On Tue, 25 Jun 2024 at 12:38, [email protected] < [email protected]> wrote:
Is there a way for an administrator to change the TSO PREFIX of another > RACF userid? > There is no IBM-supplied RACF command to do this. But of course since the info is in the RACF database, it's quite possible to write a command to make the change. If you are confident dealing with RACF database fields and building and installing assembler programs, I'd suggest looking at https://www.cbttape.org/xephon/xephonr/rac0205.pdf which contains a detailed description and source code for a generalized command line (and CLIST/REXX variable) interface to RACF fields. But this is not for the faint of heart, and might well not pass muster in a production environment. Reason for asking:When a new TSO userid is created, we need to set its TSO > PREFIX to a value different from "USERID" (the default). Basically, as we > generally dont allow USER datasets, we need to set the TSO PREFIX of any > TSO userid to their "default group". In order to achieve this, just after > running the ADDUSER RACF command, the administrator enters TSO for the > first time using the just-created userid credentials and runs the "PROF > PREFIX(aaaa)" command. Not a very clean solution, indeed... > Also not clean because the administrator will know the user's password, and the user won't be prompted to change it at first logon unless the admin also issues an ALU EXPIRE (from an admin userid) after updating the prefix. How about a "run once" CLIST, invoked from the PARM= in the logon proc? Perhaps you already have a general thing like this along the lines of CMS's PROFILE EXEC that runs for all users? It could check that the prefix is right, and fix it if not. This way it's the real user making the change rather than the administrator. Tony H. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
