DFSMSrmm: Check how you control your RACF tape profile processing

Description

The currently supported releases of DFSMSrmm support the TAPEAUTHDSN parameter in the DEVSUPxx (device support) parmlib member; however, this support has required enhancements in z/OS V2R2 to be properly implemented.

Before z/OS V2R1, for TAPEAUTHDSN=YES, DFSMSrmm performed tape authorization checks in the DATASET class with DSTYPE=T to indicate to RACF that the check was for data sets on tape volumes and that RACF had to perform a check for discrete profiles.

With z/OS V2R2, DFSMSrmm correctly supports option TAPEAUTHDSN according to the documentation in z/OS MVS Initialization and Tuning Guide and in z/OS DFSMSrmm Implementation and Customization Guide. If TAPEAUTHDSN=YES is set, DFSMSrmm now performs authorization checking without DSTYPE=T. The RACROUTE is issued in the DATASET class as if for a DASD data set.

If you want to continue using your existing data set profiles (generic or discrete), you need to change your existing TAPEAUTHDSN settings. See Steps to take.

Table 1 provides more details about this migration action. Use this information to plan your changes to the system.

Table 1. Information about this migration action
Element or feature: DFSMSrmm
When change was introduced: z/OS V2R1.
Applies to migration from: z/OS V1R13.
Timing: Before the first IPL of z/OS V2R2.
Is the migration action required? Yes, if you have set up the RACF implementation.
Target system hardware requirements: None
Target system software requirements: None.
Other system (coexistence or fallback) requirements: None.
Restrictions: None.
System impacts: None.
Related IBM Health Checker for z/OS check: None.

Steps to take

Check to determine if you use the TAPEAUTHDSN=YES option in your DEVSUPxx parmlib member. If the option is specified, based on the RACF and DFSMSrmm configuration that you use with discrete data set profiles, you must prepare for a change in processing after you IPL V2R2.

If you want to continue using your existing data set profiles (generic or discrete), you need to exchange the current TAPEAUTHDSN settings:
  1. Change TAPEAUTHDSN=NO to TAPEAUTHDSN=YES to now make use of generic profiles.
  2. Change TAPEAUTHDSN=YES to TAPEAUTHDSN=NO to now make use of discrete profiles.

Reference information

For more information, see the following references:
  • See "Enhanced security for tape data sets" in z/OS MVS Initialization and Tuning Guide
  • See "Recommendations for using RACF tape profile processing" in z/OS DFSMSrmm Implementation and Customization Guide.
Parent topic: DFSMS actions to perform before the first IPL of z/OS V2R2