Adding to what Peter said...if you need to configure the IBM HTTP Server to
execute that CGI under a specific RACF/ACF2 id you can specify security
directives to handle it.
This example forces our form-mailer CGI script to run under the SC40UNIX id
and doesn't require any user authentication:
Protection Anybody-SC40UNIX {
ServerId Web-Server-Administration
AuthType Basic
Mask anybody@(*)
}
Protect /default/cgi-bin/form-mailer Anybody-SC40UNIX SC40UNIX
And this example requires the user to authentication with their ACF2 id
(RACF should work as well) and then run our whoami CGI script user that
person's private userid:
Protection Generic-TSO {
UserId %%CLIENT%%
ServerId "Generic TSO Authentication"
AuthType Basic
PasswdFile %%SAF%%
Mask All
}
protect /default/cgi-bin/whoami Generic-TSO %%CLIENT%%
We haven't used Perl to make system calls like you need to but if you run
into an authentication issue running LISTCAT or opening the underlying
catalogs/datasets you might need to code a protect directive like above.
Brad Van Duser
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Thursday, January 15, 2004 4:08 PM
To: Cooper, Vickie
Cc: [EMAIL PROTECTED]
Subject: Re: System commands
"Cooper, Vickie" <[EMAIL PROTECTED]> wrote on 01/08/2004 07:45:15
PM:
> Is there a way to run a system command in a cgi script to issue a
> listcat?
It probably depends on the access restrictions placed
on the user who runs the cgi script. Most Unix based
web servers run the httpd daemon as a restricted user
such as "nobody" so as to expressly prevent unauthorized
access to system data or resources.
It has been a while since I logged in to OE running WebSphere or the like
but you might need to know who runs it. The shell command:
ps -ef
may be able to help you track it down.
> If I run this perl script...it works:
> $aaa=`tso "listc level('myuserid')"`;
> print "aaa: $aaa";
>
> This comes back with aaa: and all of my datasets.
>
> But, if I now run it as a cgi, it doesn't:
> print <<END_OF_TEXT;
> Content-type: text/html
>
> <HTML>
> <BODY>
> </CENTER>
> END_OF_TEXT
>
> $aaa=`tso "listc level('myuserid')"`;
> print "aaa: $aaa";
> print <<END_OF_TEXT;
> </BODY>
> </HTML>
> END_OF_TEXT
>
> This comes back with aaa: and nothing after it.
The nobody (or equivalent) user may not be allowed to
access your data set catalog. That may be done on purpose.
You might need to review security considerations with
you administrators. Once those are addressed you may need
to be careful about full high level qualifier specifications too.
Peter Prymmer
