Invoking the security authorization facility (SAF)

The security authorization facility (SAF) is the component of MVS™ that verifies a user's authorization to resources. These resources include commands, data sets, jobs, nodes, printers, card readers, remotes, SYSIN, and SYSOUT. SAF verifies the authorization by routing requests to the Resource Access Control Facility (RACF®) or any functionally equivalent security product. RACF determines if the user has authority to a particular resource.

All JES2 resources have profile names in a specific format. See z/OS JES2 Initialization and Tuning Guide for examples of profile names.

JES2 invokes SAF when attempting to access a resource on behalf of itself or a user. An installation can enhance SAF verification through:

Exits 36 and/or 37
Additional calls to SAF through $SEAS
Defining additional resource names and verifying those resources through SAF. The security administrator must then define the required resources to RACF in specific resource classes.