)CM
)DEFAULT )&?![^]
)CM
/* REXX ----------------------------------------------------------- */
/* ================================================================ */
/*                                                                  */
/* COPYRIGHT =                                                      */
/* Licensed Material - Property of IBM                              */
/*                                                                  */
/* 5724-I63, 5724-H88, 5655-N01, 5733-W61                           */
/* (C) Copyright IBM Corp. 1999, 2006                               */
/* All Rights Reserved                                              */
/* US Government Users Restricted Rights - Use, duplication or      */
/* disclosure restricted by GSA ADP Schedule Contract with IBM Corp.*/
/*                                                                  */
/*                                                                  */
/* FUNCTION:                                                        */
/*   WebSphere for z/OS Sample RACF group definitions               */
/*                                                                  */
/* ================================================================ */
/* This is a sample exec which customers may modify to include      */
/* installation specific RACF requirements.  This exec defines      */
/* all the userids and groups that are necessary and sufficient     */
/* for installing WebSphere and running the Initial Verification    */
/* Program (IVP).                                                   */
/* Additionally, there are commented sections for other components  */
/* that might be used (for example, SSL).                           */
/*                                                                  */
/*==================================================================*/
/* This EXEC either:                                                */
/*    - generates a set of RACF commands in the form of a REXX exec */
/*      which is written to the RACFCMDS DD statement. Any error or */
/*      warnings for Exec processing will be written to SYSTSPRT DD */
/*         or                                                       */
/*    - creates and executes the RACF commands generated here.      */
/*      in this case, all output is directed to SYSTSPRT DD         */
/*                                                                  */
/* THE SETTING OF THE *switch* VARIABLE CONTROLS THIS.              */
/*==================================================================*/
/*                                                                  */
/* NOTE: This sample is biased toward getting WebSphere installed   */
/* and running quickly on a test system.  You should reexamine the  */
/* the values (especially the UACC values) when moving to           */
/* production.                                                      */
/* ---------------------------------------------------------------- */
/* Basic Assumptions -                                              */
/*                                                                  */
/* RACF access will be at the group level rather than the userid    */
/* to minimize the number of RACF definitions.                      */
/*                                                                  */
/* Each controller region will have its own unique userid. The      */
/* WebSphere controller regions are:                                */
/*     Daemon                                                       */
/*     AppServer                                                    */
/*     Deployment Manager                                           */
/*                                                                  */
/* All of the above controller regions' userids will be in the same */
/* RACF group.                                                      */
/*                                                                  */
/* The deployment manager servant will have its own user ID.        */
/*                                                                  */
/* STEPS TO USING THIS EXEC                                         */
/*                                                                  */
/* 1. Indicate if you want to generate a dataset with RACF          */
/*    commands or issue them directly from this exec.               */
/* 2. You must supply a logstream dataset name, and a DB2           */
/*    subsystem name.                                               */
/* 3. Review the supplied values for all the needed userids and     */
/*    RACF groups.  You can use the values provided or change them. */
/* 4. Determine which optional security mechanisms you wish to      */
/*    enable, and modify values as needed for these.  See the       */
/*    comment 'Optional Security Mechanisms'                        */
/* 5. Modify and run the job BBODBRAJ in the your CNTL PDS ...      */
/*      &TRGHLQ..CNTL.                                              */
/*    The results of the job can be seen in the SYSPRINT output.    */
/*    If you generate command output, that will be in RACFCMDS DD.  */
/*                                                                  */
/* Usage notes:                                                     */
/*                                                                  */
/* -The definitions defined here are sufficient to get the basic    */
/*  WAS system up and running and to run the IVP.                   */
/*                                                                  */
/* -If you are using this EXEC to migrate your installation from    */
/*  WebSphere V5 to WebSphere V6, it is recommended that you route  */
/*  RACF command output to a dataset rather than executing the      */
/*  commands directly.                                              */
/*                                                                  */
/* -Similarly, if you wish to use this EXEC to control access to    */
/*  the OPERCMDS class, it is recommended that you route RACF       */
/*  command output to a dataset rather than executing the commands  */
/*  directly.                                                       */
/*                                                                  */
/* - If you output RACF commands into a dataset, the output will    */
/*  be formatted as a simple rexx EXEC. Code this output dataset    */
/*  in the SYSEXEC DD statement of the JCL invoking the IKJEFT01    */
/*  program.(BBODBRAJ in your CNTL PDS also invokes IKJEFT01.)      */
/*                                                                  */
/* -If multiple WebSphere systems are running in the same security  */
/*  environment, all controller region and servant regions can have */
/*  unique identities merely by incrementing the number at the      */
/*  the end of the name prefix.                                     */
/*                                                                  */
/* -default_WS_CFG_group is used as the group id of the WebSphere   */
/*  configuration files in the hfs, all users which are connected   */
/*  to this group will have read access to the configuration files. */
/*  Therefore, this group doesn't need any explicit permits.        */
/*                                                                  */
/* -During installation, if you change the server short name to use */
/*  a prefix other than the BBO* default, you must create your own  */
/*  non-default RACF SAF profile using the non-default prefix. For  */
/*  more information, see "Understanding System Authorization       */
/*  Facility profile names generated by the Customization Dialog"   */
/*  in the WebSphere Application Server Information Center located  */
/*  at:                                                             */
/*                                                                  */
/*  www-306.ibm.com/software/webservers/appserv/zos_os390/library/  */
/*                                                                  */
/* ---------------------------------------------------------------- */
/*  Change History:                                                 */
/*                                                                  */
/*      MD16289 H28W500 030327  PDML: initial release.              */
/*      MD16547 H28W500 030403  PDG1: remove daemon server/cbind    */
/*      MD16604 H28W500 030403  PDG1: update started task           */
/*      MD16362 H28W500 041003  PDG1: echo command before invoke    */
/*      MD16761 H28W500 041103  PDG1: fix started task              */
/*      MD16791 H28W500 050509  PDOC: enable SSL unconditionally    */
/*                                    create SAF EJBROLES for       */
/*                                    WAS administration            */
/*                                    Restricted user profiles      */
/*                                    Restructure for WS Sec on     */
/*      MD17040 H28W500 050703  PDG1: Update SERVER for WLM-DAE     */
/*      MD17166 H28W500 051603  PDG1: Change echo to use single str */
/*      MD17013 H28W500 052103  PDML: Make Server Ids Protected     */
/*      MD16594 H28W500 053003  PDOC: Move EJBRoles to Base         */
/*      MD17349 H28W500 061003  PDOC: CN for DeployManager Incorrect*/
/*      WS15621 H28W502 081803  PDRZ: Multi-node support. Some      */
/*                                    functions moved to BBOSBRAC   */
/*      MD18098 H28W502 091903  PDRZ: Daemon SSL keyring, certs     */
/*      MD18528 H28W502 110703  PDGK: Change value of               */
/*                                    build_WebSphere_Profiles      */
/*      PQ86559 H28W502 072304  PDSS: RACF BBO* SAF profile names   */
/*      250035  H28W601 011704    DB: Remove refs to passticket     */
/*                                    Text updates for V6           */
/*      251673  H28W601 012605    DB: change v5/v6 to V5/V6         */
/*      250152  H28W601 020105    DB: create keyring for for servant*/
/*      255429  H28W601 021605    DB: add FILEPROC of 10000 for the */
/*                                    dmgr SR userid                */
/*      279429  H28W602 052705  PDML: update HOME value.            */
/*      281074  H28W602 060305  PDML: update HOME value.            */
/*      283304  H28W602 061305  PDML: remove USERHOME.              */
/*     PK07374  H28W602 062105  PDML: update HOME value.            */
/*    LIDB2634  H28W610 082405  PDML: security out of box update.   */
/*      309640  H28W610 093005  kvijai: Update CosNaming roles and  */
/*                                 add adminsecuritymanager and     */
/*                                 deployer role to EJBROLE         */
/*      311865  H28W610 100805    DB: create asynch user always,    */
/*                                    add logic for SSL on daemon   */
/*      313369  H28W610 101305    DB: missing end on an if stmt     */
/*                                    and remove asynch user items  */
/*      326125  H28W610 112805    DB: Certificate CN should be      */
/*                                    daemon IP name                */
/*      328269  H28W610 120105    DB: Remove excess addring stmt    */
/*      330975  H28W610 121405    DB: use cell_name for cert LABEL  */
/*                                    and use DMKEYR now            */
/*     330975.1 H28W610 011006    DB: fix item missed with 330975   */
/*     350729.1 H28W610 030206    DB: add what was done for 351971  */
/*      354119  H28W610 031006    JB: add keyring for WAS admin ID  */
/*     356731   H28W610 032106    DB: personal cert name incorrect  */
/*      362158  H28W610 041206    DB: use NOPASSWORD/NOOIDCARD for  */
/*                                    admin and unauth ids          */
/*      354695  H28W610 041206    DB: remove setupOperCmds routine  */
/*      362400  H28W610 041206    DB: remove 3-part SERVER profiles */
/*      360439  H28W610 041306  sdittmar: explain generated cmds    */
/*      369495  H28W610 060406    DB: use generic CBIND profiles    */
/*      348320  H28W610 060506    DB: auto UID/GID support          */
/*      371657  H28W610 060706    DB: add refresh for APPL class    */
/*      368332  H28W610 060706    DB: change CB390 to CBS390        */
/*----------------------------------------------------------------- */
)BLANK
issue_cmds_switch = ''
parse upper arg parms
)BLANK
/*------------------------------------------------------------------*/
/* Specify whether to execute commands immediately or write them    */
/* to a file.                                                       */
/*------------------------------------------------------------------*/
)BLANK
parse upper var parms . "ISSUECMDS(" issue_cmds_switch ")" .
issue_cmds_switch =strip(issue_cmds_switch)
if issue_cmds_switch = "Y" then switch = "issuecmds"
else switch = "generatecmds"
)BLANK
/*-----------------------------------------------------------------*/
/* Define a group to own the files in the WAS configuration HFS.   */
/* Controller regions (which run authorized code) also need to     */
/* have this as their default group, since they update the HFS.    */
/* Add anyone to this group that needs access to HFS configuration */
/* files or administrator access.                    @MD16594.1C   */
/*-----------------------------------------------------------------*/
default_WS_CFG_group                    = "&CNFGGRP"
default_WS_CFG_GID                      = "&CNFGGID"
)BLANK
/*-----------------------------------------------------------------*/
/* Define a group for WebSphere servant region user IDs.           */
/* These regions run application code but need some common         */
/* permissions, which are granted to this group.                   */
/*-----------------------------------------------------------------*/
default_WS_SR_group                     = "&ALLGRPS"
default_WS_SR_GID                       = "&ALLGIDS"
)BLANK
/*------------------------------------------------------------------*/
/* Define a group for local clients and unauthorized user IDs -     */
/* i.e. any local user IDs that need some minimal access to the     */
/* cell.                                                            */
/*------------------------------------------------------------------*/
default_WS_unauth_group                 = "&ALLGRPD"
default_WS_unauth_GID                   = "&ALLGIDD"
)BLANK
default_daemon_CR_proc_name                = "&DMNPRCC"
default_daemon_CR_userid                   = "&DMNUSRC"
default_daemon_CR_UID                      = "&DMNUIDC"
default_daemon_CR_GID                      = default_WS_CFG_GID
default_daemon_generic_server_name         = "&DMNNAME"
default_daemon_server_instance_name        = "&DMNINSN"
)BLANK
default_dm_daemon_CR_proc_name             = "&DMNPRCC2"
default_dm_daemon_CR_userid                = "&DMNUSRC2"
default_dm_daemon_CR_UID                   = "&DMNUIDC2"
default_dm_daemon_CR_GID                   = default_WS_CFG_GID
default_dm_daemon_generic_server_name      = "&DMNJNAM2"       /* @MD16604C*/
)BLANK
default_dmgr_CR_proc_name                  = "&DMPRCC"
default_dmgr_SR_proc_name                  = "&DMPRCS"
default_dmgr_CR_userid                     = "&DMUSRC"
default_dmgr_CR_UID                        = "&DMUIDC"
default_dmgr_CR_GID                        = default_WS_CFG_GID
default_dmgr_SR_userid                     = "&DMUSRS"
default_dmgr_SR_UID                        = "&DMUIDS"
default_dmgr_SR_GID                        = default_WS_SR_GID
default_dmgr_cluster_name                  = "&DMCTN"
default_dmgr_server_jobname                = "&DMSSNS"
default_dmgr_server_jobname_SR             = "&DMSSNS" || "S"  /* @MD16604A*/
)BLANK
)BLANK
cell_name                                  = "&DMCENS"
daemon_ipname                              = "&DMNIPNA2"
enable_daemon_ssl                          = "&DAESSL"
)BLANK
/* If security is on you need SSL.                       */
WS_TestCA               = "&CALAB"            /*@WS15621C*/
WS_generate_CA_cert         = "&CAGEN"
ws_cert_expiration_date     = "&CAEXPDAT"     /*@WS15621A*/
)BLANK
Dmgr_keyring            = "&DMKEYR"           /*@MD18098C*/
Dmgr_daemon_keyring     = "&DMKEYR"           /*@MD18098A*/
)BLANK
/*------------------------------------------------------------------*/
/* Specify the name of the error log stream.                        */
/*------------------------------------------------------------------*/
default_logstream_name                  = "&ERRLOG" /*none pokvmtl5 */
)BLANK
/*------------------------------------------------------------------*/
/* Provide your DB2 subsystem name for DSNR support.                */
/*------------------------------------------------------------------*/
default_DB2_ssname                      = "&DB2SSID"
)BLANK
)SEL &BBOWST = FS
/*-------------------------------------------------------*/
/* WebSphere family security has been selected.          */
/* Additional variables are defined here.                */
/*-------------------------------------------------------*/
)BLANK
/*-------------------------------------------------------*/
/* Define an administrator user ID to WebSphere.         */
/* No corresponding RACF user ID is created.             */
/*-------------------------------------------------------*/
default_WS_admin_userid                 = "&WASADMN"
default_WS_admin_userid_password        = "&WASPW"
default_WS_admin_UID                    = "&WASUID"
)BLANK
/*-------------------------------------------------------*/
/* End of setup for WebSphere family security.           */
/*-------------------------------------------------------*/
)BLANK
)ENDSEL
)SEL &BBOWST = ZS
/*-------------------------------------------------------*/
/* WebSphere for z/OS security has been selected.        */
/* Additional variables are defined here.                */
/*-------------------------------------------------------*/
)BLANK
/*-------------------------------------------------------*/
/* Optional - specify a security domain name.            */
/*-------------------------------------------------------*/
security_domain_qualify     ="&USEDOMN"       /*@WS15621A*/
security_domain_name        ="&DOMAINNM"      /*@WS15621A*/
if (security_domain_qualify = "Y") && (security_domain_name <> "")
    then do
      domain_postfix = "." || security_domain_name
      domain_prefix = security_domain_name || "."
      domain = security_domain_name
    end
    else do
      domain_postfix = ""
      domain_prefix = ""
      domain = "CBS390"
    end
application_id = domain
)BLANK
/*-------------------------------------------------------*/
/* Define an administrator user ID to WebSphere and RACF.*/
/* It must have the config group as its default group.   */
/*-------------------------------------------------------*/
default_WS_admin_userid                 = "&WASADMN"
default_WS_admin_userid_password        = "&WASPW"
default_WS_admin_UID                    = "&WASUID"
)BLANK
/*------------------------------------------------------------------*/
/* Define one default unauthorized-client ID to be used by all the  */
/* regions.  If you want unique IDs for different regions (DMgr,    */
/* and so forth) then you will define them similarly, and connect   */
/* them to the unauthorized client group specified above.           */
/*------------------------------------------------------------------*/
default_WS_unauth_userid                = "&ALLUSRD"
default_WS_unauth_UID                   = "&ALLUIDD"
)BLANK
/*-------------------------------------------------------*/
/* End of setup for WebSphere for z/OS security.         */
/*-------------------------------------------------------*/
)BLANK
)ENDSEL
/*-------------------------------------------------------*/
/*    Optional security mechanisms?  "Y" or "N"          */
/*-------------------------------------------------------*/
/* do you use the DSNR class to protect DB2 resources?   */
UseDB2DSNR = "N"
)BLANK
/* do you want to protect use of Operator Commands       */
/* which are needed by ADMIN to manage Servers?          */
UseOperCmds = "N"
)BLANK
/* Use SSL Basic Authentication? (ID/PW over SSL)        */
UseSSLBA    = "N"
)BLANK
/* Use SSL Client Certificates?                          */
UseSSLClientCerts = "N"
)BLANK
/* Setup for use also as Remote Client?                  */
RemoteClient = "N"
)BLANK
/* Setup for use connectors?                             */
useIMSOTMA="N"
useCICSPAA="N"
)BLANK
/*-------------------------------------------------------*/
/*             Start of Standard setup                   */
/*-------------------------------------------------------*/
maxrc = 0
)BLANK
/* Verify that required data fields are set up */
call VerifyRequiredData
if maxrc > 4 then
   exit maxrc
)BLANK
 if switch = 'issuecmds'  then do;
    call PutComment('WebSphere Application Server RACF Setup')
    call PutComment('-- Deployment Manager')
    call PutComment('-- Cell name:' cell_name )
    call PutComment('-- Config group:' default_WS_CFG_group )
    call PutComment('Generated on ' || DATE() || ' at ' || TIME() )
   end;
)BLANK
  else do;
    call PutLine('/* REXX */')
    call PutComment('WebSphere Application Server RACF Setup')
    call PutComment('-- Deployment Manager')
    call PutComment('-- Cell name:' cell_name )
    call PutComment('-- Config group:' default_WS_CFG_group )
    call PutComment('Generated on ' || DATE() || ' at ' || TIME() )
    call PutLine('trace commands')
   end;
/*-------------------------------------------------------*/
/*        General RACF Classes for OS level Security     */
/*-------------------------------------------------------*/
call ActivateClasses
)BLANK
/*-------------------------------------------------------*/
/* Create WAS user IDs for the location service daemon,  */
/* controller and servants.  These are needed regardless */
/* of which security scheme is chosen.                   */
/*-------------------------------------------------------*/
call CreateUsers
)BLANK
/*-------------------------------------------------------*/
/* Set up access to the WAS error logstream.             */
/* If you want your clients to write to the logstream,   */
/* you must update this procedure.                       */
/*-------------------------------------------------------*/
call AccessLogstream
)BLANK
/*-------------------------------------------------------*/
/* Create SERVER definitions to control servant access   */
/* to controller resources.                              */
/*-------------------------------------------------------*/
call ServerClass
)BLANK
/*-------------------------------------------------------*/
/* Allow servant regions to access WLM services.         */
/*-------------------------------------------------------*/
call setupWLM                                           /*@MD18997A*/
)BLANK
/*-------------------------------------------------------*/
/* Create started task profiles to assign user IDs to    */
/* the daemon, controller and servant regions.           */
/*-------------------------------------------------------*/
call assignStarted
)BLANK
/*-------------------------------------------------------*/
/* Perform basic SSL setup.                              */
/*-------------------------------------------------------*/
call setupSSL
)BLANK
/*-------------------------------------------------------*/
/* Set up SSL for the Location Service Daemon            */
/*-------------------------------------------------------*/
call enableDaemon_SSL
)BLANK
)BLANK
)SEL &BBOWST = FS
/*-------------------------------------------------------*/
/* Perform additional setup for WebSphere family         */
/* security.                                             */
/*-------------------------------------------------------*/
)BLANK
/*-------------------------------------------------------*/
/* End of additional setup for WebSphere family          */
/* security.                                             */
/*-------------------------------------------------------*/
)BLANK
)ENDSEL
)BLANK
)SEL &BBOWST = ZS
/*-------------------------------------------------------*/
/* Perform additional setup for WebSphere for z/OS       */
/* security.                                             */
/*-------------------------------------------------------*/
)BLANK
/*-------------------------------------------------------*/
/* Activate additional classes.                          */
/*-------------------------------------------------------*/
call ActivateClasses_ZOS
)BLANK
/*-------------------------------------------------------*/
/* Define additional user IDs.                           */
/*-------------------------------------------------------*/
call CreateUsers_ZOS
)BLANK
/*-------------------------------------------------------*/
/* Set up APPL security definitions.                     */
/*-------------------------------------------------------*/
call PermitAPPLclass                              /*    @WS15621D*/
/*-------------------------------------------------------*/
/* Set up CBIND definitions to control who is allowed to */
/* connect to and and access servers, and also determine */
/* who is trusted to pass on other identities.           */
/*-------------------------------------------------------*/
call CBINDClass
)BLANK
/*-------------------------------------------------------*/
/* Set up EJBROLE definitions.                           */
/*-------------------------------------------------------*/
call setupEJBRoleAccess
)BLANK
/*-------------------------------------------------------*/
/* Set up SSL for WebSphere for z/OS security:           */
/*  - digital certificate for the controller             */
/*  - keyrings for servants and administrators           */
/*-------------------------------------------------------*/
call setupSSL_ZOS
)BLANK
/*-------------------------------------------------------*/
/* Set up additional facilities                          */
/*  - EnabledTrustedApplications                         */
/*  - SyncToThread                                       */
/*-------------------------------------------------------*/
call setupSpecialFacilities_ZOS
)BLANK
/*-------------------------------------------------------*/
/* End of additional setup for WebSphere for z/OS        */
/* security.                                             */
/*-------------------------------------------------------*/
)BLANK
)ENDSEL
)BLANK
/*-------------------------------------------------------*/
/* If desired, allow servants to access DB2.             */
/*-------------------------------------------------------*/
if UseDB2DSNR = "Y"
    then do
    call setupDB2
    end
)BLANK
/*-------------------------------------------------------*/
/* the following authentication methods are options for  */
/*  remote security.                                     */
/*-------------------------------------------------------*/
)BLANK
if UseSSLClientCerts = "Y"
   then do
     call ServerSSLforClientCerts
   end
)BLANK
/*-------------------------------------------------------*/
/* Sample routines to set up IMS and CICS permissions.   */
/*-------------------------------------------------------*/
if useIMSOTMA="Y"
  then do
     call Permit4IMSPAA
  end
)BLANK
if useCICSPAA="Y"
  then do
     call Permit4CICSPAA
  end
)BLANK
/*---------------------------------------------------------*/
/*           Exit with highest return code                 */
/*---------------------------------------------------------*/
call PutComment('End of generated commands.')
if switch = "generatecmds" then do
   "EXECIO 0 DISKW RACFCMDS ( FINIS "
   end
exit maxrc
)BLANK
)BLANK
/*------------------------------------------------------------------*/
/*  Start of Subroutine Section                                     */
/*------------------------------------------------------------------*/
VerifyRequiredData:
/* ---------------------------------------------------------------- */
/* Do prechecks of values that have no reasonable defaults and need */
/* to be set before using this exec.                                */
/* ---------------------------------------------------------------- */
)BLANK
if default_logstream_name = "" then
  do
     say "You need to fill in a valid logstream name before running this exec."
     maxrc = 100
  end
)BLANK
RETURN
)BLANK
)BLANK
ActivateClasses:
/* ---------------------------------------------------------------- */
/* Activates all RACF classes which are needed regardless of        */
/* which WebSphere security scheme is chosen.                       */
/* ---------------------------------------------------------------- */
call PutComment('Activating RACF classes which are needed regardless of security scheme.')
CMD = "SETROPTS CLASSACT(SERVER)"
call ProcessCmd CMD
CMD = "SETROPTS RACLIST(SERVER) GENERIC(SERVER)"
call ProcessCmd CMD
CMD = "SETROPTS CLASSACT(STARTED)"
call ProcessCmd CMD
CMD = "SETROPTS RACLIST(STARTED) GENERIC(STARTED)"
call ProcessCmd CMD
CMD = "SETROPTS CLASSACT(FACILITY)"
call ProcessCmd CMD
CMD = "SETROPTS RACLIST(FACILITY) GENERIC(FACILITY)"
call ProcessCmd CMD
CMD = "SETROPTS GRPLIST"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
ActivateClasses_ZOS:
/* ---------------------------------------------------------------- */
/* Activates additional RACF classes used by WebSphere for z/OS     */
/* security.                                                        */
/* ---------------------------------------------------------------- */
call PutComment('Activating classes needed only for z/OS security.')
CMD = "SETROPTS CLASSACT(CBIND)"
call ProcessCmd CMD
CMD = "SETROPTS RACLIST(CBIND) GENERIC(CBIND)"
call ProcessCmd CMD
CMD = "SETROPTS CLASSACT(SURROGAT) GENERIC(SURROGAT)"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
CreateUsers:
/* -----------------------------------------------------------------*/
/* Determine whether to use AUTOUID or the user specified UID for   */
/* each of the user ids                                             */
/* -----------------------------------------------------------------*/
)BLANK
/* dmgr Daemon userid ----------------------------------------------*/
if default_dm_daemon_CR_UID = "*"
 then do
    dm_daemon_CR_uid_string = "AUTOUID"
 end
 else do
    dm_daemon_CR_uid_string = "UID(&DMNUIDC2)"
 end
/* dmgr CR userid --------------------------------------------------*/
if default_dmgr_CR_UID = "*"
 then do
    dmgr_CR_UID_string = "AUTOUID"
 end
 else do
    dmgr_CR_UID_string = "UID(&DMUIDC)"
 end
/* dmgr SR userid --------------------------------------------------*/
if default_dmgr_SR_UID = "*"
 then do
    dmgr_SR_UID_string = "AUTOUID"
 end
 else do
    dmgr_SR_UID_string = "UID(&DMUIDS)"
 end
/* Administrator userid --------------------------------------------*/
if default_WS_admin_UID = "*"
 then do
    admin_UID_string = "AUTOUID"
 end
 else do
    admin_UID_string = "UID(&WASUID)"
 end
/* Unauth userid ---------------------------------------------------*/
if default_WS_unauth_UID = "*"
 then do
    unauth_UID_string = "AUTOUID"
 end
 else do
    unauth_UID_string = "UID(&ALLUIDD)"
 end
/* ---------------------------------------------------------------- */
/* Define the user ids which are needed regardless of which         */
/* security scheme is selected.                                     */
/* ---------------------------------------------------------------- */
)BLANK
/* ---------------------------------------------------------------- */
/* Define the user ids for each of the server controller regions:   */
/* daemon, Appserver, and Deployment Manager.                       */
/* ---------------------------------------------------------------- */
)BLANK
 call PutComment('Adding users for WAS Deployment Manager Regions. ')
)BLANK
/* Daemon userid for dmgr ------------------------------------------*/
 call PutComment('Adding WAS Deployment Manager Daemon user ID. ')
 CMD = "ADDUSER " || default_dm_daemon_CR_userid || ,
       " DFLTGRP(" || default_WS_CFG_group || ,
       ") OMVS("|| dm_daemon_CR_uid_string || ,
       " HOME(&USERHOME/&CNFGGRP) PROGRAM(/bin/sh)) NAME('WAS DAEMON CR') " ||  ,
       " NOPASSWORD NOOIDCARD"                            /*MD17013C*/
 call ProcessCmd CMD
)BLANK
/* Deployment Manager controller user ID--------------------------- */
 call PutComment('Adding WAS Deployment Manager controller user ID. ')
 CMD = "ADDUSER " || default_dmgr_CR_userid || ,
   " DFLTGRP(" || default_WS_CFG_group || ,
   ") OMVS("|| dmgr_CR_UID_string      || ,
   " HOME(&USERHOME/&CNFGGRP) PROGRAM(/bin/sh)) NAME('WAS DMGR CR') " || ,
   " NOPASSWORD NOOIDCARD"                               /* MD17013C*/
 call ProcessCmd CMD
)BLANK
/* Deployment Manager servant user ID------------------------------ */
 call PutComment('Adding WAS Deployment Manager servant user ID. ')
 CMD = "ADDUSER " || default_dmgr_SR_userid || ,
   " DFLTGRP(" || default_WS_SR_group || ,
   ") OMVS("|| dmgr_SR_UID_string     || ,
   " HOME(&USERHOME/&ALLGRPS) PROGRAM(/bin/sh)) NAME('WAS DMGR SR') " || ,
   " NOPASSWORD NOOIDCARD"                               /* MD17013C*/
 call ProcessCmd CMD
)BLANK
 call PutComment('Allow 10000 concurrently open files.')
 CMD = "ALU " || default_dmgr_SR_userid || ,
             " OMVS(FILEPROC(10000))"
 call ProcessCmd CMD
)BLANK
/*-----------------------------------------------------------------  */
/* Connect servant userids to the WebSphere configuration group.     */
/* (Controllers already have this as their default group.)           */
/*-----------------------------------------------------------------  */
call PutComment('Connecting servant user ID to the WAS config group. ')
CMD = "CONNECT " || default_dmgr_SR_userid || ,
   " group(" || default_WS_CFG_group || ")"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
CreateUsers_ZOS:
/* ---------------------------------------------------------------- */
/* Define the administrator and unauthorized-user IDs.              */
/*                                                                  */
/* Jobs will need to be submitted under the userid associated       */
/* with the default WebSphere administrator id. It requires an      */
/* unexpired password.                                              */
/*                                                                  */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Adding WAS administrator user ID.')
)BLANK
CMD = "ADDUSER " || default_WS_admin_userid || ,
   " DFLTGRP(" || default_WS_CFG_group || ,
   ") OMVS("|| admin_UID_string || ,
   " HOME(&USERHOME/&CNFGGRP) PROGRAM(/bin/sh)) NAME('WAS ADMINISTRATOR') " || ,
   " NOPASSWORD NOOIDCARD"
call ProcessCmd CMD
)BLANK
/* ---------------------------------------------------------------- */
/* Define a user ID to be used for unauthenticated requests.        */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Adding WAS unauthenticated user ID')
)BLANK
CMD = "ADDUSER " || default_WS_unauth_userid || ' RESTRICTED ' ||, /*MD16971C*/
   " DFLTGRP(" || default_WS_unauth_group || ,
   ") OMVS("|| unauth_UID_string || ,
   " HOME(&USERHOME/&ALLGRPD) PROGRAM(/bin/sh)) NAME('WAS DEFAULT USER') "  || ,
   " NOPASSWORD NOOIDCARD"
 call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
AccessLogstream:
/* ---------------------------------------------------------------- */
/* LOGSTREAM Set-Up                                                 */
/*                                                                  */
/* ---------------------------------------------------------------- */
/*                                                                  */
/* Set up access authorizations for the log stream:                 */
/*                                                                  */
/* For each server identity (or client identity, if you allow       */
/* clients to write to the error log stream), assign UPDATE         */
/* access to the log stream:                                        */
/*                                                                  */
/* Note: in a production environment, you would likely want the     */
/*       UACC to be NONE.                                           */
/* ---------------------------------------------------------------- */
)BLANK
 call PutComment('Defining access authorizations for the log stream. ')
 CMD = "RDEFINE LOGSTRM" default_logstream_name "UACC(READ)"
 call ProcessCmd CMD
)BLANK
 call PutComment('Permitting WAS configuration group to update log stream. ')
 CMD = "PERMIT" default_logstream_name "CLASS(LOGSTRM)" || ,
      " ID("default_WS_CFG_group") ACCESS(UPDATE)"
 call ProcessCmd CMD
)BLANK
)BLANK
Call ProcessCmd ("SETROPTS CLASSACT(LOGSTRM)")
/*------------------------------------------------------------------*/
/* For each user who browses the error log stream, assign READ      */
/* access:                                                          */
/*                                                                  */
/*  PERMIT log_stream_name CLASS(LOGSTRM) ID(user_ID) ACCESS(READ)  */
/*                                                                  */
/* ---------------------------------------------------------------- */
RETURN
)BLANK
CBINDClass:
/* --------------------------------------------------------------------- */
/* CLASS=CBIND                                                           */
/* OS/390 WebSphere PROFILES                                             */
/* --------------------------------------------------------------------- */
/*  CLASS  = CBIND                                                       */
/* PROFILE = CB.BIND.<cluster name>                                      */
/*  (CB.BIND.CLUSTER)                                                    */
/* Used for: determining if a client can "BIND" (access) a controller    */
/*           region.                                                     */
/* Notes:                                                                */
/* 1. Any userid can gain access to the controller region if it has READ */
/*    access to the CB.BIND.cluster_name profile.                        */
/* 2. A userid can still gain access to the Controller Region if the     */
/*    session owner has control access.                                  */
/* 3. Within a local session (or SSL client certificate session)         */
/*    the session owner is the userid of the client or controller        */
/*    region (if server-as-client) that issued the message.              */
/*    Otherwise, ownership is assigned to the first userid which         */
/*    has successfully accessed the controller region.                   */
/* --------------------------------------------------------------------- */
)BLANK
/* Delete CBIND CB.BIND.daemon and PERMIT. @MD16547D*/
)BLANK
call PutComment('Defining the CBIND class. ')
call PutComment('Used for: determining if a client can "BIND" (access) a controller region. ')
CMD = "RDEFINE CBIND CB.BIND." || domain_prefix ,               /*@WS15621C*/
      || "**" ||           ,                                    /*@WS15621C*/
      " UACC(READ)"
call ProcessCmd CMD
)BLANK
call PutComment('Granting the WAS configuration group CONTROL access to the CBIND class. ')
CMD = "PERMIT CB.BIND." || domain_prefix ,                      /*@WS15621C*/
      || "**" ||      ,                                         /*@WS15621C*/
      " CLASS(CBIND) ID(" || default_WS_CFG_group || ") ACCESS(CONTROL) "
call ProcessCmd CMD
)BLANK
/* ---------------------------------------------------------------- */
/* ACCESS TO J2EE Applications                                      */
/* ---------------------------------------------------------------- */
/* CLASS  = CBIND                                                   */
/* PROFILE = CB.<CLUSTER NAME>                                      */
/* Used for: Determining if a client can use J2EE applications in a */
/*           server.                                                */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Defining CBIND CB.cluster access for ' || ,
    'WAS systems servers. ')
call PutComment('Used for: Determining if a client can use J2EE applications in a server. ')
)BLANK
/* Delete CBIND CB.daemon @MD16547D*/
)BLANK
CMD = "RDEFINE CBIND CB." || domain_prefix  ,              /*@WS15621C*/
      || "**" || ,                                         /*@WS15621C*/
      " UACC(READ)"
call ProcessCmd CMD
)BLANK
)BLANK
)BLANK
call PutComment('Refreshing the CBIND class. ')
CMD = "SETROPTS RACLIST(CBIND) GENERIC(CBIND) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
ServerClass:
/* ---------------------------------------------------------------- */
/* CLASS = SERVER                                                   */
/* PROFILE = CB.<cluster>.<generic server>                          */
/* Used for: determining if a servant region can initialize         */
/* ---------------------------------------------------------------- */
call PutComment('Defining SERVER CB.cluster.generic_server. ')  /* @MD16761C*/
call PutComment('Used for: Determining if a servant region can initialize. ')
)BLANK
)BLANK
CMD = "RDEFINE SERVER CB.*   UACC(NONE)"                        /* @WS15621A*/
call ProcessCmd CMD
)BLANK
/* Delete RDEFINE SERVER.CB.daemon @MD16547D*/
)BLANK
/* ---------------------------------------------------------------- */
CMD = "RDEFINE SERVER CB.*." || default_dmgr_cluster_name || '.*' || , /* @MD17040A*/
   " UACC(NONE) "                                                   /* @MD17040A*/
call ProcessCmd CMD                                                 /* @MD17040A*/
)BLANK
)BLANK
/* ---------------------------------------------------------------- */
/* Now permit the corresponding server ids to the above profiles.   */
/* ---------------------------------------------------------------- */
call PutComment('Permitting SERVER class access. ')
)BLANK
CMD = "PERMIT CB.*." || default_dmgr_cluster_name || '.*' || , /* @MD17040A*/
   " CLASS(SERVER) ID(" || default_dmgr_SR_userid    || ,           /* @MD17040A*/
   ") ACC(READ)"                                                    /* @MD17040A*/
call ProcessCmd CMD                                                 /* @MD17040A*/
)BLANK
)BLANK
call PutComment('Refreshing the SERVER class. ')
CMD = "SETROPTS RACLIST(SERVER) GENERIC(SERVER) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
assignStarted:
/* ---------------------------------------------------------------- */
/* Create STARTED task profiles for each runtime server identity    */
/* Define User Identities for the runtime addresses/tasks           */
/* ---------------------------------------------------------------- */
call PutComment('Assigning Daemon and Deployment Manager controller and servant userids to started tasks. ') /* @MD16761A*/
)BLANK
CMD = "RDEFINE STARTED " || default_dm_daemon_CR_proc_name || , /*@MD16761C*/
   ".* STDATA(USER(" || default_dm_daemon_CR_userid || ,
   ") GROUP(" || default_WS_CFG_group || ,
   ") TRACE(YES))"                                        /* @MD16604C*/
call ProcessCmd CMD
/* ---------------------------------------------------------------- */
CMD = "RDEFINE STARTED " || default_dmgr_CR_proc_name || , /* @MD16761C*/
   ".* STDATA(USER(" || default_dmgr_CR_userid || ,
   ") GROUP(" || default_WS_CFG_group || ,
   ") TRACE(YES))"                                        /* @MD16604C*/
call ProcessCmd CMD
)BLANK
CMD = "RDEFINE STARTED " || default_dmgr_server_jobname_SR || ,
   ".* STDATA(USER(" || default_dmgr_SR_userid || ,       /* @MD16761C*/
   ") GROUP(" || default_WS_CFG_group || ,
   ") TRACE(YES))"                                        /* @MD16604A*/
call ProcessCmd CMD
)BLANK
call PutComment('Refreshing the STARTED class. ')
CMD = "SETROPTS RACLIST(STARTED) GENERIC(STARTED) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
)BLANK
)BLANK
setupWLM: /*@MD18997A*/
/* ---------------------------------------------------------------- */
/*  AsynchBeans for z/OS, require servants to have access to WLM    */
/*  services.  New for @MD18997A                                    */
/* ---------------------------------------------------------------- */
call PutComment('Authorize servants to use WLM Services')
CMD = "RDEFINE FACILITY (BPX.WLMSERVER) UACC(NONE)"
call ProcessCmd CMD
CMD = "PERMIT BPX.WLMSERVER ACCESS(READ) ID(" || ,
      default_WS_SR_group  || ,
      ") CL(FACILITY)"
call ProcessCmd CMD
call PutComment('Refreshing the FACILITY class. ')
CMD = "SETROPTS RACLIST(FACILITY) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN                                                 /*@MD18997A*/
)BLANK
/* ---------------------------------------------------------------- */
/* Below this point are comments for other security systems and     */
/* and access connections.  These are not needed to run the provided*/
/* IVP, but would be needed for those shops that use them.          */
/* To "activate" a section, remove the comment delimiters, make     */
/* changes, and move the section above the "exit maxrc" line above. */
/* ---------------------------------------------------------------- */
)BLANK
setupDB2:
/* ---------------------------------------------------------------- */
/* RACF set-up for IDENTITY with DB2 if DSNR is activated.          */
/*  Note that which Identity is used by DB2 depends on the          */
/*  type of server, Run-As setting for EJB, and DB2 configuration   */
/* ---------------------------------------------------------------- */
/* CLASS = DSNR                                                     */
/* PROFILE = <db2>.RRSAF                                            */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Setting up DSNR for DB2 access. ')
CMD = "RDEFINE DSNR" default_DB2_ssname || ".RRSAF UACC(NONE)"
call ProcessCmd CMD
CMD = "PERMIT" default_DB2_ssname || ".RRSAF CLASS(DSNR)" ,
    "ID(" ,
       || default_WS_SR_group || ,
    ") ACCESS(READ)"
call ProcessCmd CMD
)BLANK
call PutComment('Activating the DSNR class. ')
call ProcessCmd("SETROPTS CLASSACT(DSNR)")
call ProcessCmd("SETROPTS RACLIST(DSNR) GENERIC(DSNR)")
call ProcessCmd("SETROPTS RACLIST(DSNR) REFRESH")
)BLANK
RETURN
)BLANK
)BLANK
setupEJBRoleAccess:
/* ---------------------------------------------------------------- */
/* EJB Role Access.  Needed if SAF Authorization desired           */
/* ---------------------------------------------------------------- */
/* RACF CLASS  = EJBROLES                                           */
/* Sample Client Profile for access to installation defined methods.*/
/*                           updated for MD16971AA                    */
)BLANK
call PutComment('Setting up EJBRoles Profiles for admin roles');
call ProcessCmd("SETROPTS CLASSACT(EJBROLE)")
call PutComment('Defining roles for SAF access');
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "administrator UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "monitor       UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "configurator UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "operator     UACC(NONE)")
/*                  Start of changes for @309640A            */
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "deployer     UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || ,
       "adminsecuritymanager UACC(NONE)")
call PutComment('Setting up EJBRoles access for default admin user ID. ')
CMD = "PERMIT " || domain_prefix || "adminsecuritymanager " || ,
    "CLASS(EJBROLE) ID(" || default_WS_admin_userid || ") ACCESS(READ)"
call ProcessCmd CMD
/*                  End of changes for @309640A              */
)BLANK
call PutComment('Setting up EJBRoles access for administrator and CR');
CMD = "PERMIT " || domain_prefix ||  "administrator  CLASS(EJBROLE)  ID(" || ,
       default_WS_CFG_group || ") ACCESS(READ)"        /*@MD16594C*/
call ProcessCmd CMD
)BLANK
/*                         start of changes for    @MD16475AA */
call PutComment('Setting up EJBRoles Profiles for Naming roles');
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "CosNamingRead   UACC(READ)")
CMD = "PERMIT " || domain_prefix || "CosNamingRead  CLASS(EJBROLE)  ID(" || ,
       default_WS_unauth_userid || ") ACCESS(READ)"
call ProcessCmd CMD
/*                  Start of changes for @309640C            */
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "CosNamingWrite  UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "CosNamingCreate UACC(NONE)")
call ProcessCmd("RDEFINE EJBROLE " || domain_prefix || "CosNamingDelete UACC(NONE)")
/*                        end of changes for         @MD16475AA */
CMD = "PERMIT " || domain_prefix || "CosNamingWrite  CLASS(EJBROLE) ID(" || ,
    default_WS_CFG_group || ") ACCESS(READ)"
call ProcessCmd CMD
CMD = "PERMIT " || domain_prefix || "CosNamingCreate  CLASS(EJBROLE) ID(" || ,
    default_WS_CFG_group || ") ACCESS(READ)"
call ProcessCmd CMD
CMD = "PERMIT " || domain_prefix || "CosNamingDelete  CLASS(EJBROLE) ID(" || ,
    default_WS_CFG_group || ") ACCESS(READ)"
call ProcessCmd CMD
/*                  End of changes for @309640A              */
)BLANK
call PutComment('Refreshing the EJBROLES class. ')
call ProcessCmd("SETROPTS RACLIST(EJBROLE) REFRESH")
)BLANK
RETURN
)BLANK
setupSSL:
/* ---------------------------------------------------------------- */
/*       SSL SET-UP                                                 */
/*                                                                  */
/*       This sets up a WAS Test Certificate Authority for use for  */
/*          creating all certificates needed on both client and     */
/*          servers, for test purposes.                              */
/*       See "RACF Security Administrator's Guide" for more         */
/*       information on Digital Certicates.                         */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Define permissions to work with certificates')
call ProcessCmd("RDEFINE FACILITY IRR.DIGTCERT.LIST UACC(NONE)")
call ProcessCmd("RDEFINE FACILITY IRR.DIGTCERT.LISTRING UACC(NONE)")
)BLANK
CMD = "PERMIT IRR.DIGTCERT.LIST CLASS(FACILITY) ID(" ,
 || default_WS_CFG_group || ") ACC(READ) "
call ProcessCmd CMD
CMD = "PERMIT IRR.DIGTCERT.LISTRING CLASS(FACILITY) ID(" ,
 || default_WS_CFG_group || ") ACC(READ) "
call ProcessCmd CMD
)BLANK
if WS_generate_CA_cert = "Y"
 then do
  call PutComment('Create a Certificate Authority certificate')
  call PutComment('This will be used to sign client and server certs')
  FORMAT_DATE = WS_cert_expiration_date
  call PutComment('FORMAT_DATE IS ' || FORMAT_DATE);
  CMD = "RACDCERT CERTAUTH GENCERT SUBJECTSDN(CN('WAS CertAuth for Security Domain') " ,
        ||  " OU('"|| cell_name || "'))" ,
        ||  " WITHLABEL('" || WS_TestCA || "')  TRUST " ,
        ||  "NOTAFTER(DATE(" || FORMAT_DATE || "))"
  call ProcessCmd CMD
 end
)BLANK
call PutComment('Facility class refresh ')
call ProcessCmd( "SETROPTS RACLIST(FACILITY) REFRESH")
)BLANK
 RETURN
)BLANK
)BLANK
enableDaemon_SSL:
if (enable_daemon_ssl = "Y")
/* ---------------------------------------------------------------- */
/* Set up SSL for location service daemon                           */
/* ---------------------------------------------------------------- */
then do
 call PutComment('Creating SSL keyring for Deployment Manager daemon')
)BLANK
 CMD = "RACDCERT ADDRING(" || Dmgr_daemon_keyring || ") ID("   || ,
                         default_dm_daemon_CR_userid ")"
 call ProcessCmd CMD
)BLANK
 call PutComment('Generating certificate for Deployment Manager daemon')
)BLANK
 FORMAT_DATE = ws_cert_expiration_date
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid              || ,
       ") GENCERT SUBJECTSDN(CN('" || daemon_ipname               || ,
       "')"                                                       || ,
       " O('IBM') OU('" || cell_name || "'))"                     || ,
       " WITHLABEL('DefaultWASDmDaemonCert."                      || ,
                      cell_name || "')"                           || ,
       " SIGNWITH(CERTAUTH LABEL('"                               || ,
       WS_TestCA || "'))"                                         || ,
       " NOTAFTER(DATE(" || FORMAT_DATE || "))"
 call ProcessCmd CMD
)BLANK
 call PutComment ('Connecting certificate to the Deployment Manager daemon keyring')
)BLANK
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid              || ,
       ") CONNECT ("                                              || ,
       "LABEL('DefaultWASDmDaemonCert."                           || ,
                      cell_name || "')"                           || ,
       " RING(" || Dmgr_daemon_keyring ") DEFAULT)"
 call ProcessCmd CMD
)BLANK
 call PutComment('Connect WAS CA Certificate to Deployment Manager daemon keyring')
)BLANK
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid || ") CONNECT (RING(" ,
       || Dmgr_daemon_keyring || ") LABEL('" ,
       || WS_TestCA  ||  "') CERTAUTH)"
 call ProcessCmd CMD
)BLANK
 call PutComment('Connect Commercial CAs to Deployment Manager daemon keyring' )
)BLANK
CALabel = 'Verisign Class 3 Primary CA'
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid || ") CONNECT (RING(" ,
     ||  Dmgr_daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
     || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Verisign Class 1 Primary CA'
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid || ") CONNECT (RING(" ,
     ||  Dmgr_daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
     ||  " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'RSA Secure Server CA'
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid || ") CONNECT (RING(" ,
     ||  Dmgr_daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
     || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Thawte Server CA'
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid || ") CONNECT (RING(" ,
     ||  Dmgr_daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
     || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Thawte Premium Server CA'
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid || ") CONNECT (RING(" ,
     ||  Dmgr_daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
     || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Thawte Personal Basic CA'
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid || ") CONNECT (RING(" ,
     ||  Dmgr_daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
     || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Thawte Personal Freemail CA'
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid || ") CONNECT (RING(" ,
     ||  Dmgr_daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
     || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Thawte Personal Premium CA'
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid || ") CONNECT (RING(" ,
     ||  Dmgr_daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
     || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
)BLANK
 CALabel = 'Verisign International Svr CA'
 CMD = "RACDCERT ID(" || default_dm_daemon_CR_userid || ") CONNECT (RING(" ,
     ||  Dmgr_daemon_keyring || ") CERTAUTH label('" || CALabel || "')",
     || " USAGE(CERTAUTH))"
 call ProcessCmd CMD
 end
)BLANK
RETURN
)BLANK
)BLANK
setupSSL_ZOS:
/* ---------------------------------------------------------------- */
/*    SSL BASIC SERVER SET-UP                                       */
/* ---------------------------------------------------------------- */
/* RACF set-up for SSL for Deploy Manager         @MD16791CC        */
/*  The SSL set-up uses the RACF RACDCERT command to generate and   */
/*  maintain digital certificates in RACF, using the WebSphere Test */
/*  Certificate Authority cert created in the base install.         */
/*  There must be a unique RACF keyring and digital certificate     */
/*  public/private key pair for the identity of each server enabled */
/*  for SSL.                                                        */
/*  The certificate must be unique and owned by the server's id.    */
/*                                                                  */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Creating SSL keyrings for WebSphere Deployment Manager ')
)BLANK
CMD = "RACDCERT ADDRING(" || Dmgr_keyring || ") ID(" default_dmgr_CR_userid ")"
call ProcessCmd CMD
)BLANK
CMD = "RACDCERT ADDRING(" || Dmgr_keyring || ") ID(" default_dmgr_SR_userid ")"
call ProcessCmd CMD
)BLANK
call PutComment('Generating certificates for WebSphere Deployment Manager ')
)BLANK
FORMAT_DATE = ws_cert_expiration_date                            /*@WS15621A*/
CMD = "RACDCERT ID ("                                    || ,    /*@WS15621C*/
      default_dmgr_CR_userid || ,                                /*@WS15621C*/
      ") GENCERT SUBJECTSDN(CN('" || daemon_ipname || "')" || ,
      " O('IBM') OU('" || cell_name || "'))"             || ,    /*@WS15621C*/
      " WITHLABEL('DefaultWASDmgrCert."|| cell_name ||"')" || ,  /*@WS15621C*/
      " SIGNWITH(CERTAUTH LABEL('"                       || ,    /*@WS15621C*/
      WS_TestCA || "'))"                                 || ,    /*@WS15621C*/
      " NOTAFTER(DATE(" || FORMAT_DATE || "))"                   /*@WS15621A*/
call ProcessCmd CMD
)BLANK
call PutComment('Connecting Certificates to the Deployment Manager keyring')
)BLANK
CMD = "RACDCERT ID(" || default_dmgr_CR_userid || ") CONNECT (" ,
      || "LABEL('DefaultWASDmgrCert."|| cell_name ||"') RING(" , /*@WS15621C*/
      ||  Dmgr_keyring ") DEFAULT)"
call ProcessCmd CMD
)BLANK
call PutComment('Connect WAS CA Certificate to Deployment Manager keyring')
)BLANK
CMD = "RACDCERT ID(" ||  default_dmgr_CR_userid || ") CONNECT (RING(" ,
 || Dmgr_keyring || ") LABEL('" ,                                /*@WS15621C*/
 || WS_TestCA  ||  "') CERTAUTH)"                                /*@WS15621C*/
call ProcessCmd CMD
)BLANK
CMD = "RACDCERT ID(" ||  default_dmgr_SR_userid || ") CONNECT (RING(" ,
 || Dmgr_keyring || ") LABEL('" ,
 || WS_TestCA  ||  "') CERTAUTH)"
call ProcessCmd CMD
)BLANK
call PutComment('Connect Commercial CAs to Deployment Manager keyring') /*MD16602AA*/
)BLANK
CALabel = 'Verisign Class 3 Primary CA'
CMD = "RACDCERT ID(" ||  default_dmgr_CR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign Class 3 Primary CA'
CMD = "RACDCERT ID(" ||  default_dmgr_SR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign Class 1 Primary CA'
CMD = "RACDCERT ID(" ||  default_dmgr_CR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 ||  " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign Class 1 Primary CA'
CMD = "RACDCERT ID(" ||  default_dmgr_SR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 ||  " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'RSA Secure Server CA'
CMD = "RACDCERT ID(" ||  default_dmgr_CR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'RSA Secure Server CA'
CMD = "RACDCERT ID(" ||  default_dmgr_SR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Server CA'
CMD = "RACDCERT ID(" ||  default_dmgr_CR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Server CA'
CMD = "RACDCERT ID(" ||  default_dmgr_SR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Premium Server CA'
CMD = "RACDCERT ID(" ||  default_dmgr_CR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Premium Server CA'
CMD = "RACDCERT ID(" ||  default_dmgr_SR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Basic CA'
CMD = "RACDCERT ID(" ||  default_dmgr_CR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Basic CA'
CMD = "RACDCERT ID(" ||  default_dmgr_SR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Freemail CA'
CMD = "RACDCERT ID(" ||  default_dmgr_CR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Freemail CA'
CMD = "RACDCERT ID(" ||  default_dmgr_SR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Premium CA'
CMD = "RACDCERT ID(" ||  default_dmgr_CR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Premium CA'
CMD = "RACDCERT ID(" ||  default_dmgr_SR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign International Svr CA'
CMD = "RACDCERT ID(" ||  default_dmgr_CR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"                               /*MD16791CC end */
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign International Svr CA'
CMD = "RACDCERT ID(" ||  default_dmgr_SR_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"                               /*MD16791CC end */
call ProcessCmd CMD
)BLANK
/*                                                  Start 354119 */
call PutComment('Creating SSL keyrings for WebSphere administrator ')
)BLANK
CMD = "RACDCERT ADDRING(" || Dmgr_keyring || ") ID(" default_WS_admin_userid ")"
call ProcessCmd CMD
)BLANK
call PutComment('Connect WAS CA Certificates to Servers keyring')
)BLANK
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") LABEL('" || WS_TestCA  ||"') CERTAUTH)"
call ProcessCmd CMD
)BLANK
call PutComment('Connect Commercial CAs to Servers keyring') /* MD16971AA*/
)BLANK
CALabel = 'Verisign Class 3 Primary CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign Class 1 Primary CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 ||  " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'RSA Secure Server CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Server CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Premium Server CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Basic CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Freemail CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Thawte Personal Premium CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"
call ProcessCmd CMD
)BLANK
CALabel = 'Verisign International Svr CA'
CMD = "RACDCERT ID(" ||  default_WS_admin_userid || ") CONNECT (RING(" ,
 ||  Dmgr_keyring || ") CERTAUTH label('" || CALabel || "')",
 || " USAGE(CERTAUTH))"                               /*MD16971AA end */
call ProcessCmd CMD
/*                                                   End   354119 */
)BLANK
return
)BLANK
)BLANK
clientSSL:
/* ---------------------------------------------------------------- */
/*         SSL BASIC CLIENT SET-UP                                  */
/* ---------------------------------------------------------------- */
/*  Each z/OS client using SSL security must have a unique RACF     */
/*  keyring. The Certificate Authority's public certificate for     */
/*  all server's it connects to using SSL must be connected         */
/*  to the client's keyring.                                        */
/*  In this example, there is one Cert Authority used by all        */
/*  WebSphere servers.                                              */
/*  NOTES: 1. This step is required for WAS z/os client access to   */
/*            ALL SSL based mechanisms,including:                   */
/*             SSL Basic Auth,                                      */
/*             Kerberos over SSL,                                   */
/*             SSL Client Certificates                              */
/*        2.  The keyring names here must match the SSL_KEYRING=    */
/*            client environment variable value.                    */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Facility class refresh ')
call ProcessCmd( "SETROPTS RACLIST(FACILITY) REFRESH")
)BLANK
RETURN
)BLANK
)BLANK
ServerSSLforClientCerts:
/* ---------------------------------------------------------------- */
/*    SSL CLIENT CERTIFICATES SERVER SET-UP                         */
/* ---------------------------------------------------------------- */
/* Additional RACF set-up for SSL for Servers supporting            */
/*   Client Certificates                                            */
/* - connect the CA certificates for used to generate client        */
/*   certificates into the servers' keyring.                        */
/*                                                                  */
/* - Provide a mapping from SubjectDN or IssuerDN to RACF userid    */
/* ---------------------------------------------------------------- */
call PutComment('Activate Digital Certificate Mapping class ')
)BLANK
CMD = "SETROPTS CLASSACT(DIGTNMAP) RACLIST(DIGTNMAP)"
call ProcessCmd CMD
)BLANK
call PutComment('Refresh RACF FACILITY and DIGTNMAP classes ')
CMD = "SETROPTS RACLIST(FACILITY) REFRESH"
call ProcessCmd CMD
)BLANK
CMD = "SETROPTS RACLIST(DIGTNMAP) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
setupSpecialFacilities_ZOS:
/* ---------------------------------------------------------------- */
/* For out-of-the-box security                                      */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('Creating Sync-to-thread profile ')
call PutComment('Used for: Enabling Sync-to-thread. ')
call PutComment('Controller region user ID needs READ or CONTROL access to enable Sync-to-thread. ')
call PutComment('With READ access, only security environments representing users in the SURROGATE class are allowed, while CONTROL allows for security environments to represent any user. ')
)BLANK
CMD = "RDEFINE FACILITY BBO.SYNC." || cell_name || ".** UACC(NONE)"
call ProcessCmd CMD
)BLANK
call PutComment('Creating EnableTrustedApplications profile ')
call PutComment('Used for: Allowing applications to perform operations normally reserved for privileged users. ')
)BLANK
CMD = "RDEFINE FACILITY BBO.TRUSTEDAPPS." || cell_name || ".**" || ,
                        " UACC(NONE)"
call ProcessCmd CMD
)BLANK
call PutComment('Permit default WAS Configuration group to EnableTrustedApplications profile. ')
CMD = "PERMIT BBO.TRUSTEDAPPS." || cell_name || ".** " || ,
      "CLASS(FACILITY) ID("default_WS_CFG_group") ACCESS(READ)"
call ProcessCmd CMD
)BLANK
call PutComment('Activate and refresh FACILITY class. ')
CMD = "SETROPTS CLASSACT(FACILITY) GENERIC(FACILITY)"
call ProcessCmd CMD
)BLANK
CMD = "SETROPTS RACLIST(FACILITY) REFRESH"
call ProcessCmd CMD
)BLANK
)BLANK
 RETURN
)BLANK
ClientSSLforClientCerts:
/* ---------------------------------------------------------------- */
/*    SSL CLIENT CERTIFICATES CLIENT SET-UP                         */
/* ---------------------------------------------------------------- */
/* Additional RACF set-up for SSL for Clients supporting            */
/*   Client Certificates                                            */
/* - create personal certificates for clients using our Test CA and */
/*   connect these certificates into the clients' keyrings          */
/*                                                                  */
/*------------------------------------------------------------------*/
)BLANK
call PutComment('FACILITY class refresh ')
CMD = "SETROPTS RACLIST(FACILITY) REFRESH"
call ProcessCmd CMD
)BLANK
RETURN
)BLANK
)BLANK
permit4IMSPAA:
/* ---------------------------------------------------------------- */
/*      IMS OTMA PAA Usage                                          */
/*                                                                  */
/* ---------------------------------------------------------------- */
/*                                                                  */
/* Example access authorizations.                                   */
/*                                                                  */
/* ---------------------------------------------------------------- */
/* 1. If you need to do authorization setup for IMS OTMA PAA        */
/*    usage, uncomment and issue the following command to indicate  */
/*    this type of processing is being done by the clist.           */
/*                                                                  */
/* 2. To control the users that are allowed to use the IMS OTMA     */
/*    callable interface, uncomment the following two commands      */
/*    to define the profile, IMSXCF.OTMACI, in the RACF FACILITY    */
/*    class (only do once):                                         */
/*                                                                  */
/* "RDEF FACILITY IMSXCF.OTMACI UACC(NONE)"                         */
/* "SETROPTS RACLIST(FACILITY) REFRESH"                             */
/*                                                                  */
/* 3. In all cases where a server is defined with a container that  */
/*    has an IMS OTMA PAA LRM defined to it, authorize the userid   */
/*    associated with the corresponding server region to use the    */
/*    OTMA callable interface (i.e., the userid under which the     */
/*    the server region is started). To do so, uncomment and        */
/*    and replicate the following command once for each userid      */
/*    that needs to be permitted to use the OTMA callable           */
/*    interface. Replace xxxxx with the server region userid that   */
/*    needs to be authorized.                                       */
/*                                                                  */
/* "PERMIT IMSXCF.OTMACI CLASS(FACILITY) ID(xxxxxx) ACCESS(READ)"   */
/*                                                                  */
/* ---------------------------------------------------------------- */
)BLANK
call PutComment('FACILITY class refresh ')
call ProcessCmd( "SETROPTS RACLIST(FACILITY) REFRESH")
)BLANK
RETURN
)BLANK
)BLANK
permit4CICSPAA:
/* ---------------------------------------------------------------- */
/*      CICS EXCI PAA Usage                                         */
/*                                                                  */
/* ---------------------------------------------------------------- */
/*                                                                  */
/* Example access authorizations.                                   */
/*                                                                  */
/* ---------------------------------------------------------------- */
/* If you run your CICS with SURROGCHK=YES, you'll need to do       */
/* the following authorization setup to use the CICS EXCI PAA       */
/* support:                                                         */
/*                                                                  */
/* 1. Uncomment and issue the following command to indicate         */
/*    CICS EXCI setup processing is being done by the clist.        */
/*                                                                  */
/* say 'Setup for CICS EXCI PAA usage '                             */
/*                                                                  */
/* 2. Uncomment the following two commands to setup a SURROGAT      */
/*    class profile that can be used to permit a WebSphere/390 Server */
/*    to be a surrogate for all users of the CICS EXCI interface.   */
/*                                                                  */
/* "RDEF SURROGAT *.DFHEXCI UACC(NONE)"                             */
/* "SETROPTS RACLIST(SURROGAT) REFRESH"                             */
/*                                                                  */
/* 3. In all cases where a server is defined with a container that  */
/*    has a CICS EXCI PAA LRM defined to it, authorize the userid   */
/*    associated with the corresponding servant region (i.e., the   */
/*    userid under which the servant region is started) to be a     */
/*    surrogate for users of the EXCI interface. To do so,          */
/*    uncomment and replicate the following command once for each   */
/*    userid that needs to be permitted to be a surrogate. Replace  */
/*    xxxxx with the servant region userid that needs to be         */
/*    authorized.                                                   */
/*                                                                  */
/* "PERMIT *.DFHEXCI CLASS(SURROGAT) ID(xxxxxx) ACCESS(READ)"       */
/*                                                                  */
/* ---------------------------------------------------------------- */
)BLANK
RETURN
)BLANK
)BLANK
/* ---------------------------------------------------------------- */
/* PermitAPPLclass function                                @MD16761A*/
/* ---------------------------------------------------------------- */
/* Sets permissions for CLASS(APPL)                        @MD16761A*/
/* PERMIT CBS390 CLASS(APPL) ID(all userids) ACCESS(READ)  @MD16761A*/
/* ---------------------------------------------------------------- */
PermitAPPLclass:
call PutComment('APPL class setup.')
call PutComment('Used for: Used to control client access to a WebSphere Application Server for z/OS cell or group of cells.')
CMD = "RDEFINE APPL " || application_id || " UACC(NONE)" /*@WS15621C*/
call ProcessCmd CMD                                      /*@MD16761A*/
 
call PutComment('Permitting READ access to APPL class for the default WS configuration group and the default WS unauthenticated userid.')
CMD = "PERMIT" application_id "CLASS(APPL) ID(" || ,
       default_WS_CFG_group || ") ACCESS(READ)"
call ProcessCmd CMD
 
CMD = "PERMIT" application_id "CLASS(APPL) ID(" || ,
       default_WS_unauth_userid || ") ACCESS(READ)"
call ProcessCmd CMD
)BLANK
CMD = "SETROPTS RACLIST(APPL) REFRESH"
call ProcessCmd CMD
)BLANK
return
)BLANK
)BLANK
/* ---------------------------------------------------------------- */
/*                   cv2lower function                              */
/* ---------------------------------------------------------------- */
/* converts upper case to lower case letters                        */
/* ---------------------------------------------------------------- */
)BLANK
 cv2lower: procedure expose kerbId
    upper = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
    lower = 'abcdefghijklmnopqrstuvwxyz'
    parse ARG racfId
)BLANK
    kerbId = TRANSLATE(racfId, lower, upper)
    return
)BLANK
/* ---------------------------------------------------------------- */
/*                   ProcessCmd Routine                             */
/* ---------------------------------------------------------------- */
/* ProcessCmd either executes the command, or writes it out into   */
/*        a file that is 80 characters in width.                   */
/* ---------------------------------------------------------------- */
ProcessCmd: procedure expose maxrc switch
  parse arg command
  linelen = 68                                         /* @MD16362A*/
  if switch = 'issuecmds' then do
     ADDRESS TSO command
     rrc =rc
     if rrc > maxrc  then
        maxrc  = rrc
     end
   else do
      start=1
      do while (start <= LENGTH(command))
      if  LENGTH(SUBSTR(command,start)) <= linelen then  /* @MD16362C*/
         QUEUE  '"' || Substr(command,start) || '"'      /* @MD16362C*/
      else
         QUEUE  '"' || Substr(command,start,linelen) || '" || ,' /* @MD16362C*/
      EXECIO 1 DISKW RACFCMDS
      start = start + linelen                            /* @MD16362C*/
      end
      QUEUE 'say'        /* blank line after each cmd */ /* @MD17166A*/
       EXECIO 1 DISKW RACFCMDS                           /* @MD17166A*/
      QUEUE ' '          /* blank line after each cmd */ /* @MD17166A*/
       EXECIO 1 DISKW RACFCMDS                           /* @MD17166A*/
    end
  return
/* ---------------------------------------------------------------- */
/*                   PutComment Routine                             */
/* ---------------------------------------------------------------- */
/* PutComment displays a comment.  If executing the command it      */
/*        is out in SYSTSPRT, otherwise it is dispersed into the    */
/*        command file.                                             */
/* ---------------------------------------------------------------- */
PutComment: procedure expose switch
  parse arg comment
  linelen = 68                                         /* @MD16362A*/
  if switch = 'issuecmds' then do;
     say comment
     end;
  else do;
     start=1
     do while (start <= LENGTH(comment))
       QUEUE  "say '"  || Substr(comment,start,linelen) || "'"
       EXECIO 1 DISKW RACFCMDS
       start =start+linelen                            /* @MD16362C*/
     end;
  end;
  return
/* ---------------------------------------------------------------- */
/*                   PutLine Routine                             */
/* ---------------------------------------------------------------- */
/* PutComment displays a comment w/o say.  If executing the command */
/*        it is out in SYSTSPRT, otherwise it is dispersed into the */
/*        command file.                                             */
/* ---------------------------------------------------------------- */
PutLine: procedure expose switch
  parse arg comment
  if switch = 'issuecmds' then do;
     say comment
     end;
  else do;
       QUEUE  comment
       EXECIO 1 DISKW RACFCMDS
  end;
return
