# SailPoint RACF (Read-only) Connector Documentation

> Mainframe IBM RACF (Read-only) Connector Documentation

# Documentation

# Connecting SailPoint and RACF (Read-Only)

To connect SailPoint with RACF, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Configure**.
5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
8. Under **Connection Type**, select **Direct Connection** or **Flat File**.

   - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
   - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.
9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source.
10. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
6. (Optional) Select **Create Manual Work Items** to allow the connector to create manual work items for certain operations. You can also enable this option so the source supports additional source management features such as creating accounts and access profile management.

   > **Important**
   >
   > Once you enable this feature, you cannot disable it.

   For more information on manual work items in SailPoint, refer to [Work Items](<https://developer.sailpoint.com/docs/api/work-items>). For more information on SailPoint features, refer to [SailPoint Identity Services](<https://documentation.sailpoint.com/saas/help/index.html>).
7. Select **Save**.

## Additional Settings

> [!NOTE]
>
> **Screenshot**
>
> [![Additional Settings](<https://documentation.sailpoint.com/connectors/mainframe/racf_read_only/va/help/img/racf_s_add.png>)](<https://documentation.sailpoint.com/connectors/mainframe/racf_read_only/va/help/img/racf_s_add.png>)

1. Specify the **File Encoding** to be used by the connector. Valid values for this attribute can be found at [Character Sets](<https://www.iana.org/assignments/character-sets/character-sets.xhtml>) on the Internet Assigned Numbers Authority (IANA) website. If this field is empty, the default encoding (the value of file.encoding specified by the jvm) is used.
2. Enter the **Filter String** to exclude matching strings from the dataset.
3. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Integrating SailPoint with RACF (Read-Only)

Connecting SailPoint to your RACF (Read-Only) source allows you to aggregate Accounts and Groups data from a file. The integration supports file exported by RACF database unload utility (IRRDBU00).

## Supported Features

This connector supports the following features:

### Account Management

- Manages RACF users as Accounts
- Aggregation

### Account - Group Management

- Manages RACF groups as Account-Groups
- Aggregation

### Permission Management

- Application reads permissions directly assigned to accounts and groups as direct permissions during account and group aggregation.
- The connector does not support automated revocation of the aggregated permissions and creates work item for such requests.

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The RACF (Read-Only) connector uses the following default correlation and object configurations.

> [!NOTE]
>
> This connector currently supports two types of objects, account and group.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account Attributes

The RACF (Read-Only) connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Account objects are used when building identities Link objects.

#### CLASSES

| Attribute Name | Description |
| --- | --- |
| CATEGORIES | Defines the categories associated with a general resource. There is one record per general resource/category combination. |
| KERB\_NAME | RACF user name as taken from the profile. |
| KERB\_MAXLIFE | Maximum ticket life. |
| KERB\_KEY\_VER | Current key version. |
| KERB\_ENCRYPT\_DES | Is key encryption using DES enabled? |
| KERB\_ENCRYPT\_DES3 | Is key encryption using DES3 enabled? |
| KERB\_ENCRYPT\_DESD | Is key encryption using DES with derivation enabled? |
| KERB\_ENCRYPT\_A128 | Is key encryption using AES128 enabled? |
| KERB\_ENCRYPT\_A256 | Is key encryption using AES256 enabled? |
| KERB\_KEY\_FROM | Key source. Valid values are PASSWORD or PHRASE. |
| NAME | User ID as taken from the profile name. |
| CREATE\_DATE | The date that the profile was created. |
| OWNER\_ID | The user ID or group name that owns the profile. |
| ADSP | Does the user have the ADSP attribute? |
| SPECIAL | Does the user have the SPECIAL attribute? |
| OPER | Does the user have the OPERATIONS attribute? |
| REVOKE | Is the user REVOKEd? |
| GRPACC | Does the user have the GRPACC attribute? |
| PWD\_INTERVAL | The number of days that the user’s password can be used. |
| PWD\_DATE | The date that the password was last changed. |
| PROGRAMMER | The name associated with the user ID. |
| DEFGRP\_ID | The default group associated with the user. |
| LASTJOB\_TIME | The time that the user last entered the system. |
| LASTJOB\_DATE | The date that the user last entered the system. |
| INSTALL\_DATA | Installation-defined data. |
| UAUDIT | Do all RACHECK and RACDEF SVCs cause logging? |
| AUDITOR | Specifies if the user has the auditor attribute. |
| NOPWD | `YES` - indicates that this user ID can logon without a password using OID card. `NO` - indicates that this user must specify a password. `PRO` - indicates a protected user ID. `PHR` - indicates that the user has a password phrase. |
| OIDCARD | Specifies if this user has the OIDCARD data. |
| PWD\_GEN | The current password generation number. |
| REVOKE\_CNT | The number of unsuccessful logon attempts. |
| MODEL | The data set model profile name. |
| SECLEVEL | The user’s security level. |
| REVOKE\_DATE | The date that the user will be revoked. |
| RESUME\_DATE | The date that the user will be resumed. |
| ACCESS\_SUN | Can the user access the system on Sunday? |
| ACCESS\_MON | Can the user access the system on Monday? |
| ACCESS\_TUE | Can the user access the system on Tuesday? |
| ACCESS\_WED | Can the user access the system on Wednesday? |
| ACCESS\_THU | Can the user access the system on Thursday? |
| ACCESS\_FRI | Can the user access the system on Friday? |
| ACCESS\_SAT | Can the user access the system on Saturday? |
| START\_TIME | After what time can the user logon? |
| END\_TIME | After what time can the user not logon? |
| SEC\_LABELS | The user’s default security label. |
| ATTRIBS | Other user attributes (RSTD for users with RESTRICTED attribute). |
| PWDENV\_EXISTS | Has a PKCS\#7 envelope been created for the user’s current password? |
| PWD\_ASIS | Should the password be evaluated in the case entered? |
| PHR\_DATE | The date the password phrase was last changed. |
| PHR\_GEN | The current password phrase generation number. |
| CERT\_SEQN | Sequence number that is incremented whenever a certificate for the user is added, deleted, or altered. |
| PPHENV\_EXISTS | Has the user's current password phrase been PKCS\#7 enveloped for possible retrieval? |
| ASSOCIATED\_MAPPING | Defines the certificate name filter in the DIGTNMAP class associated with this user ID. |
| CSDATA\_CUSTOM | Record type of the User CICS Data record |
| LNOTES\_SHORTNAME | User ID as taken from the profile name. |
| CICS\_OP\_CLASSES | The class associated with the CICS operator. |

#### GROUPS

| Attribute Name | Description |
| --- | --- |
| OVM\_UID | User identifier (UID) associated with the user name from the profile. |
| OVM\_HOME\_PATH | Home path associated with the user identifier (UID). |
| OVM\_PROGRAM | Default program associated with the user identifier (UID). |
| OVM\_FSROOT | File system root for this user. |
| PRIMARY\_LANGUAGE | The primary language for the user. |
| SECONDARY\_LANGUAGE | The secondary language for the user. |
| CICS\_RSL\_KEY | Defines the resource security level (RSL) keys associated with a CICS user. There is one record per combination of user and CICS RSL key. |
| LDAP\_HOST | LDAP server URL. |
| LDAP\_BIND\_DN | LDAP BIND distinguished name. |
| NETVIEW\_IC | Command list processed at logon. |
| NETVIEW\_CONSOLE\_NAME | Default console name. |
| NETVIEW\_CTL | CTL value: GENERAL, GLOBAL, or SPECIFIC. |
| NETVIEW\_MSGRECVR | Eligible to receive unsolicited messages? |
| NETVIEW\_NGMFADMN | Authorized to NetView graphic monitoring facility? |
| NETVIEW\_NGMFVSPN | Value of view span options. |
| NDS\_UNAME | NDS user name associated with the user ID. |
| CICS\_OPIDENT | The CICS operator identifier. |
| CICS\_OPPRTY | The CICS operator priority. |
| CICS\_NOFORCE | Is the extended recovery facility (XRF) NOFORCE option in effect? |
| CICS\_TIMEOUT | The terminal time-out value. Expressed in hh:mm. |
| DCE\_UUID | DCE UUID associated with the user name from the profile. |
| DCE\_NAME | DCE principal name associated with this user. |
| DCE\_HOMECELL | Home cell name. |
| DCE\_HOMEUUID | Home cell UUID. |
| DCE\_AUTOLOGIN | Is this user eligible for an automatic DCE login? |
| CERTIFICATE | Defines the names of the certificate profiles in the DIGTCERT class that are associated with this user ID. |
| CICS\_TSL\_KEY | Defines the transaction security level (TSL) keys for a CICS user. There is one record per combination of user and CICS TSL key. |
| TSO\_ACCOUNT\_NAME | User ID as taken from the profile name. |
| TSO\_COMMAND | The command issued at LOGON. |
| TSO\_DEST | The default destination identifier. |
| TSO\_HOLD\_CLASS | The default hold class. |
| TSO\_JOB\_CLASS | The default job class. |
| TSO\_LOGIN\_PROC | The default logon procedure. |
| TSO\_LOGIN\_SIZE | The default logon region size. |
| TSO\_MSG\_CLASS | The default message class. |
| TSO\_LOGON\_MAX | The maximum logon region size. |
| TSO\_PERF\_GROUP | The performance group associated with the user. |
| TSO\_SYSOUT\_CLASS | The default sysout class. |
| TSO\_USER\_DATA | The TSO user data, in hexadecimal in the form `X<cccc>`. |
| TSO\_UNIT\_NAME | The default SYSDA device. |
| TSO\_SECLABEL | The default logon security label. |
| DFP\_DATA\_RECORDS | Defines the information required by the System Managed Storage facility of the Data Facility Product (DFP). |
| AREA\_NAME | Area for delivery for the user. |
| BUILDING | Building for delivery. |
| DEPARTMENT | Department for delivery. |
| ROOM | Room for delivery. |
| ADDRESS1 | Address line 1 |
| ADDRESS2 | Address line 2 |
| ADDRESS3 | Address line 3 |
| ADDRESS4 | Address line 4 |
| ACCOUNT\_NUMBER | User account number for delivery. |
| MVS\_UID | z/OS UNIX user identifier (UID) associated with the user name from the profile. |
| MVS\_HOME\_PATH | HOME PATH associated with the z/OS UNIX user identifier (UID). |
| MVS\_PROGRAM | Default Program associated with the z/OS UNIX user identifier (UID). |
| MVS\_MAX\_CPUTIME | Maximum CPU time associated with the UID. |
| MVS\_MAX\_ASSSIZE | Maximum address space size associated with the UID. |
| MVS\_MAX\_FILEPROC | Maximum active or open files associated with the UID. |
| MVS\_MAX\_PROC | Maximum number of processes associated with the UID. |
| MVS\_MAX\_THREADS | Maximum number of threads associated with the UID. |
| MVS\_MAX\_MAP\_STORAGE | Maximum mappable storage amount associated with the UID. |
| MVS\_MEM\_LIMIT | Maximum size of non-shared memory. |
| MVS\_SHMEM\_LIMIT | Maximum size of shared memory. |
| NETVIEW\_OPCLASS | OPCLASS value from 1 to 2040. |
| EIM\_LDAPPROFFILE | EIM LDAPBIND profile name. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The RACF (Read-Only) connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute Name | Description |
| --- | --- |
| SUBGROUPNAME | The name of a subgroup within the group. |
| MVS\_GID | OMVS z/OS UNIX group identifier (GID) associated with the group name from the profile. |
| CSDATA\_CUSTOM | Defines the custom fields associated with a group. There is one record per combination of group and CSDATA custom fields. |
| MEMBERS | A user ID within the group. |
| NAME | Group name as taken from the profile name. |
| SUPERIOR\_GROUP | Name of the superior group to this group. |
| CREATE\_DATE | Date that the group was defined. |
| OWNER\_ID | The user ID or group name which owns the profile. |
| UACC | The default universal access. Valid values are NONE for all groups other than the IBM-defined VSAMDSET group which has CREATE. |
| NOTERMUACC | Indicates if the group must be specifically authorized to use a particular terminal through the use of the PERMIT command. |
| INSTALL\_DATA | Installation-defined data. |
| GROUP\_MODEL | Data set profile that is used as a model for this group. |
| UNIVERSAL | Indicates if the group has the UNIVERSAL attribute. |
| OVM\_GID | OMVS z/OS UNIX group identifier (GID) associated with the group name from the profile. |
| TME\_ROLE | Role profile name. |