editing and Submitting (Files Exist)

    ISREDDE - SYS88218.T095045.RA000.LARSON.R0000002 ------------- COLUMNS 001 072
    COMMAND ===> _                                                SCROLL ===> CSR
    ****** ***************************** TOP OF DATA ******************************
    000001 //LARSON  JOB (ACCOUNT),'NAME',MSGCLASS=C
    000002 //*
    000003 //*
    000004 //*
    000005 //KGUP     EXEC PGM=CSFKGUP,PARM=('NOSSM')
    000006 //CSFCKDS  DD   DSN=LARSON.TEST.CSFCKDS,
    000007 //              DISP=OLD
    000008 //CSFIN    DD   DSN=LARSON.CSFIN.TESTDS1P(TEST),
    000009 //              DISP=OLD
    000010 //CSFDIAG  DD   SYSOUT=*
    000011 //CSFKEYS  DD   DSN=LARSON.TEST.CSFKEYS,
    000012 //              DISP=OLD
    000013 //CSFSTMNT DD   DSN=LARSON.TEST.CSFSTMNT,
    000014 //              DISP=OLD
    ****** **************************** BOTTOM OF DATA ****************************
    

Example of a KGUP job stream with existing data sets

The KGUP job stream in Figure 162 is an example of a job stream in which the data sets already exist.

In the EXEC statement of the job stream that ICSF created, the PGM parameter specifies that the job run KGUP. The PARM parameter notifies KGUP whether special secure mode is enabled. The keyword SSM indicates that the mode is enabled, and NOSSM indicates that the mode is not enabled.

The data definition (DD) statements identify the data sets that KGUP uses while processing. ICSF uses the names you provide on the Specify KGUP Data Sets panel. The cryptographic key data set (CSFCKDS) and the control statement input data set (CSFIN) have to exist prior to ICSF generating the job stream. The other data sets do not have to already exist. In the example that is shown on this panel, all the data sets existed prior to ICSF creating the job stream.

On the DD statements, the DSN parameter specifies the data set name. ICSF uses the name you provide on the Specify KGUP Data Sets panel for the data set name. The DISP parameter indicates the data set's status. On this panel, all the data sets existed prior to ICSF creating this job stream, therefore the job stream indicates a status of OLD for the data sets.

In Figure 162, the DD statement for the diagnosis data set (CSFDIAG) is different from the other DD statements. The SYSOUT=* parameter specifies that ICSF print the data set on the output listing.

Example of a KGUP job stream with non-existing data sets

Figure 163 shows an example of a panel in ISPF edit mode that contains a KGUP job stream where certain data sets did not exist previously.

 ISREDDE - SYS88218.T095045.RA000.LARSON.R0000003 ------------- COLUMNS 001 072
 COMMAND ===> _                                                SCROLL ===> CSR
 ****** ***************************** TOP OF DATA ******************************
 000001 //LARSON  JOB (ACCOUNT),'NAME',MSGCLASS=C
 000002 //*
 000003 //*
 000004 //*
 000005 //KGUP     EXEC PGM=CSFKGUP,PARM=('NOSSM')
 000006 //CSFCKDS  DD   DSN=LARSON.TEST.CSFCKDS,
 000007 //              DISP=OLD
 000008 //CSFIN    DD   DSN=LARSON.CSFIN.TESTDS2P(TEST2),
 000009 //              DISP=OLD
 000010 //CSFDIAG  DD   DSN=LARSON.TEST.CSFDIAG,
 000011 //              DISP=(,CATLG,CATLG),UNIT=SYSDA,
 000012 //              DCB=(RECFM=FBA,LRECL=133,BLKSIZE=13300),
 000013 //              SPACE=(TRK,(220,10),RLSE)
 000014 //CSFKEYS  DD   DSN=LARSON.TEST.CSFKEYS,
 000015 //              DISP=(,CATLG,CATLG),UNIT=SYSDA,
 000016 //              DCB=(RECFM=FB,LRECL=208,BLKSIZE=3328),
 000017 //              VOL=SER=TSO001,SPACE=(TRK,(60,10),RLSE)
 000018 //CSFSTMNT DD   DSN=LARSON.TEST.CSFSTMNT,
 000019 //              DISP=(,CATLG,CATLG),UNIT=SYSDA,
 000020 //              DCB=(RECFM=FB,LRECL=80,BLKSIZE=3200),
 000021 //              SPACE=(TRK,(60,10),RLSE)
 ****** **************************** BOTTOM OF DATA ****************************

The job stream contains information to create the diagnosis data set (CSFDIAG), key output data set (CSFKEYS), and the control statement output data set (CSFSTMNT) that did not previously exist. On the DISP parameter, the CATLG keyword specifies that you want the data set cataloged when the job ends normally and when the job ends abnormally. The unit parameter indicates the device you want the data set to reside on. The DCB parameter specifies the necessary data control block information such as the record format (RECFM), record length (LRECL) and block size (BLKSIZE).

When you submit the job, KGUP performs the functions you specified on the control statements. The functions KGUP performs change the CKDS. You can view the diagnostics data set to know whether KGUP successfully processed the control statements.