)CM
)DEFAULT )&?![^]
)CM
/* REXX ----------------------------------------------------------- */
/* ================================================================ */
/*                                                                  */
/* COPYRIGHT =                                                      */
/* Licensed Material - Property of IBM                              */
/*                                                                  */
/* 5724-I63, 5724-H88, 5655-N01, 5733-W61                           */
/* (C) Copyright IBM Corp. 1999, 2006                               */
/* All Rights Reserved                                              */
/* US Government Users Restricted Rights - Use, duplication or      */
/* disclosure restricted by GSA ADP Schedule Contract with IBM Corp.*/
/*                                                                  */
/*                                                                  */
/* FUNCTION:                                                        */
/*   WebSphere for z/OS Sample RACF group definitions               */
/*                                                                  */
/* ================================================================ */
/* This is a sample exec which customers may modify to include      */
/* installation specific RACF requirements.  This exec defines      */
/* all the userids and groups that are necessary and sufficient     */
/* for installing WebSphere and running the Initial Verification    */
/* Program (IVP).                                                   */
/* Additionally, there are commented sections for other components  */
/* that might be used (for example, SSL).                           */
/*                                                                  */
/*==================================================================*/
/* This EXEC either:                                                */
/*    - generates a set of RACF commands in the form of a REXX exec */
/*      which is written to the RACFCMDS DD statement. Any error or */
/*      warnings for Exec processing will be written to SYSTSPRT DD */
/*         or                                                       */
/*    - creates and executes the RACF commands generated here.      */
/*      in this case, all output is directed to SYSTSPRT DD         */
/*                                                                  */
/* THE SETTING OF THE *switch* VARIABLE CONTROLS THIS.              */
/*==================================================================*/
/*                                                                  */
/* NOTE: This sample is biased toward getting WebSphere installed   */
/* and running quickly on a test system.  You should reexamine the  */
/* the values (especially the UACC values) when moving to           */
/* production.                                                      */
/* ---------------------------------------------------------------- */
/* Basic Assumptions -                                              */
/*                                                                  */
/* RACF access will be at the group level rather than the userid    */
/* to minimize the number of RACF definitions.                      */
/*                                                                  */
/* Each controller region will have its own unique userid. The      */
/* WebSphere controller regions are:                                */
/*     Daemon                                                       */
/*     AppServer                                                    */
/*     Deployment Manager                                           */
/*                                                                  */
/* All of the above controller regions' userids will be in the same */
/* RACF group.                                                      */
/*                                                                  */
/* Initially, the servant regions will run under the same user ID;  */
/* all servant user IDs will be in the same group.                  */
/*                                                                  */
/* STEPS TO USING THIS EXEC                                         */
/*                                                                  */
/* 1. Indicate if you want to generate a dataset with RACF          */
/*    commands or issue them directly from this exec.               */
/* 2. You must supply a logstream dataset name, and a DB2           */
/*    subsystem name.                                               */
/* 3. Review the supplied values for all the needed userids and     */
/*    RACF groups.  You can use the values provided or change them. */
/* 4. Determine which optional security mechanisms you wish to      */
/*    enable, and modify values as needed for these.  See the       */
/*    comment 'Optional Security Mechanisms'                        */
/* 5. Modify and run the job BBOCBRAJ in the your CNTL PDS ...      */
/*      &TRGHLQ..CNTL.                                              */
/*    The results of the job can be seen in the SYSPRINT output.    */
/*    If you generate command output, that will be in RACFCMDS DD.  */
/*                                                                  */
/* Usage notes:                                                     */
/*                                                                  */
/* -The definitions defined here are sufficient to get the basic    */
/*  WAS system up and running and to run the IVP.                   */
/*                                                                  */
/* -If you are using this EXEC to migrate your installation from    */
/*  WebSphere V5 to WebSphere V6, it is recommended that you route  */
/*  RACF command output to a dataset rather than executing the      */
/*  commands directly.                                              */
/*                                                                  */
/* -Similarly, if you wish to use this EXEC to control access to    */
/*  the OPERCMDS class, it is recommended that you route RACF       */
/*  command output to a dataset rather than executing the commands  */
/*  directly.                                                       */
/*                                                                  */
/* - If you output RACF commands into a dataset, the output will    */
/*  be formatted as a simple rexx EXEC. Code this output dataset    */
/*  in the SYSEXEC DD statement of the JCL invoking the IKJEFT01    */
/*  program.(BBOCBRAJ in your CNTL PDS also invokes IKJEFT01.)      */
/*                                                                  */
/* -If multiple WebSphere systems are running in the same security  */
/*  environment, all controller region and servant regions can have */
/*  unique identities merely by incrementing the number at the      */
/*  the end of the name prefix.                                     */
/*                                                                  */
/* -WSGUEST and WSADMIN are special userids and it is easiest to    */
/*  use these names asis.  See WebSphere Installation and           */
/*  Customization for more information.                             */
/*                                                                  */
/* -default_WS_CFG_group is used as the group id of the WebSphere   */
/*  configuration files in the hfs, all users which are connected   */
/*  to this group will have read access to the configuration files. */
/*  Therefore, this group doesn't need any explicit permits.        */
/*                                                                  */
/* -During installation, if you change the server short name to use */
/*  a prefix other than the BBO* default, you must create your own  */
/*  non-default RACF SAF profile using the non-default prefix. For  */
/*  more information, see "Understanding System Authorization       */
/*  Facility profile names generated by the Customization Dialog"   */
/*  in the WebSphere Application Server Information Center located  */
/*  at:                                                             */
/*                                                                  */
/*  www-306.ibm.com/software/webservers/appserv/zos_os390/library   */
/*                                                                  */
/* ---------------------------------------------------------------- */
/*  Change History:                                                 */
/*                                                                  */
/*  $L0=7677    H28K510 000324  PDRA: Created                       */
/*  $L1=OW46650 H28W400 001120  PDOC: Put Default values in quotes  */
/*  $L2=OW45800 H28W400 001120  PDOC: Permit IVP_CR to LOGSTRM      */
/*  $L3=WS14568 H28W500 030213  PDG1: Support for V5                */
/*  $P1=MD15996 H28W500 030303  PDG1: Support for WSADMIN           */
/*      MD16189 H28W500 030327  PDML: split skeleton.               */
/*      MD16547 H28W500 030403  PDG1: remove daemon server/cbind    */
/*      MD16604 H28W500 030403  PDG1: update started task           */
/*      MD16362 H28W500 041003  PDG1: echo command before invoke    */
/*      MD16761 H28W500 041103  PDG1: fix started task              */
/*      MD16971 H28W500 050503  PDOC: enable SSL unconditionally    */
/*                                    create SAF EJBROLES for       */
/*                                    WAS administration            */
/*                                    Restricted user profiles      */
/*                                    Restructure for WS Sec on     */
/*      MD17040 H28W500 050703  PDG1: Update SERVER for WLM-DAE     */
/*      MD17166 H28W500 051603  PDG1: Change echo to use single str */
/*      MD17013 H28W500 052103  PDML: Change Server Ids to Protected*/
/*      MD16475 H28W500 053003  PDOC: Add CosNaming Profiles        */
/*      MD17248 H28W500 053003  PDOC: Give APPL permission to Guest */
/*      MD17349 H28W500 061303  PDOC: Make Server DN unique         */
/*      WS15621 H28W502 080603  PDRZ: Multi-node support. Some      */
/*                                    functions moved to BBOSBRAC   */
/*      MD17453 H28W502 091203  PDRZ: Asynch Admin STARTED profile  */
/*      WS17709 H28W502 093003  PDGK: JSSE 501 rollup               */
/*      MD18098 H28W502 091603  PDRZ: Daemon SSL keyring, certs     */
/*      MD18731 H28W502 120103  PDRZ: keyring for asynch admin user */
/*      MD18997 H28W510 012004  PDOC: Add WLM permission for WBIFZ  */
/*      PQ86559 H28W502 072304  PDSS: RACF BBO* SAF profile names   */
/*      247142  H28W600 121004  PDOC: Add Control Region Adjunct    */
/*      250035  H28W601 011704   DB:  Text updates for V6           */
/*                                    Remove reference to keymask   */
/*      251673  H28W601 012505    DB: Change v5/v6 to V5/V6         */
/*      249948  H28W601 012805  PDML: update CRA.                   */
/*      250152  H28W601 020105    DB: create keyring for for servant*/
/*      255429  H28W601 021605    DB: update FILEPROC to 10000      */
/*      258304  H28W601 031005    DB: connect WAS CA to CRA keyring */
/*      253275  H28W602 041505    DB: remove CTRACE references      */
/*      260883  H28W601 042005    DB: permit default application    */
/*                                    environment to CRA userid     */
/*      279429  H28W602 052705  PDML: update home.                  */
/*      281074  H28W602 060305  PDML: update home.                  */
/*      283304  H28W602 061305  PDML: remove USERHOME.              */
/*     PK07374  H28W602 062105  PDML: update home.                  */
/*    LIDB2634  H28W610 082405  PDML: security out of box update.   */
/*      309640  H28W610 093005  kvijai: Update CosNaming roles and  */
/*                                 add adminsecuritymanager and     */
/*                                 deployer role to EJBROLE         */
/*      311865  H28W610 100805    DB: create asynch user always,    */
/*                                    add logic for SSL on daemon   */
/*      313369  H28W610 101305    DB: missing end on an if stmt     */
/*      326125  H28W610 112805    DB: Certificate CN should be      */
/*                                    Daemon IP name                */
/*      326137  H28W610 112905    DB: Remove excess ADDRING call    */
/*      330975  H28W610 121405    DB: user cell_name for cert LABEL */
/*     330975.1 H28W610 011006    DB: fix item missed with 330975   */
/*      342405  H28W610 013006    DB: always create async profile   */
/*      348726  H28W610 022006  kvijai: update BBO.TRSTAPPS profile */
/*                                          to BBO.TRUSTEDAPPS.     */
/*      348730  H28W610 022006  kvijai: change BBO.SYNCID  profile  */
/*                                          to BBO.SYNC.            */
/*    350729.1  H28W610 030206    DB: use config group for SYNC and */
/*                                    TRUSTEDAPPS                   */
/*      354300  H28W610 032106    DB: define All#Role for Default   */
/*                                    App                           */
/*      352836  H28W610 032706    DB: need to gencert for CRA id    */
/*      358773  H28W610 032906    DB: connect cert for CRA id       */
/*      362158  H28W610 041206    DB: use NOPASSWORD/NOOIDCARD for  */
/*                                    admin and unauth ids          */
/*      354695  H28W610 041206    DB: remove setupOperCmds routine  */
/*      362400  H28W610 041206    DB: remove 3-part SERVER profiles */
/*      360439  H28W610 041306  kvijai: explain generated RACF cmds */
/*      364225  H28W610 042106    DB: remove All Role               */
/*      369495  H28W610 060406    DB: use generic CBIND profile     */
/*      348320  H28W610 060506    DB: auto UID/GID support          */
/*      371657  H28W610 060706    DB: add refresh for APPL class    */
/*      368332  H28W610 060706    DB: change CB390 to CBS390        */
/*----------------------------------------------------------------- */
)BLANK
issue_cmds_switch = ''
parse upper arg parms
)BLANK
/*------------------------------------------------------------------*/
/* Specify whether to execute commands immediately or write them    */
/* to a file.                                                       */
/*------------------------------------------------------------------*/
parse upper var parms . "ISSUECMDS(" issue_cmds_switch ")" .
issue_cmds_switch =strip(issue_cmds_switch)
if issue_cmds_switch = "Y" then switch = "issuecmds"
else switch = "generatecmds"
)BLANK
/*-----------------------------------------------------------------*/
/* Define a group to own the files in the WAS configuration HFS.   */
/* Controller regions (which run authorized code) also need to     */
/* have this as their default group, since they update the HFS.    */
/* Add anyone to this group that needs access to HFS configuration */
/* files or administrator access.                    @MD16594.1C   */
/*-----------------------------------------------------------------*/
default_WS_CFG_group                    = "&CNFGGRP"
default_WS_CFG_GID                      = "&CNFGGID"
)BLANK
/*-----------------------------------------------------------------*/
/* Define a group for WebSphere servant region user IDs.           */
/* These regions run application code but need some common         */
/* permissions, which are granted to this group.                   */
/*-----------------------------------------------------------------*/
default_WS_SR_group                     = "&ALLGRPS"
default_WS_SR_GID                       = "&ALLGIDS"
)BLANK
/*-------------------------------------------------------*/
/* Define a user ID to run asynchronous administrative   */
/* tasks.                                                */
/*-------------------------------------------------------*/
default_asynch_admin_userid = "&AAOPUSR"        /*@MD17453A*/
default_asynch_admin_uid    = "&AAOPUID"        /*@MD17453A*/
default_asynch_admin_proc   = "&AAOPROC"        /*@MD17453A*/
)BLANK
/*------------------------------------------------------------------*/
/* Define a group for local clients and unauthorized user IDs -     */
/* i.e. any local user IDs that need some minimal access to the     */
/* cell.                                                            */
/*------------------------------------------------------------------*/
default_WS_unauth_group                 = "&ALLGRPD"
default_WS_unauth_GID                   = "&ALLGIDD"
)BLANK
default_daemon_CR_proc_name                = "&DMNPRCC"
default_daemon_CR_userid                   = "&DMNUSRC"
default_daemon_CR_UID                      = "&DMNUIDC"
default_daemon_CR_GID                      = default_WS_CFG_GID
default_daemon_generic_server_name         = "&DMNJNAME"     /* @MD16604C*/
)BLANK
default_appServer_CR_proc_name             = "&ASPRCC"
default_appServer_SR_proc_name             = "&ASPRCS"
default_appServer_CR_userid                = "&ASUSRC"
default_appServer_CR_UID                   = "&ASUIDC"
default_appServer_CR_GID                   = default_WS_CFG_GID
default_appServer_SR_userid                = "&ASUSRS"
default_appServer_SR_UID                   = "&ASUIDS"
default_appServer_SR_GID                   = default_WS_SR_GID
default_appServer_cluster_name             = "&ASCTN"        /* @MD16604C*/
default_appServer_server_jobname           = "&ASSSNS"
default_appServer_server_jobname_SR        = "&ASSSNS"||"S"  /* @MD16604A*/
default_appServer_adjunct_userid           = "&AJUSRS"       /* @247142 A*/
default_appServer_adjunct_UID              = "&AJUIDS"       /* @247142 A*/
default_appServer_adjunct_procname         = "&AJPRCS"       /* @247142 A*/
default_appServer_adjunct_jobname          = "&ASSSNS"||"A"  /* @247142 A*/
)BLANK
cell_name                                  = "&ASCENS"
daemon_ipname                              = "&DMNIPNAM"
enable_daemon_ssl                          = "&DAESSL"         /*xxxxxxA*/
)BLANK
/* Optional SSL related variables.                       */
/* If you are using Kerberos, or any other SSL related   */
/* transport, we set up a test Certificate authority.    */
/* with a label name as defined here.                    */
WS_TestCA                   = "&CALAB"        /*@WS15621C*/
WS_generate_CA_cert         = "&CAGEN"
ws_cert_expiration_date     = "&CAEXPDAT"     /*@WS15621A*/
)BLANK
Appsrvr_keyring             = "&ASKEYR"
Daemon_keyring              = "&ASKEYR"       /*@MD18098A*/
)BLANK
/*------------------------------------------------------------------*/
/* Specify the name of the error log stream.                        */
/*------------------------------------------------------------------*/
default_logstream_name                  = "&ERRLOG" /*none pokvmtl5 */
)BLANK
/*------------------------------------------------------------------*/
/* Provide your DB2 subsystem name for DSNR support.                */
/*------------------------------------------------------------------*/
default_DB2_ssname                      = "&DB2SSID"
)BLANK
)SEL &BBOWST = FS
/*-------------------------------------------------------*/
/* WebSphere family security has been selected.          */
/* Additional variables are defined here.                */
/*-------------------------------------------------------*/
)BLANK
/*-------------------------------------------------------*/
/* Define an administrator user ID to WebSphere.         */
/* No corresponding RACF user ID is created.             */
/*-------------------------------------------------------*/
default_WS_admin_userid                 = "&WASADMN"
default_WS_admin_userid_password        = "&WASPW"
default_WS_admin_UID                    = "&WASUID"
)BLANK
/*-------------------------------------------------------*/
/* End of setup for WebSphere family security.           */
/*-------------------------------------------------------*/
)BLANK
)ENDSEL
)SEL &BBOWST = ZS
/*-------------------------------------------------------*/
/* WebSphere for z/OS security has been selected.        */
/* Additional variables are defined here.                */
/*-------------------------------------------------------*/
)BLANK
/*-------------------------------------------------------*/
/* Optional - specify a security domain name.            */
/*-------------------------------------------------------*/
security_domain_qualify     ="&USEDOMN"       /*@WS15621A*/
security_domain_name        ="&DOMAINNM"      /*@WS15621A*/
if (security_domain_qualify = "Y") && (security_domain_name <> "")
    then do
      domain_postfix = "." || security_domain_name
      domain_prefix = security_domain_name || "."
      domain = security_domain_name
    end
    else do
      domain_postfix = ""
      domain_prefix = ""
      domain = "CBS390"
    end
application_id = domain
)BLANK
/*-------------------------------------------------------*/
/* Define an administrator user ID to WebSphere and RACF.*/
/* It must have the config group as its default group.   */
/*-------------------------------------------------------*/
default_WS_admin_userid                 = "&WASADMN"
default_WS_admin_userid_password        = "&WASPW"
default_WS_admin_UID                    = "&WASUID"
)BLANK
/*------------------------------------------------------------------*/
/* Define one default unauthorized-client ID to be used by all the  */
/* regions.  If you want unique IDs for different regions (DMgr,    */
/* and so forth) then you will define them similarly, and connect   */
/* them to the unauthorized client group specified above.           */
/*------------------------------------------------------------------*/
default_WS_unauth_userid                = "&ALLUSRD"
default_WS_unauth_UID                   = "&ALLUIDD"
)BLANK
/*-------------------------------------------------------*/
/* End of setup for WebSphere for z/OS security.         */
/*-------------------------------------------------------*/
)BLANK
)ENDSEL
/*-------------------------------------------------------*/
/*    Optional security mechanisms?  "Y" or "N"          */
/*-------------------------------------------------------*/
/* do you use the DSNR class to protect DB2 resources?   */
UseDB2DSNR = "N"
)BLANK
/* do you want to protect use of Operator Commands       */
/* which are needed by ADMIN to manage Servers?          */
UseOperCmds = "N"
)BLANK
/* Use SSL Basic Authentication? (ID/PW over SSL)        */
UseSSLBA    = "N"
)BLANK
/* Use SSL Client Certificates?                          */
UseSSLClientCerts = "N"
)BLANK
/* Setup for use also as Remote Client?                  */
RemoteClient = "N"
)BLANK
/* Setup for use connectors?                             */
useIMSOTMA="N"
useCICSPAA="N"
)BLANK
/*-------------------------------------------------------*/
/*             Start of Standard setup                   */
/*-------------------------------------------------------*/
maxrc = 0
)BLANK
/* Verify that required data fields are set up */
call VerifyRequiredData
if maxrc > 4 then
   exit maxrc
)BLANK
)BLANK
 if switch = 'issuecmds'  then do;
    call PutComment('WebSphere Application Server RACF Setup')
    call PutComment('-- Stand-alone AppServer')
    call PutComment('-- Cell name:' cell_name )
    call PutComment('-- Server name:' default_appServer_server_jobname  )
    call PutComment('-- Config group:' default_WS_CFG_group )
    call PutComment('Generated on ' || DATE() || ' at ' || TIME() )
   end;
)BLANK
  else do;
    call PutLine('/* REXX */')
    call PutComment('WebSphere Application Server RACF Setup')
    call PutComment('-- Stand-alone AppServer')
    call PutComment('-- Cell name:' cell_name )
    call PutComment('-- Server name:' default_appServer_server_jobname  )
    call PutComment('-- Config group:' default_WS_CFG_group )
    call PutComment('Generated on ' || DATE() || ' at ' || TIME() )
    call PutLine('trace commands')
   end;
)BLANK
/*-------------------------------------------------------*/
/*        General RACF Classes for OS level Security     */
/*-------------------------------------------------------*/
call ActivateClasses
)BLANK
/*-------------------------------------------------------*/
/* Create WAS user IDs for the location service daemon,  */
/* controller and servants.  These are needed regardless */
/* of which security scheme is chosen.                   */
/*-------------------------------------------------------*/
call CreateUsers
)BLANK
/*-------------------------------------------------------*/
/* Create Asynch admin user                              */
/*-------------------------------------------------------*/
call Create_Asynch_User
)BLANK
/*-------------------------------------------------------*/
/* Set up access to the WAS error logstream.             */
/* If you want your clients to write to the logstream,   */
/* you must update this procedure.                       */
/*-------------------------------------------------------*/
call AccessLogstream
)BLANK
/*-------------------------------------------------------*/
/* Create SERVER definitions to control servant access   */
/* to controller resources.                              */
/*-------------------------------------------------------*/
call ServerClass
)BLANK
/*-------------------------------------------------------*/
/* Allow servant regions to access WLM services.         */
/*-------------------------------------------------------*/
call setupWLM                                           /*@MD18997A*/
)BLANK
/*-------------------------------------------------------*/
/* Create started task profiles to assign user IDs to    */
/* the daemon, controller and servant regions.           */
/*-------------------------------------------------------*/
call assignStarted
)BLANK
/*-------------------------------------------------------*/
/* Perform basic SSL setup.                              */
/*-------------------------------------------------------*/
call setupSSL
)BLANK
/*-------------------------------------------------------*/
/* Set up SSL for the Location Service Daemon            */
/*-------------------------------------------------------*/
call enableDaemon_SSL
)BLANK
)SEL &BBOWST = FS
/*-------------------------------------------------------*/
/* Perform additional setup for WebSphere family         */
/* security.                                             */
/*-------------------------------------------------------*/
)BLANK
/*-------------------------------------------------------*/
/* End of additional setup for WebSphere family          */
/* security.                                             */
/*-------------------------------------------------------*/
)ENDSEL
)BLANK
)SEL &BBOWST = ZS
/*-------------------------------------------------------*/
/* Perform additional setup for WebSphere for z/OS       */
/* security.                                             */
/*-------------------------------------------------------*/
)BLANK
/*-------------------------------------------------------*/
/* Activate additional classes.                          */
/*-------------------------------------------------------*/
call ActivateClasses_ZOS
)BLANK
/*-------------------------------------------------------*/
/* Define additional user IDs.                           */
/*-------------------------------------------------------*/
call CreateUsers_ZOS
)BLANK
/*-------------------------------------------------------*/
/* Set up APPL security definitions.                     */
/*-------------------------------------------------------*/
call PermitAPPLclass                              /*    @WS15621D*/
/*-------------------------------------------------------*/
/* Set up CBIND definitions to control who is allowed to */
/* connect to and and access servers, and also determine */
/* who is trusted to pass on other identities.           */
/*-------------------------------------------------------*/
call CBINDClass
)BLANK
/*-------------------------------------------------------*/
/* Set up EJBROLE definitions.                           */
/*-------------------------------------------------------*/
call setupEJBRoleAccess
)BLANK
/*-------------------------------------------------------*/
/* Set up SSL for WebSphere for z/OS security:           */
/*  - digital certificate for the controller             */
/*  - keyrings for servants and administrators           */
/*-------------------------------------------------------*/
call setupSSL_ZOS
)BLANK
/*-------------------------------------------------------*/
/* Set up additional facilities                          */
/*  - EnabledTrustedApplications                         */
/*  - SyncToThread                                       */
/*-------------------------------------------------------*/
call setupSpecialFacilities_ZOS
)BLANK
/*-------------------------------------------------------*/
/* End of additional setup for WebSphere for z/OS        */
/* security.                                             */
/*-------------------------------------------------------*/
)ENDSEL
)BLANK
/*-------------------------------------------------------*/
/* If desired, allow servants to access DB2.             */
/*-------------------------------------------------------*/
if UseDB2DSNR = "Y"
 then do
    call setupDB2
 end
)BLANK
/*-------------------------------------------------------*/
/* the following authentication methods are options for  */
/*  remote security.                                     */
/*-------------------------------------------------------*/
)BLANK
if UseSSLClientCerts = "Y"
   then do
     call ServerSSLforClientCerts
   end
)BLANK
/*-------------------------------------------------------*/
/* Sample routines to set up IMS and CICS permissions.   */
/*-------------------------------------------------------*/
if useIMSOTMA="Y"
  then do
     call Permit4IMSPAA
  end
)BLANK
if useCICSPAA="Y"
  then do
     call Permit4CICSPAA
  end
)BLANK
/*---------------------------------------------------------*/
/*           Exit with highest return code                 */
/*---------------------------------------------------------*/
call PutComment('End of generated commands.')
if switch = "generatecmds" then do
   "EXECIO 0 DISKW RACFCMDS ( FINIS "
   end
exit maxrc
)BLANK
)BLANK
/*------------------------------------------------------------------*/
/*  Start of Subroutine Section                                     */
/*------------------------------------------------------------------*/
VerifyRequiredData:
/* ---------------------------------------------------------------- */
/* Do prechecks of values that have no reasonable defaults and need */
/* to be set before using this exec.                                */
/* ---------------------------------------------------------------- */
)BLANK
if default_logstream_name = "" then
  do
     say "You need to fill in a valid logstream name before running this exec."
     maxrc = 100
  end
)BLANK
RETURN
)BLANK
)BLANK
ActivateClasses:
/* ---------------------------------------------------------------- */
/* Activates all RACF classes which are needed regardless of        */
/* which WebSphere security scheme is chosen.                       */
/* ---------------------------------------------------------------- */
call PutComment('Activating RACF classes which are needed regardless of security scheme.')
CMD = "SETROPTS CLASSACT(SERVER)"
call ProcessCmd CMD
CMD = "SETROPTS RACLIST(SERVER) GENERIC(SERVER)"
call ProcessCmd CMD
CMD = "SETROPTS CLASSACT(STARTED)"
call ProcessCmd CMD
CMD = "SETROPTS RACLIST(STARTED) GENERIC(STARTED)"
call ProcessCmd CMD
CMD = "SETROPTS CLASSACT(FACILITY)"
call ProcessCmd CMD
CMD = "SETROPTS RACLIST(FACILITY) GENERIC(FACILITY)"
call ProcessCmd CMD
CMD = "SETROPTS GRPLIST"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
ActivateClasses_ZOS:
/* ---------------------------------------------------------------- */
/* Activates additional RACF classes used by WebSphere for z/OS     */
/* security.                                                        */
/* ---------------------------------------------------------------- */
call PutComment('Activating classes needed only for z/OS security. ')
CMD = "SETROPTS CLASSACT(CBIND)"
call ProcessCmd CMD
CMD = "SETROPTS RACLIST(CBIND) GENERIC(CBIND)"
call ProcessCmd CMD
CMD = "SETROPTS CLASSACT(SURROGAT) GENERIC(SURROGAT)"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
CreateUsers:
/* -----------------------------------------------------------------*/
/* Determine whether to use AUTOUID or the user specified UID for   */
/* each of the user ids                                             */
/* -----------------------------------------------------------------*/
)BLANK
/* Daemon userid ---------------------------------------------------*/
if default_daemon_CR_UID = "*"
 then do
    daemon_CR_uid_string = "AUTOUID"
 end
 else do
    daemon_CR_uid_string = "UID(&DMNUIDC)"
 end
/* appserver CR userid ---------------------------------------------*/
if default_appServer_CR_UID = "*"
 then do
    appServer_CR_UID_string = "AUTOUID"
 end
 else do
    appServer_CR_UID_string = "UID(&ASUIDC)"
 end
/* appserver SR userid ---------------------------------------------*/
 if default_appServer_SR_UID = "*"
  then do
     appServer_SR_UID_string = "AUTOUID"
  end
  else do
     appServer_SR_UID_string = "UID(&ASUIDS)"
  end
/* appserver adjunct userid ----------------------------------------*/
 if default_appServer_adjunct_UID = "*"
  then do
     appServer_adjunct_UID_string = "AUTOUID"
  end
  else do
     appServer_adjunct_UID_string = "UID(&AJUIDS)"
  end
/* Async userid ----------------------------------------------------*/
if default_asynch_admin_uid = "*"
 then do
    asynch_admin_uid_string = "AUTOUID"
 end
 else do
    asynch_admin_uid_string = "UID(&AAOPUID)"
 end
/* Administrator userid --------------------------------------------*/
if default_WS_admin_UID = "*"
 then do
    admin_UID_string = "AUTOUID"
 end
 else do
    admin_UID_string = "UID(&WASUID)"
 end
/* Unauth userid ---------------------------------------------------*/
if default_WS_unauth_UID = "*"
 then do
    unauth_UID_string = "AUTOUID"
 end
 else do
    unauth_UID_string = "UID(&ALLUIDD)"
 end
/* ---------------------------------------------------------------- */
/* Define the user ids which are needed regardless of which         */
/* security scheme is selected.                                     */
/* ---------------------------------------------------------------- */
)BLANK
/* ---------------------------------------------------------------- */
/* Define the user ids for each of the server controller regions:   */
/* daemon, Appserver, and Deployment Manager.                       */
/* ---------------------------------------------------------------- */
)BLANK
/* Daemon userid -------------------------------------------------- */
call PutComment('Adding users for WAS AppServer Regions. ')
call PutComment('Adding AppServer daemon user ID.')
)BLANK
  CMD = "ADDUSER " || default_daemon_CR_userid || ,
   " DFLTGRP(" || default_WS_CFG_group || ,
   ") OMVS("|| daemon_CR_UID_string || ,
   " HOME(&USERHOME/&CNFGGRP) PROGRAM(/bin/sh)) NAME('WAS DAEMON CR') "  || ,
   " NOPASSWORD NOOIDCARD"                                /*MD17013C*/
  call ProcessCmd CMD
)BLANK
call PutComment('Adding AppServer controller user ID.')
/* AppServer controller user ID------------------------------------ */
 CMD = "ADDUSER " || default_appServer_CR_userid || ,
   " DFLTGRP(" || default_WS_CFG_group || ,
   ") OMVS("|| appServer_CR_UID_string || ,
   " HOME(&USERHOME/&CNFGGRP) PROGRAM(/bin/sh)) NAME('WAS APPSVR CR') "  || ,
   " NOPASSWORD NOOIDCARD"                                /*MD17013C*/
 call ProcessCmd CMD
)BLANK
call PutComment('Adding AppServer servant user ID.')
/* AppServer servant user ID--------------------------------------- */
CMD = "ADDUSER " || default_appServer_SR_userid || ,
   " DFLTGRP(" || default_WS_SR_group || ,
   ") OMVS("|| appServer_SR_UID_string || ,
   " HOME(&USERHOME/&ALLGRPS) PROGRAM(/bin/sh)) NAME('WAS APPSVR SR') "  || ,
   " NOPASSWORD NOOIDCARD"                               /* MD17013C*/
call ProcessCmd CMD
)BLANK
call PutComment('Allow 10000 concurrently open files.')
CMD = "ALU " || default_appServer_SR_userid || ,         /*@WS15621A*/
             " OMVS(FILEPROC(10000))"                     /*@WS15621A*/
call ProcessCmd CMD                                      /*@WS15621A*/
)BLANK
call PutComment('Adding user for WAS Control Region Adjunct')
)BLANK
/* AppServer control region adjunct user ID------------------------ */
CMD = "ADDUSER " || default_appServer_adjunct_userid || ,
     " DFLTGRP(" || default_WS_SR_group || ,
   ") OMVS("|| appServer_adjunct_UID_string || ,
   " HOME(&USERHOME/&ALLGRPS)" || ,
   " PROGRAM(/bin/sh)) NAME('WAS APPSVR ADJUNCT') " || ,
   " NOPASSWORD NOOIDCARD"                               /*@247142 A*/
call ProcessCmd CMD                                      /*@247142 A*/
call PutComment('Allow 10000 concurrently open files.')
CMD = "ALU " || default_appServer_adjunct_userid || ,    /*@247142 A*/
             " OMVS(FILEPROC(10000))"                     /*@247142 A*/
call ProcessCmd CMD                                      /*@247142 A*/
)BLANK
/*-----------------------------------------------------------------  */
/* Connect servant userids to the WebSphere configuration group.     */
/* (Controllers already have this as their default group.)           */
/*-----------------------------------------------------------------  */
call PutComment('Connecting servants to the WebSphere configuration group. ')
CMD = "CONNECT " || default_appServer_SR_userid || ,
   " group(" || default_WS_CFG_group || ")"
call ProcessCmd CMD
)BLANK
CMD = "CONNECT " || default_appServer_adjunct_userid || ,
   " group(" || default_WS_CFG_group || ")"             /*@247142 A*/
call ProcessCmd CMD                                     /*@247142 A*/
)BLANK
)BLANK
RETURN
)BLANK
Create_Asynch_User:
/* ---------------------------------------------------------------- */
/* Define the userid for the asynch admin task                      */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Adding default asynch admin task userid')
)BLANK
CMD = "ADDUSER " || default_asynch_admin_userid || ,
      " DFLTGRP(" || default_WS_CFG_group       || ,
      ") OMVS("|| asynch_admin_uid_string       || ,
    " HOME(&USERHOME/&CNFGGRP) PROGRAM(/bin/sh)) NAME('WAS Asynch Admin  Task') " || ,
    " NOPASSWORD NOOIDCARD"
call ProcessCmd CMD
RETURN
)BLANK
)BLANK
CreateUsers_ZOS:
/* ---------------------------------------------------------------- */
/* Define the administrator and unauthorized-user IDs.              */
/*                                                                  */
/* Jobs will need to be submitted under the userid associated       */
/* with the default WebSphere administrator id. It requires an      */
/* unexpired password.                                              */
/*                                                                  */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Adding WAS administrator user ID')
)BLANK
CMD = "ADDUSER " || default_WS_admin_userid || ,
   " DFLTGRP(" || default_WS_CFG_group || ,
   ") OMVS("|| admin_UID_string || ,
   " HOME(&USERHOME/&CNFGGRP) PROGRAM(/bin/sh)) NAME('WAS ADMINISTRATOR') " || ,
   " NOPASSWORD NOOIDCARD"
call ProcessCmd CMD
)BLANK
/* ---------------------------------------------------------------- */
/* Define a user ID to be used for unauthenticated requests.        */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Adding WAS unauthenticated user ID')
)BLANK
CMD = "ADDUSER " || default_WS_unauth_userid || ' RESTRICTED ' ||, /*MD16971C*/
   " DFLTGRP(" || default_WS_unauth_group || ,
   ") OMVS("|| unauth_UID_string || ,
   " HOME(&USERHOME/&ALLGRPD) PROGRAM(/bin/sh)) NAME('WAS DEFAULT USER')  " || ,
   " NOPASSWORD NOOIDCARD"
 call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
AccessLogstream:
/* ---------------------------------------------------------------- */
/* LOGSTREAM Set-Up                                                 */
/*                                                                  */
/* ---------------------------------------------------------------- */
/*                                                                  */
/* Set up access authorizations for the log stream:                 */
/*                                                                  */
/* For each server identity (or client identity, if you allow       */
/* clients to write to the error log stream), assign UPDATE         */
/* access to the log stream:                                        */
/*                                                                  */
/* Note: in a production environment, you would likely want the     */
/*       UACC to be NONE.                                           */
/* ---------------------------------------------------------------- */
Call PutComment('Defining access authorizations for the log stream.')
 CMD = "RDEFINE LOGSTRM" default_logstream_name "UACC(READ)"
 call ProcessCmd CMD
)BLANK
Call PutComment('Permitting WAS configuration group to update log stream.')
 CMD = "PERMIT" default_logstream_name "CLASS(LOGSTRM)" || ,
      " ID("default_WS_CFG_group") ACCESS(UPDATE)"
 call ProcessCmd CMD
)BLANK
)BLANK
Call ProcessCmd ("SETROPTS CLASSACT(LOGSTRM)")
/*------------------------------------------------------------------*/
/* For each user who browses the error log stream, assign READ      */
/* access:                                                          */
/*                                                                  */
/*  PERMIT log_stream_name CLASS(LOGSTRM) ID(user_ID) ACCESS(READ)  */
/*                                                                  */
/* ---------------------------------------------------------------- */
RETURN
)BLANK
)BLANK
CBINDClass:
/* --------------------------------------------------------------------- */
/* CLASS=CBIND                                                           */
/* OS/390 WebSphere PROFILES                                             */
/* --------------------------------------------------------------------- */
/*  CLASS  = CBIND                                                       */
/* PROFILE = CB.BIND.<cluster name>                                      */
/*  (CB.BIND.CLUSTER)                                                    */
/* Used for: determining if a client can "BIND" (access) a controller    */
/*           region.                                                     */
/* Notes:                                                                */
/* 1. Any userid can gain access to the controller region if it has READ */
/*    access to the CB.BIND.cluster_name profile.                        */
/* 2. A userid can still gain access to the Controller Region if the     */
/*    session owner has control access.                                  */
/* 3. Within a local session (or SSL client certificate session)         */
/*    the session owner is the userid of the client or controller        */
/*    region (if server-as-client) that issued the message.              */
/*    Otherwise, ownership is assigned to the first userid which         */
/*    has successfully accessed the controller region.                   */
/* --------------------------------------------------------------------- */
)BLANK
/* Delete CBIND CB.BIND.daemon and PERMIT.                      @MD16547D*/
/* --------------------------------------------------------------------- */
)BLANK
call PutComment('Define and permit CB.BIND.<cluster name> profile to CBIND class')
call PutComment('Used for determining if a client can access a controller region')
call PutComment('Any userid can gain access to the controller region if it has READ access to the CB.BIND.cluster_name profile')
CMD = "RDEFINE CBIND CB.BIND." || domain_prefix               ,      /*@WS15621C*/
      || "**" || ,                                                   /*@WS15621C*/
      " UACC(READ)"
call ProcessCmd CMD
)BLANK
CMD = "PERMIT CB.BIND." || domain_prefix               ,             /*@WS15621C*/
      || "**" || ,                                                   /*@WS15621C*/
   " CLASS(CBIND) ID(" || default_WS_CFG_group || ") ACCESS(CONTROL) "
call ProcessCmd CMD
)BLANK
/* ---------------------------------------------------------------- */
/* ACCESS TO J2EE Applications                                      */
/* ---------------------------------------------------------------- */
/* CLASS  = CBIND                                                   */
/* PROFILE = CB.<CLUSTER NAME>                                      */
/* Used for: Determining if a client can use J2EE applications in a */
/*           server.                                                */
/* ---------------------------------------------------------------- */
)BLANK
/* Delete CBIND CB.daemon                                  @MD16547D*/
)BLANK
/*------------------------------------------------------------------*/
call PutComment('Define and permit CB.<cluster name> profile to CBIND class')
call PutComment('Used for determining if a client can use J2EE applications in a server')
CMD = "RDEFINE CBIND CB." || domain_prefix               ,           /*@WS15621C*/
      || "**" || ,                                                   /*@WS15621C*/
      " UACC(READ)"
call ProcessCmd CMD
)BLANK
/*------------------------------------------------------------------*/
)BLANK
)BLANK
CMD = "SETROPTS RACLIST(CBIND) GENERIC(CBIND) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
ServerClass:
/* ---------------------------------------------------------------- */
/* CLASS = SERVER                                                   */
/* PROFILE = CB.<cluster>.<generic server>                          */
/* Used for: determining if a servant region can initialize         */
/* ---------------------------------------------------------------- */
call PutComment('Defining SERVER CB.cluster.generic_server. ')  /* @MD16761C*/
call PutComment('Used for determining if a servant region can initialize.')
)BLANK
CMD = "RDEFINE SERVER CB.*   UACC(NONE)"
call ProcessCmd CMD
)BLANK
CMD = "RDEFINE SERVER CB.*." || default_appServer_cluster_name || "ADJUNCT" || '.*' || , /* @249948A */
   " UACC(NONE)"                                                                         /* @249948A */
call ProcessCmd CMD                                                                      /* @249948A */
)BLANK
CMD = "RDEFINE SERVER CB.*." || default_appServer_cluster_name || '.*' || , /* @MD17040A*/
   " UACC(NONE)"                                                            /* @MD17040A*/
call ProcessCmd CMD                                                         /* @MD17040A*/
)BLANK
call PutComment('Permitting SERVER class access. ')                 /* @MD17040A*/
CMD = "PERMIT CB.*." || default_appServer_cluster_name || '.*' || , /* @MD17040A*/
   " CLASS(SERVER) ID(" || default_appServer_SR_userid || ,         /* @MD17040A*/
   ") ACC(READ)"                                                    /* @MD17040A*/
call ProcessCmd CMD                                                 /* @MD17040A*/
CMD = "PERMIT CB.*." || default_appServer_cluster_name || '.*' || , /* 260883A */
   " CLASS(SERVER) ID(" || default_appServer_adjunct_userid || ,    /* 260883A */
   ") ACC(READ)"                                                    /* 260883A */
call ProcessCmd CMD
CMD = "PERMIT CB.*." || default_appServer_cluster_name || "ADJUNCT" || '.*' || , /* @249948C*/
   " CLASS(SERVER) ID(" || default_appServer_adjunct_userid || ,    /* @247142 A*/
   ") ACC(READ)"                                                    /* @247142 A*/
call ProcessCmd CMD                                                 /* @247142 A*/
/* ---------------------------------------------------------------- */
)BLANK
CMD = "SETROPTS RACLIST(SERVER) GENERIC(SERVER) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
assignStarted:
/* ---------------------------------------------------------------- */
/* Create STARTED task profiles for each runtime server identity    */
/* Define User Identities for the runtime addresses/tasks           */
/* ---------------------------------------------------------------- */
call PutComment('Assigning userids to started tasks. ') /* @MD16761A*/
call PutComment('Assign async admin ID to started task')
CMD = "RDEFINE STARTED " || default_asynch_admin_proc || ,
   ".* STDATA(USER(" || default_asynch_admin_userid   || ,
   ") GROUP(" || default_WS_CFG_group                 || ,
   ") TRACE(YES))"
call ProcessCmd CMD
)BLANK
call PutComment('Assign daemon controller ID to started task')
CMD = "RDEFINE STARTED " || default_daemon_CR_proc_name || , /* @MD16761C*/
   ".* STDATA(USER(" || default_daemon_CR_userid || ,
   ") GROUP(" || default_WS_CFG_group || ,
   ") TRACE(YES))"
call ProcessCmd CMD
)BLANK
/*------------------------------------------------------------------*/
call PutComment('Assign AppServer controller ID to started task')
CMD = "RDEFINE STARTED " || default_appServer_CR_proc_name || , /* @MD16761C*/
   ".* STDATA(USER(" || default_appServer_CR_userid || ,
   ") GROUP(" || default_WS_CFG_group || ,
   ") TRACE(YES))"                                        /* @MD16604A*/
call ProcessCmd CMD                                       /* @MD16604A*/
)BLANK
/*------------------------------------------------------------------*/
call PutComment('Assign AppServer adjunct ID to started task')
CMD = "RDEFINE STARTED " || default_appServer_adjunct_jobname || ,
   ".* STDATA(USER(" || default_appServer_adjunct_userid || ,
   ") GROUP(" || default_WS_CFG_group || ,
   ") TRACE(YES))"                                        /* @247142 A*/
call ProcessCmd CMD
)BLANK
/* ---------------------------------------------------------------- */
call PutComment('Assign AppServer servant ID to started task')
CMD = "RDEFINE STARTED " || default_appServer_server_jobname_SR || ,
   ".* STDATA(USER(" || default_appServer_SR_userid || ,  /* @MD16761C*/
   ") GROUP(" || default_WS_CFG_group || ,
   ") TRACE(YES))"                                        /* @MD16604A*/
call ProcessCmd CMD
)BLANK
CMD = "SETROPTS RACLIST(STARTED) GENERIC(STARTED) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
)BLANK
setupWLM: /*@MD18997A*/
/* ---------------------------------------------------------------- */
/*  AsynchBeans for z/OS, require servants to have access to WLM    */
/*  services.  New for @MD18997A                                    */
/* ---------------------------------------------------------------- */
call PutComment('Authorize servants to use WLM Services')
CMD = "RDEFINE FACILITY (BPX.WLMSERVER) UACC(NONE)"
call ProcessCmd CMD
CMD = "PERMIT BPX.WLMSERVER ACCESS(READ) ID(" || ,
      default_WS_SR_group  || ,
      ") CL(FACILITY)"
call ProcessCmd CMD
CMD = "SETROPTS RACLIST(FACILITY) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN                                                 /*@MD18997A*/
)BLANK
/* ---------------------------------------------------------------- */
/* Below this point are comments for other security systems and     */
/* and access connections.  These are not needed to run the provided*/
/* IVP, but would be needed for those shops that use them.          */
/* To "activate" a section, remove the comment delimiters, make     */
/* changes, and move the section above the "exit maxrc" line above. */
/* ---------------------------------------------------------------- */
)BLANK
setupDB2:
/* ---------------------------------------------------------------- */
/* RACF set-up for IDENTITY with DB2 if DSNR is activated.          */
/*  Note that which Identity is used by DB2 depends on the          */
/*  type of server, Run-As setting for EJB, and DB2 configuration   */
/* ---------------------------------------------------------------- */
/* CLASS = DSNR                                                     */
/* PROFILE = <db2>.RRSAF                                            */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Setting up DSNR for DB2 access. ')
CMD = "RDEFINE DSNR" default_DB2_ssname || ".RRSAF UACC(NONE)"
call ProcessCmd CMD
CMD = "PERMIT" default_DB2_ssname || ".RRSAF CLASS(DSNR)" ,
    "ID(" ,
       || default_WS_SR_group || ,
    ") ACCESS(READ)"
call ProcessCmd CMD
)BLANK
call ProcessCmd("SETROPTS CLASSACT(DSNR)")
call ProcessCmd("SETROPTS RACLIST(DSNR) GENERIC(DSNR)")
call ProcessCmd("SETROPTS RACLIST(DSNR) REFRESH")
)BLANK
RETURN
)BLANK
)BLANK
setupEJBRoleAccess:
/* ---------------------------------------------------------------- */
/* EJB Role Access.  Needed if SAF Authorization desired           */
/* ---------------------------------------------------------------- */
/* RACF CLASS  = EJBROLES                                           */
/* Sample Client Profile for access to installation defined methods.*/
/*                           updated for MD16971AA                    */
)BLANK
call PutComment('Setting up EJBRoles Profiles for admin roles when using SAF authorization');
call ProcessCmd("SETROPTS CLASSACT(EJBROLE)")
call PutComment('Defining roles for SAF access');
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "administrator UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "monitor       UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "configurator UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "operator     UACC(NONE)")
/*            Start of changes for @309640A                */
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "deployer     UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || ,
    "adminsecuritymanager UACC(NONE)")
CMD = "PERMIT " || domain_prefix || "adminsecuritymanager CLASS(EJBROLE) ID(" || ,
    default_WS_admin_userid || ") ACCESS(READ)"
call ProcessCmd CMD
/*            End of changes for @309640A                  */
)BLANK
call PutComment('Setting up EJBRoles access for administrator and CR');
CMD = "PERMIT " || domain_prefix ||  "administrator  CLASS(EJBROLE)  ID(" || ,
       default_WS_CFG_group || ") ACCESS(READ)"        /*@MD16594C*/
call ProcessCmd CMD
)BLANK
/*                         start of changes for    @MD16475AA */
call PutComment('Setting up EJBRoles Profiles for Naming roles');
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "CosNamingRead   UACC(READ)")
CMD = "PERMIT " || domain_prefix || "CosNamingRead  CLASS(EJBROLE)  ID(" || ,
       default_WS_unauth_userid || ") ACCESS(READ)"
call ProcessCmd CMD
/*           Start of changes for @309640C                */
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "CosNamingWrite  UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "CosNamingCreate UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "CosNamingDelete UACC(NONE)")
/*                        end of changes for         @MD16475AA */
CMD = "PERMIT " || domain_prefix || "CosNamingWrite  CLASS(EJBROLE)  ID(" || ,
       default_WS_CFG_group || ") ACCESS(READ)"
call ProcessCmd CMD
CMD = "PERMIT " || domain_prefix || "CosNamingCreate  CLASS(EJBROLE) ID(" || ,
       default_WS_CFG_group || ") ACCESS(READ)"
call ProcessCmd CMD
CMD = "PERMIT " || domain_prefix || "CosNamingDelete  CLASS(EJBROLE) ID(" || ,
       default_WS_CFG_group || ") ACCESS(READ)"
call ProcessCmd CMD
/*            End of changes for @309640C                  */
)BLANK
call ProcessCmd("SETROPTS RACLIST(EJBROLE) REFRESH")
)BLANK
RETURN
)BLANK
setupSSL:
/* ---------------------------------------------------------------- */
/*       SSL SET-UP                                                 */
/*                                                                  */
/*       This sets up a WAS Test Certificate Authority for use for  */
/*          creating all certificates needed on both client and     */
/*          servers, for test purposes.                              */
/*       See "RACF Security Administrator's Guide" for more         */
/*       information on Digital Certicates.                         */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Define permissions to work with certificates')
call ProcessCmd("RDEFINE FACILITY IRR.DIGTCERT.LIST UACC(NONE)")
call ProcessCmd("RDEFINE FACILITY IRR.DIGTCERT.LISTRING UACC(NONE)")
)BLANK
CMD = "PERMIT IRR.DIGTCERT.LIST CLASS(FACILITY) ID(" ,
 || default_WS_CFG_group || ") ACC(READ) "
call ProcessCmd CMD
)BLANK
CMD = "PERMIT IRR.DIGTCERT.LISTRING CLASS(FACILITY) ID(" ,
 || default_WS_CFG_group || ") ACC(READ) "
call ProcessCmd CMD
)BLANK
if WS_generate_CA_cert = "Y"
 then do
  call PutComment('Create a Certificate Authority certificate')
  call PutComment('This will be used to sign client and server certs')
  FORMAT_DATE = WS_cert_expiration_date
  call PutComment('FORMAT_DATE IS ' || FORMAT_DATE);
  CMD = "RACDCERT CERTAUTH GENCERT SUBJECTSDN(CN('WAS CertAuth for Security Domain') " ,
        ||  " OU('"|| cell_name || "'))" ,
        ||  " WITHLABEL('" || WS_TestCA || "')  TRUST " ,
        ||  "NOTAFTER(DATE(" || FORMAT_DATE || "))"
  call ProcessCmd CMD
 end
)BLANK
call PutComment('Facility class refresh ')
call ProcessCmd( "SETROPTS RACLIST(FACILITY) REFRESH")
)BLANK
)BLANK
 RETURN
)BLANK
)BLANK
enableDaemon_SSL:
/* ---------------------------------------------------------------- */
/* Set up SSL for location service daemon                           */
/* ---------------------------------------------------------------- */
if (enable_daemon_ssl = "Y")
then do
 call PutComment('Creating SSL keyring for Location Service Daemon')
 CMD = "RACDCERT ADDRING(" || Daemon_keyring || ,
       ") ID(" default_daemon_CR_userid ")"
 call ProcessCmd CMD
)BLANK
 call PutComment('Generating certificate for Location Service Daemon')
)BLANK
 FORMAT_DATE = ws_cert_expiration_date
)BLANK
 CMD = "RACDCERT ID (" || default_daemon_CR_userid             || ,
       ") GENCERT SUBJECTSDN(CN('" || daemon_ipname            || ,
       "')"                                                    || ,
       " O('IBM') OU('" || cell_name || "'))"                  || ,
       " WITHLABEL('DefaultDaemonCert."                        || ,
                   cell_name || "')"                           || ,
       " SIGNWITH(CERTAUTH LABEL('" || WS_TestCA || "'))"      || ,
       " NOTAFTER(DATE(" || FORMAT_DATE || "))"
 call ProcessCmd CMD
 call PutComment('Connecting Daemon Certificate to the keyring')
)BLANK
 CMD = "RACDCERT ID(" || default_daemon_CR_userid || ") CONNECT ("   ,
       || "LABEL('DefaultDaemonCert." || cell_name || ,
       "') RING(" ||  Daemon_keyring ") DEFAULT)"
 call ProcessCmd CMD
)BLANK
 call PutComment('Connect WAS CA Certificates to Daemon keyring')
)BLANK
 CMD = "RACDCERT ID(" ||  default_daemon_CR_userid    || ,
       ") CONNECT (RING("                             || ,
       Daemon_keyring || ") LABEL('" || WS_TestCA     || ,
       "') CERTAUTH)"
 call ProcessCmd CMD
)BLANK
 call PutComment('Connect Commercial CAs to Daemon keyring')
)BLANK
 CALabel = 'Verisign Class 3 Primary CA'
 CMD = "RACDCERT ID(" ||  default_daemon_CR_userid || ") CONNECT (RING(" ,
       ||  Daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
       || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Verisign Class 1 Primary CA'
 CMD = "RACDCERT ID(" ||  default_daemon_CR_userid || ") CONNECT (RING(" ,
       ||  Daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
       ||  " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'RSA Secure Server CA'
 CMD = "RACDCERT ID(" ||  default_daemon_CR_userid || ") CONNECT (RING(" ,
       ||  Daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
       || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Thawte Server CA'
 CMD = "RACDCERT ID(" ||  default_daemon_CR_userid || ") CONNECT (RING(" ,
       ||  Daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
       || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Thawte Premium Server CA'
 CMD = "RACDCERT ID(" ||  default_daemon_CR_userid || ") CONNECT (RING(" ,
       ||  Daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
       || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Thawte Personal Basic CA'
 CMD = "RACDCERT ID(" ||  default_daemon_CR_userid || ") CONNECT (RING(" ,
       ||  Daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
       || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Thawte Personal Freemail CA'
 CMD = "RACDCERT ID(" ||  default_daemon_CR_userid || ") CONNECT (RING(" ,
       ||  Daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
       || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Thawte Personal Premium CA'
 CMD = "RACDCERT ID(" ||  default_daemon_CR_userid || ") CONNECT (RING(" ,
       ||  Daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
       || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Verisign International Svr CA'
 CMD = "RACDCERT ID(" ||  default_daemon_CR_userid || ") CONNECT (RING(" ,
       ||  Daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
       || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
end
)BLANK
)BLANK
RETURN
)BLANK
)BLANK
setupSSL_ZOS:
/* ---------------------------------------------------------------- */
/*    SSL BASIC SERVER SET-UP                                       */
/* ---------------------------------------------------------------- */
/* RACF set-up for SSL for Servers                                  */
/*  The SSL set-up uses the RACF RACDCERT command to generate and   */
/*  maintain digital certificates in RACF, using the WebSphere Test */
/*  Certificate Authority cert created in BBOSBRAC.                 */
/*  There must be a unique RACF keyring and digital certificate     */
/*  public/private key pair for the identity of each server enabled */
/*  for SSL.                                                        */
/*  The certificate must be unique and owned by the server's id.    */
/*                                                                  */
/*  NOTES: 1. This step is required for ALL SSL based mechanisms,   */
/*            including SSL Basic Auth, Kerberos over SSL,          */
/*            SSL Client Certificates, and Asserted Identity        */
/*        2.  The keyring name here must match the one set in the   */
/*            EUI.                                                  */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Creating SSL keyrings for WebSphere servers ')
)BLANK
CMD = "RACDCERT ADDRING(" || Appsrvr_keyring || ") ID(" default_appServer_CR_userid ")"
call ProcessCmd CMD
)BLANK
CMD = "RACDCERT ADDRING(" || Appsrvr_keyring || ") ID(" default_appServer_SR_userid ")"
call ProcessCmd CMD
)BLANK
CMD = "RACDCERT ADDRING(" || Appsrvr_keyring || ") ID(" default_appServer_adjunct_userid ")"
call ProcessCmd CMD
)BLANK
call PutComment('Generating certificates for WebSphere servers ')
)BLANK
FORMAT_DATE = ws_cert_expiration_date                          /*@WS15621C*/
)BLANK
CMD = "RACDCERT ID ("             || ,                         /*@WS15621C*/
      default_appServer_CR_userid || ,                         /*@WS15621C*/
      ") GENCERT SUBJECTSDN(CN('" || daemon_ipname || "')" || ,
      " O('IBM') OU('" || cell_name || "'))"  ||      ,        /*@WS15621C*/
      " WITHLABEL('DefaultWASCert."                      || ,  /*@WS15621C*/
           cell_name ||  "')"  || ,                            /*@WS15621C*/
      " SIGNWITH(CERTAUTH LABEL('" || WS_TestCA || "'))" || ,  /*@WS15621C*/
      " NOTAFTER(DATE(" || FORMAT_DATE || "))"                 /*@WS15621A*/
call ProcessCmd CMD
)BLANK
CMD = "RACDCERT ID ("             || ,
      default_appServer_adjunct_userid || ,
      ") GENCERT SUBJECTSDN(CN('" || daemon_ipname || "')" || ,
      " O('IBM') OU('" || cell_name || "'))"  ||      ,
      " WITHLABEL('DefaultAdjunctCert."                    || ,
           cell_name ||  "')"  || ,
      " SIGNWITH(CERTAUTH LABEL('" || WS_TestCA || "'))" || ,
      " NOTAFTER(DATE(" || FORMAT_DATE || "))"
call ProcessCmd CMD
)BLANK
call PutComment('Connecting Server Certificates to their keyrings ')
)BLANK
CMD = "RACDCERT ID(" || default_appServer_CR_userid || ") CONNECT (" ,
|| "LABEL('DefaultWASCert." || cell_name || ,                     /*@WS15621C*/
    "') RING(" ||  Appsrvr_keyring ") DEFAULT)"                   /*@WS15621C*/
call ProcessCmd CMD
)BLANK
CMD = "RACDCERT ID(" || default_appServer_adjunct_userid || ") CONNECT (" ,
|| "LABEL('DefaultAdjunctCert." || cell_name || ,
    "') RING(" ||  Appsrvr_keyring ") DEFAULT)"
call ProcessCmd CMD
)BLANK
call PutComment('Connect WAS CA Certificates to Servers keyring')
)BLANK
CMD = "RACDCERT ID(" ||  default_appServer_CR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") LABEL('" || WS_TestCA || ,             /*@WS15621C*/
                           "') CERTAUTH)"                         /*@WS15621C*/
call ProcessCmd CMD
CMD = "RACDCERT ID(" ||  default_appServer_SR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") LABEL('" || WS_TestCA || ,
                           "') CERTAUTH)"
call ProcessCmd CMD
CMD = "RACDCERT ID(" ||  default_appServer_adjunct_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") LABEL('" || WS_TestCA || ,
                           "') CERTAUTH)"
call ProcessCmd CMD
)BLANK
call PutComment('Connect Commercial CAs to Servers keyring') /* MD16971AA*/
)BLANK
CALabel = 'Verisign Class 3 Primary CA'
CMD = "RACDCERT ID(" ||  default_appServer_CR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign Class 3 Primary CA'
CMD = "RACDCERT ID(" ||  default_appServer_SR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign Class 1 Primary CA'
CMD = "RACDCERT ID(" ||  default_appServer_CR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 ||  " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign Class 1 Primary CA'
CMD = "RACDCERT ID(" ||  default_appServer_SR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 ||  " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'RSA Secure Server CA'
CMD = "RACDCERT ID(" ||  default_appServer_CR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'RSA Secure Server CA'
CMD = "RACDCERT ID(" ||  default_appServer_SR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Server CA'
CMD = "RACDCERT ID(" ||  default_appServer_CR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Server CA'
CMD = "RACDCERT ID(" ||  default_appServer_SR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Premium Server CA'
CMD = "RACDCERT ID(" ||  default_appServer_CR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Premium Server CA'
CMD = "RACDCERT ID(" ||  default_appServer_SR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Basic CA'
CMD = "RACDCERT ID(" ||  default_appServer_CR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Basic CA'
CMD = "RACDCERT ID(" ||  default_appServer_SR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Freemail CA'
CMD = "RACDCERT ID(" ||  default_appServer_CR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Freemail CA'
CMD = "RACDCERT ID(" ||  default_appServer_SR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Premium CA'
CMD = "RACDCERT ID(" ||  default_appServer_CR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Premium CA'
CMD = "RACDCERT ID(" ||  default_appServer_SR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign International Svr CA'
CMD = "RACDCERT ID(" ||  default_appServer_CR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"                               /*MD16971AA end */
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign International Svr CA'
CMD = "RACDCERT ID(" ||  default_appServer_SR_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
/*                                                  Start @WS17709 */
call PutComment('Creating SSL keyrings for WebSphere administrator ')
)BLANK
CMD = "RACDCERT ADDRING(" || Appsrvr_keyring || ") ID(" default_WS_admin_userid ")"
call ProcessCmd CMD
)BLANK
call PutComment('Connect WAS CA Certificates to Servers keyring')
)BLANK
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") LABEL('" || WS_TestCA  ||"') CERTAUTH)"
call ProcessCmd CMD
)BLANK
call PutComment('Connect Commercial CAs to Servers keyring') /* MD16971AA*/
)BLANK
CALabel = 'Verisign Class 3 Primary CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign Class 1 Primary CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 ||  " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'RSA Secure Server CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Server CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Premium Server CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Basic CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Freemail CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Premium CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign International Svr CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"                               /*MD16971AA end */
call ProcessCmd CMD
/*                                                   End   @WS17709 */
)BLANK
/*                                                   start @MD18098A*/
/*                                                   end   @MD18098A*/
)BLANK
/*                                                    Start @MD18731*/
call PutComment('Creating SSL keyring for WebSphere asynch administrator ')
)BLANK
CMD = "RACDCERT ADDRING(" || Appsrvr_keyring || ") ID(" default_asynch_admin_userid ")"
call ProcessCmd CMD
)BLANK
call PutComment('Connect WAS CA Certificates to Servers keyring')
)BLANK
CMD = "RACDCERT ID(" ||  default_asynch_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") LABEL('" || WS_TestCA  ||"') CERTAUTH)"
call ProcessCmd CMD
)BLANK
call PutComment('Connect Commercial CAs to Servers keyring')
)BLANK
CALabel = 'Verisign Class 3 Primary CA'
CMD = "RACDCERT ID(" ||  default_asynch_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign Class 1 Primary CA'
CMD = "RACDCERT ID(" ||  default_asynch_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 ||  " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'RSA Secure Server CA'
CMD = "RACDCERT ID(" ||  default_asynch_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Server CA'
CMD = "RACDCERT ID(" ||  default_asynch_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Premium Server CA'
CMD = "RACDCERT ID(" ||  default_asynch_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Basic CA'
CMD = "RACDCERT ID(" ||  default_asynch_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Freemail CA'
CMD = "RACDCERT ID(" ||  default_asynch_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Premium CA'
CMD = "RACDCERT ID(" ||  default_asynch_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign International Svr CA'
CMD = "RACDCERT ID(" ||  default_asynch_admin_userid || ") CONNECT (RING(" ,
 ||  Appsrvr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
/*                                                    End   @MD18731*/
)BLANK
call PutComment('Facility class refresh ')
call ProcessCmd( "SETROPTS RACLIST(FACILITY) REFRESH")
)BLANK
 RETURN
)BLANK
setupSpecialFacilities_ZOS:
/* ---------------------------------------------------------------- */
/* For out-of-the-box security                                      */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Creating Sync-to-thread profile ')
call PutComment('Used for: Enabling Sync-to-thread. ')
call PutComment('Controller region user ID needs READ or CONTROL access to enable Sync-to-thread. ')
call PutComment('With READ access, only security environments representing users in the SURROGATE class are allowed, while CONTROL allows for security environments to represent any user. ')
 
)BLANK
CMD = "RDEFINE FACILITY BBO.SYNC." || cell_name || "." || ,
                        default_appserver_cluster_name" UACC(NONE)"
call ProcessCmd CMD
)BLANK
call PutComment('Creating EnableTrustedApplications profile ')
)BLANK
call PutComment('Used for: Allowing applications to perform operations normally reserved for privileged users. ')
CMD = "RDEFINE FACILITY BBO.TRUSTEDAPPS." || cell_name || "." || ,
                        default_appserver_cluster_name" UACC(NONE)"
call ProcessCmd CMD
)BLANK
call PutComment('Permit default WAS Configuration group to EnableTrustedApplications profile. ')
CMD = "PERMIT BBO.TRUSTEDAPPS." || cell_name || "." || ,
                        default_appserver_cluster_name  ,
      "CLASS(FACILITY) ID("default_WS_CFG_group") ACCESS(READ)"
call ProcessCmd CMD
)BLANK
CMD = "SETROPTS CLASSACT(FACILITY) GENERIC(FACILITY)"
call ProcessCmd CMD
)BLANK
CMD = "SETROPTS RACLIST(FACILITY) REFRESH"
call ProcessCmd CMD
)BLANK
)BLANK
 RETURN
)BLANK
ServerSSLforClientCerts:
/* ---------------------------------------------------------------- */
/*    SSL CLIENT CERTIFICATES SERVER SET-UP                         */
/* ---------------------------------------------------------------- */
/* Additional RACF set-up for SSL for Servers supporting            */
/*   Client Certificates                                            */
/* - connect the CA certificates for used to generate client        */
/*   certificates into the servers' keyring.                        */
/*                                                                  */
/* - Provide a mapping from SubjectDN or IssuerDN to RACF userid    */
/* ---------------------------------------------------------------- */
call PutComment('Activate Digital Certificate Mapping class ')
)BLANK
CMD = "SETROPTS CLASSACT(DIGTNMAP) RACLIST(DIGTNMAP)"
call ProcessCmd CMD
)BLANK
call PutComment('Refresh RACF classes ')
CMD = "SETROPTS RACLIST(FACILITY) REFRESH"
call ProcessCmd CMD
)BLANK
CMD = "SETROPTS RACLIST(DIGTNMAP) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
ClientSSLforClientCerts:
/* ---------------------------------------------------------------- */
/*    SSL CLIENT CERTIFICATES CLIENT SET-UP                         */
/* ---------------------------------------------------------------- */
/* Additional RACF set-up for SSL for Clients supporting            */
/*   Client Certificates                                            */
/* - create personal certificates for clients using our Test CA and */
/*   connect these certificates into the clients' keyrings          */
/*                                                                  */
/*------------------------------------------------------------------*/
)BLANK
)BLANK
RETURN
)BLANK
)BLANK
permit4IMSPAA:
/* ---------------------------------------------------------------- */
/*      IMS OTMA PAA Usage                                          */
/*                                                                  */
/* ---------------------------------------------------------------- */
/*                                                                  */
/* Example access authorizations.                                   */
/*                                                                  */
/* ---------------------------------------------------------------- */
/* 1. If you need to do authorization setup for IMS OTMA PAA        */
/*    usage, uncomment and issue the following command to indicate  */
/*    this type of processing is being done by the clist.           */
/*                                                                  */
/* 2. To control the users that are allowed to use the IMS OTMA     */
/*    callable interface, uncomment the following two commands      */
/*    to define the profile, IMSXCF.OTMACI, in the RACF FACILITY    */
/*    class (only do once):                                         */
/*                                                                  */
/* "RDEF FACILITY IMSXCF.OTMACI UACC(NONE)"                         */
/* "SETROPTS RACLIST(FACILITY) REFRESH"                             */
/*                                                                  */
/* 3. In all cases where a server is defined with a container that  */
/*    has an IMS OTMA PAA LRM defined to it, authorize the userid   */
/*    associated with the corresponding server region to use the    */
/*    OTMA callable interface (i.e., the userid under which the     */
/*    the server region is started). To do so, uncomment and        */
/*    and replicate the following command once for each userid      */
/*    that needs to be permitted to use the OTMA callable           */
/*    interface. Replace xxxxx with the server region userid that   */
/*    needs to be authorized.                                       */
/*                                                                  */
/* "PERMIT IMSXCF.OTMACI CLASS(FACILITY) ID(xxxxxx) ACCESS(READ)"   */
/*                                                                  */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Facility class refresh ')
call ProcessCmd( "SETROPTS RACLIST(FACILITY) REFRESH")
)BLANK
RETURN
)BLANK
)BLANK
permit4CICSPAA:
/* ---------------------------------------------------------------- */
/*      CICS EXCI PAA Usage                                         */
/*                                                                  */
/* ---------------------------------------------------------------- */
/*                                                                  */
/* Example access authorizations.                                   */
/*                                                                  */
/* ---------------------------------------------------------------- */
/* If you run your CICS with SURROGCHK=YES, you'll need to do       */
/* the following authorization setup to use the CICS EXCI PAA       */
/* support:                                                         */
/*                                                                  */
/* 1. Uncomment and issue the following command to indicate         */
/*    CICS EXCI setup processing is being done by the clist.        */
/*                                                                  */
/* say 'Setup for CICS EXCI PAA usage '                             */
/*                                                                  */
/* 2. Uncomment the following two commands to setup a SURROGAT      */
/*    class profile that can be used to permit a WebSphere/390 Server */
/*    to be a surrogate for all users of the CICS EXCI interface.   */
/*                                                                  */
/* "RDEF SURROGAT *.DFHEXCI UACC(NONE)"                             */
/* "SETROPTS RACLIST(SURROGAT) REFRESH"                             */
/*                                                                  */
/* 3. In all cases where a server is defined with a container that  */
/*    has a CICS EXCI PAA LRM defined to it, authorize the userid   */
/*    associated with the corresponding servant region (i.e., the   */
/*    userid under which the servant region is started) to be a     */
/*    surrogate for users of the EXCI interface. To do so,          */
/*    uncomment and replicate the following command once for each   */
/*    userid that needs to be permitted to be a surrogate. Replace  */
/*    xxxxx with the servant region userid that needs to be         */
/*    authorized.                                                   */
/*                                                                  */
/* "PERMIT *.DFHEXCI CLASS(SURROGAT) ID(xxxxxx) ACCESS(READ)"       */
/*                                                                  */
/* ---------------------------------------------------------------- */
)BLANK
RETURN
)BLANK
)BLANK
/* ---------------------------------------------------------------- */
/* PermitAPPLclass function                                @MD16761A*/
/* ---------------------------------------------------------------- */
/* Sets permissions for CLASS(APPL)                        @MD16761A*/
/* PERMIT CBS390 CLASS(APPL) ID(all userids) ACCESS(READ)  @MD16761A*/
/* ---------------------------------------------------------------- */
PermitAPPLclass:
call PutComment('APPL class setup.')
call PutComment('Used to control client access to a WebSphere Application Server for z/OS cell or group of cells.')
CMD = "RDEFINE APPL " || application_id || " UACC(NONE)" /*@WS15621C*/ /*WS15621C*/
call ProcessCmd CMD                                      /*@MD16761A*/
 
CMD = "PERMIT" application_id "CLASS(APPL) ID(" || ,
       default_WS_CFG_group || ") ACCESS(READ)"
call ProcessCmd CMD
 
CMD = "PERMIT" application_id "CLASS(APPL) ID(" || ,
       default_WS_unauth_userid || ") ACCESS(READ)"
call ProcessCmd CMD
)BLANK
CMD = "SETROPTS RACLIST(APPL) REFRESH"
call ProcessCmd CMD
)BLANK
return
)BLANK
)BLANK
/* ---------------------------------------------------------------- */
/*                   cv2lower function                              */
/* ---------------------------------------------------------------- */
/* converts upper case to lower case letters                        */
/* ---------------------------------------------------------------- */
)BLANK
 cv2lower: procedure expose kerbId
    upper = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
    lower = 'abcdefghijklmnopqrstuvwxyz'
    parse ARG racfId
)BLANK
    kerbId = TRANSLATE(racfId, lower, upper)
    return
)BLANK
/* ---------------------------------------------------------------- */
/*                   ProcessCmd Routine                             */
/* ---------------------------------------------------------------- */
/* ProcessCmd either executes the command, or writes it out into   */
/*        a file that is 80 characters in width.                   */
/* ---------------------------------------------------------------- */
ProcessCmd: procedure expose maxrc switch
  parse arg command
  linelen = 68                                         /* @MD16362A*/
  if switch = 'issuecmds' then do
     ADDRESS TSO command
     rrc =rc
     if rrc > maxrc  then
        maxrc  = rrc
     end
  else do
     start=1
     do while (start <= LENGTH(command))
     if  LENGTH(SUBSTR(command,start)) <= linelen then  /* @MD16362C*/
        QUEUE '"' || Substr(command,start) || '"'       /* @MD16362C*/
     else
        QUEUE '"' || Substr(command,start,linelen) || '" || ,' /* @MD16362C*/
     EXECIO 1 DISKW RACFCMDS
     start = start + linelen                            /* @MD16362C*/
     end
    QUEUE 'say'        /* blank line after each cmd */  /* @MD17166A*/
     EXECIO 1 DISKW RACFCMDS                            /* @MD17166A*/
    QUEUE ' '          /* blank line after each cmd */  /* @MD17166A*/
     EXECIO 1 DISKW RACFCMDS                            /* @MD17166A*/
   end
  return
/* ---------------------------------------------------------------- */
/*                   PutComment Routine                             */
/* ---------------------------------------------------------------- */
/* PutComment displays a comment.  If executing the command it      */
/*        is out in SYSTSPRT, otherwise it is dispersed into the    */
/*        command file.                                             */
/* ---------------------------------------------------------------- */
PutComment: procedure expose switch
  parse arg comment
  linelen = 68                                         /* @MD16362A*/
  if switch = 'issuecmds' then do;
     say comment
     end;
  else do;
     start=1
     do while (start <= LENGTH(comment))
       QUEUE  "say '"  || Substr(comment,start,linelen) || "'"
       EXECIO 1 DISKW RACFCMDS
       start =start+linelen                            /* @MD16362C*/
     end;
  end;
  return
/* ---------------------------------------------------------------- */
/*                   PutLine Routine                             */
/* ---------------------------------------------------------------- */
/* PutLine writes a single line to SYSTSPRT or to the command file  */
/* ---------------------------------------------------------------- */
PutLine: procedure expose switch
  parse arg comment
  if switch = 'issuecmds' then do;
     say comment
     end;
  else do;
       QUEUE  comment
       EXECIO 1 DISKW RACFCMDS
  end;
return
