# SailPoint Mainframe Top Secret (Read-only) Connector Documentation

> Mainframe Top Secret (Read-only) Connector Documentation

# Documentation

# Connecting SailPoint with Top Secret (Read-only)

To connect SailPoint with Top Secret, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Configure**.
5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
8. Under **Connection Type**, select **Direct Connection** or **Flat File**.

   - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
   - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.
9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source.
10. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
6. (Optional) Select **Create Manual Work Items** to allow the connector to create manual work items for certain operations. You can also enable this option so the source supports additional source management features such as creating accounts and access profile management.

   > **Important**
   >
   > Once you enable this feature, you cannot disable it.

   For more information on manual work items in SailPoint, refer to [Work Items](<https://developer.sailpoint.com/docs/api/work-items>). For more information on SailPoint features, refer to [SailPoint Identity Services](<https://documentation.sailpoint.com/saas/help/index.html>).
7. Select **Save**.

## Uploading the Top Secret File

Upload the file generated by the `TSSCFILE` utility, and make sure it has a .csv extension. Drag and drop the .csv file or select **Upload Files** from your computer.

The following examples illustrate TSSCFILE export commands:

| Command | Purpose |
| --- | --- |
| `TSS LIST(STC) DATA(ALL)` | Displays the STC record, including procedure names mapped to ACIDs and STC-related attributes. |
| `TSS LIST(ACIDS) TYPE(USER) DATA(ALL)` | Display a complete view of user ACIDs including name, type, facilities, department/division/zone, and other attributes. |
| `TSS LIST(ACIDS) TYPE(SCA) DATA(ALL)` | Display detailed Security Control ACID information, including global scope and specific administrative authorities. For example ACID, DATA, RESOURCE, FACILITY, MISC1-MISC9, SCOPE |
| `TSS LIST(ACIDS) TYPE(ZCA) DATA(ALL)` | Lists Zone Control ACIDs, including administrators for specific zones and their authority to manage the divisions and departments within each zone. |
| `TSS LIST(ACIDS) TYPE(VCA) DATA(ALL)` | Lists Division Control ACIDs, including administrators for divisions and their authority to create or delete departments and manage resources within each division. |
| `TSS LIST(ACIDS) TYPE(DCA) DATA(ALL)` | Lists Department Control ACIDs, including department-level administrators and their authority to manage users and profiles within each department. |
| `TSS LIST(ACIDS) TYPE(ZONE) DATA(ALL)` | Displays Zone definitions, including creation and modification of dates and the list of divisions associated with each zone. |
| `TSS LIST(ACIDS) TYPE(DIVISION) DATA(ALL)` | Displays Division definitions, including parent zone and the list of all departments in each division. |
| `TSS LIST(ACIDS) TYPE(DEPARTMENT) DATA(ALL)` | Displays Department definitions, including the parent division and the list of users and profiles owned by each department. |
| `TSS LIST(ACIDS) TYPE(PROFILE) DATA(ALL)` | Displays profile (security template) details, including resource permission and the list of all the users associated with each profile. |
| `TSS LIST(ACIDS) TYPE(GROUP) DATA(ALL)` | Displays Group ACID definitions and the members associated with each group. |

## Additional Settings

> [!NOTE]
>
> **Screenshot**
>
> [![Additional Settings](<https://documentation.sailpoint.com/connectors/mainframe/top_secret_read_only/va/help/img/additional_settings.png>)](<https://documentation.sailpoint.com/connectors/mainframe/top_secret_read_only/va/help/img/additional_settings.png>)

1. Specify the **File Encoding** to be used by the connector. Valid values for this attribute can be found at [Character Sets](<https://www.iana.org/assignments/character-sets/character-sets.xhtml>) on the Internet Assigned Numbers Authority (IANA) website. If this field is empty, the default encoding (the value of file.encoding specified by the jvm) is used.
2. Enter the **Filter String** to exclude matching strings from the dataset.
3. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Integrating SailPoint with Top Secret (Read-only)

Connecting SailPoint to your Top Secret (Read-only) application allows you to aggregate Accounts and Groups data from a Top Secret TSSCFILE utility.

## Supported Features

This connector supports the following features:

### Account Management

- Manages Top Secret Users as Accounts
- Aggregation

### Account - Group Management

- Manages Top Secret groups as Account-Groups
- Aggregation

### Permission Management

- Source reads permissions directly assigned to accounts and groups as direct permissions during account and group aggregation.
- The connector does not support automated revocation of the aggregated permissions and creates a work item for such requests.

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Top Secret (Read-only) connector uses the following default correlation and object configurations.

> [!NOTE]
>
> This connector currently supports two types of objects, account and group.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account Attributes

The Top Secret (Read-only) connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Account objects are used when building identities Link objects.

| Attribute Name | Description |
| --- | --- |
| XAUTH | The authorized level at which the user can access the resource. |
| VMMDISK | The VM minidisks owned by the user. |
| ACTION | Specifies which action(s) CA-TopSecret will take when access to a resource is attempted. |
| LOCK TIME(MINUTES) | The time interval before unattended or inactive terminals are locked. |
| LOCK TIME FACILITY | The lock time for all terminals connected to the specified facility. |
| LANGUAGE PREFERENCE | The language preference code the user. |
| VOLSER(OWNED) | The volumes to which the user has access. |
| ATTRIBUTES | A dynamic field that either contains a list of user privileges or resource-specific settings associated with the record being displayed. |
| VOLSER(OWNED)2 | Report showing the DASD volumes that are owned by a specific ACID. |
| ATTRIBUTES2 | The ATTRIBUTE continuation records contain the rest of the miscellaneous flags and options for the ACID. |
| NAME | Identifies the ACID name. Names can be up to 32 characters in length, must be surrounded by single quotes if embedded with blanks, and can use letters, numbers, and special characters. |
| SITRAN | Specifies which CICS transaction CA-TopSecret automatically executes after an ACID successfully signs on to a facility. If a SITRAN is added to an ACID that already has a CICS transaction defined, the transaction is replaced. |
| HOME | Defines the initial directory pathname. This is the initial directory used when a user enters the OMVS command or enters the ISPF shell. The HOME keyword accepts from one to 1024 characters. Both uppercase and lowercase characters are allowed. If HOME isn't defined, OpenEdition MVS sets the initial directory for the user to the root directory. HOME is optional. |
| XA ACID | XAUTH Resource Class Name |
| MULTIPW | Used to assign or remove multiple password attributes, which means ACIDs need a different password to access each facility. |
| NOADSP | Used to prevent data sets, created by an ACID, from being automatically secured by MVS by setting the RACF bit. NOADSP is used to define an ACID that will be used to create data sets that cannot be automatically protected by CA-TopSecret. |
| AUDIT | Used to allow an audit of ACID activity. |
| NOPWCHG | To prevent ACIDs from changing passwords at either signon or initiation. |
| OIDCARD | Used to support the physical identification of users through operator identification cards. |
| TRACE | Used to activate a diagnostic trace on all ACID activity (initiations, resource access, violations, user's security mode, etc.) |
| SUSPEND | Used to prevent ACIDs from accessing the system when a violation occurs. |
| MRO | Used to support the use of the multi-region option. |
| CONSOLE | Used to grant or remove an ACID's ability to modify control options. For VM, options are modified through the TSS MODIFY command only. With VSE and OS/390, options are modified at the O/S console or through the TSS MODIFY command function. |
| GAP | Used to specify that a profile will become, or will cease to be, globally administrable. |
| DUFXTR | Used to add or remove the DUFXTR attribute to an ACID. DUFXTR enables an ACID to use a RACROUTE REQUEST=AUTH (RACHECK) macro or the CA-TopSecret Application Interface to extract installation data (INSTDATA) or field data from a Security Record. DUFXTR is a component of the CA-TopSecret Dynamic Update Facility (DUF). |
| DUFUPD | Used to add or remove the DUFUPD attribute to an ACID. DUFUPD enables an ACID to use the CA-TopSecret Application Interface to update the installation data (INSTDATA) or field data from a Security Record. DUFUPD is a component of the CA-TopSecret Dynamic Update Facility (DUF). |
| TSOMPW | Used to support multiple TSO UADS passwords, on a user-by-user basis. |
| NOATS | Used to prevent an ACID in CICS and CA-IDMS from signing on through ATS (Automatic Terminal Signon). |
| ACEDEFAU | Indicates whether a specific user or ACID has the ACE Default User privilege. |
| ASUSPEND | Used to remove the suspension of an ACID that was suspended for administrative reasons. |
| WHO HAS RESOURCE | Which ACIDs have been permitted access to a specified resource, facility, field, or attribute. |
| PROFILE ACID | Used to assign profiles to an ACID. |
| PASSWORD | Used to assign a password, along with values that control its use, to a previously defined ACID. |
| PASSWORD EXPIRES DATE | The date, in string format, that the password expires. |
| PASSWORD INTERVAL | The interval in which the password must be changed. |
| PASSWORD FACILITY | The facility name applied to ACIDs with the multipw attribute. |
| OPIDENT | Used to assign or remove a CICS operator identification value that is equal to the ACID's OPIDENT entry in the CICS SNT (Signon Table). The OPIDENT value is placed into the ACID's TCT at signon. |
| OPPRTY | Used to assign or remove a CICS operator priority from the associated ACID. The OPPRTY value is placed into the ACID's TCT (Terminal Control Table) at signon. |
| PROGRAM | Used to secure system programs and utilities. |
| WHOHAS ADMIN | Used to determine who has administrative authority on the application. |
| ACIDS2 | Specifies the second ACID to compare. |
| SOURCES | The specific terminals, locations, or entry points from which a user (ACID) is permitted to access the system. |
| TSOLPROC | Used to provide a default procedure to be used for TSO logon. The one- to eight-character logon procedure name. Procedure names are also TSO-related resources and the user must be permitted to any procedure name with which he attempts to log on. |
| DIV ACID | Specifies the Division ACID to which the ACID is attached. |
| DIV NAME | The name assigned to the ACID within the zone. |
| SUSPENDED | The date, in string format, that the suspension ends. |
| WHOHAS XAUTH | A list of resources that may be accessed by the ACID shown in the command, the level at which the ACID may access the resource, and the owner of the resource. |
| TSOUNIT | The default unit name to be used for dynamic allocations under TSO. The one- to eight-character unit (device) name for dynamically allocated data sets. The name must be a defined generic unit class name at the installation. This field is not alterable by the user at logon and is not required for successful logon. |
| PHYSKEY | PHYSKEY (physical security key) supports external authentication devices. |
| ACID WITHIN DEPT/DIV/ZONE | Used to specify department, division, and zone to include. |
| DATE CREATED | The date on which the ACID was created. |
| DATE LAST MODIFIED | The date on which the ACID was last modified. |
| TIME LAST MODIFIED | The time at which the ACID was last modified. |
| ROOM NUMBER | The room number assigned to the ACID. |
| MISC2 | Used to give, or to remove, a CA-TopSecret administrator's authority to perform one or more administrative functions. |
| ACCESSLEVELS | Permissions granted to ACIDs on resources. |
| MISC8 | Used to give, or to remove, a CA-TopSecret administrator's authority to list the contents of the RDT, FDT or STC or to use the ASUSPEND administrative function. |
| XA MINIDISK | The minidisk authorization information for the ACID. |
| SCOPE | Used to give CA-TopSecret administrators the authority, or to remove their authority, to assign the SCOPE of an LSCA. |
| DIGITAL CERT NAME | The name of the digital certification. |
| DEPARTMENT | The Department ACID to which the ACID is attached. |
| DLFTGRP | The default group for the ACID. |
| WHO OWNS RESOURCE | The resources owned by the ACID. |
| TSOOPT | The default options that a TSO user may specify at logon. |
| WANAME | The person to whom SYSOUT information should be delivered for this ACID. |
| XA | General Resource Ownership. Used for other resource classes not covered by the dedicated records. |
| SYSID | The SYSID (which is actually the SMFID) that the authorizations for the ACID apply to. |
| BUILDING | The building in which the ACID is located. |
| TSOCOMMAND | Default commands issued upon login of the ACID. |
| DIGITAL CERT STARTS | The date, in string format, that the digital certification starts. |
| XAUTH LIBRARY | The libraries for which the ACID has authority. |
| WHOHAS FACILITY | Returns facility information for the ACID. |
| RESOURCE CLASS NAME | The resource class for which the ACID has authority. |
| FCT/PREFIX(OWNED) | Details the File Control Table resource ownership for an ACID, focusing on FCT entries that have been protected using a generic prefix. |
| FACILITIES | The facilities to which the user has access. |
| TSOHCLASS | The default hold class for TSO generated JCL for TSO the user. |
| DIGITAL CERT EXPIRES | The date, in string format, when the digital certification expires. |
| ZONE ACID | The Zone ACID to which the ACID is attached. |
| ZONE NAME | The name assigned to the ACID within the zone. |
| ADDRESS1 | Physical address for the ACID. |
| XAUTHDAYS | Days of the week the ACID is authorized on this application. |
| ACID TYPE | The ACID type, for example zone, division, or department. |
| ACID SIZE | The size of the ACID. |
| RESTRICT | Record type that specifies access restrictions placed on a user's ACID. |
| ADDRESS4 | Alternative physical address for the ACID. |
| NODSNCHK | To specify that no data set name check will be performed. That is, CA-TopSecret will bypass all data set access security checks. All data set access will be audited. |
| NOVOLCHECK | Lists all the security bypass attributes assigned to the ACID. |
| NOLCFCHK | Used to allow an ACID to execute any command or transaction for all facilities, regardless of LCF (Limited Command Facility) restrictions. No auditing is done. |
| NOSUBCHK | Used to allow an ACID to bypass alternate ACID usage as well as all job submission security checking. Thus, associated ACIDs may submit all jobs regardless of the (derived) ACID on the job card being submitted. |
| NORESCHK | Used to allow an ACID to bypass security checking, including auditing, for all owned resources except data sets and volumes. |
| NOVMDCHK | Used to allow an ACID to bypass all checking for minidisk links. All links will be audited. NOVMDCHK is intended only to be applied to special products such as DASD space managers, which may link to many minidisks. |
| NOSUSPEN | Used to allow an ACID to bypass suspension due to violations. |
| TSODEST | The default destination identifier for TSO generated JCL for TSO users. |
| XA VOLUMN | Reports on a user's Extended Authority (XA) over a specific DASD or Tape Volume. |
| TSODEFPRFG | The default TSO performance group. |
| RESOURCE CLASS NAME2 | An additional resource class for which the ACID has authority. |
| MISC1 | A CA-TopSecret administrator's authority to perform one or more administrative functions. |
| GID | IDs of the groups to which the ACID belongs. |
| TSOUDATA | The site-defined data fields for a TSO user. |
| ACCESSLEVELS2 | Used to list the XAUTH (Cross-Authorization) access levels granted to one ACID (Accessor ID) over another ACID's resources. |
| DSN/PREFIX(OWNED) | Reports ownership of Data Sets (DSNs) or Data Set Name Prefixes by an ACID (Accessor ID). |
| TSOMSIZE | The maximum region size (in kilobytes) that the TSO user can specify at logon. |
| EXPIRES | The date on which the ACID expires. |
| TSOSCLASS | The default SYSOUT class for TSO generated JCL for the TSO users. |
| XAUTH FAC | The list of FACILITY names that are authorized to access a particular resource, usually in the context of a Resource Access Level XAUTH record. |
| DEPT ACID | The Department ACID to which the ACID is attached. |
| DEPT NAME | The name assigned to the ACID within the department. |
| DATE LAST USED | Date the ACID was last used. |
| TIME LAST USED | Time the ACID was last used. |
| CPU | Name of the CPU on which the ACID was used. |
| FAC | System facilities defined to CA-TopSecret: BATCH, STC, TSO, IMS, CICS, NCCF, CA-Roscoe, WYLBUR, or any installation-defined facility. |
| COUNT | The Login count for a specific ACID (Accessor ID). |
| SEGMENT | Used to allow TSS administrators to list data about fields in a specific segment. |
| RESOURCES | The general resources that an ACID (user ID, profile, department, etc.) is either authorized to access or owns. |
| TSOJCLASS | The default job class for TSO generated job cards from TSO users. |
| ADMIN BY | Administrative Accountability record, which tracks which administrator modified the ACID and when. |
| XAUTH MODE | Mode of Extended Authorization XAUTH that is defined for a specific ACID. |
| TSOLACCT | The default account number used for TSO logon. |
| TSOLSIZE | The default region size (in kilobytes) for TSO. |
| LISTDATA | The administrative authority granted to a Security Administrator SCA, DCA, VCA, etc. that controls their ability to read or LIST specific security information about other users. |
| OMVSPGM | The user's OpenEdition MVS shell program. This is the first program started when the OMVS command is entered, or when an OpenEdition MVS batch job is started using the BPXBATCH program. |
| SMSSTOR | The default storage keyword for the ACID. |
| UID | The unique user ID for the ACID. |
| ADDRESS3 | Alternative physical address for the ACID. |
| XAUTH PRIVPGM | The program pathing, if privileged program is in use. |
| TIME ZONE | The time zone attached to the ACID. |
| MASTER FACILITY | Identifies the specific TSS facility that is automatically associated with a started task or Multi-User Address Space Server MUSASS region ACID. |
| LCF FACILITY | Information about the Limited Command Facility security definitions assigned to an ACID. |
| FACILITY NAME | ACID's permitted facilities or when listing facility-specific information. |
| FACILITY UNTIL DATE | Expiration date that limits an ACID's authorization to use a specific facility. |
| INSTDATA | Used to record or remove information about an ACID. Up to 255 characters of information about an associated ACID may be used for convenient record keeping, or for interrogation by a user-written Installation Exit. |
| ADDRESS2 | Alternative physical address for the ACID. |
| WAACCOUNT | Work Area Account Number attribute assigned to an ACID. |
| GROUP ACID | The Group ACID to which the ACID is attached. |
| TSOMCLASS | The default message class for TSO generated JCL for TSO users. |
| MISC9 | To give, or to remove, a TSS administrator's authority to perform one or more high-level administrative functions. |
| ACID | The fundamental user or system identity record. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The Top Secret (Read-only) connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute Name | Description |
| --- | --- |
| XAUTH | The authorized level at which the user can access the resource. |
| VMMDISK | The VM minidisks owned by the user. |
| ACTION | Specifies which action(s) CA-TopSecret will take when access to a resource is attempted. |
| LOCK TIME(MINUTES) | The time interval before unattended or inactive terminals are locked. |
| LOCK TIME FACILITY | The lock time for all terminals connected to the specified facility. |
| LANGUAGE PREFERENCE | The language preference code the user. |
| VOLSER(OWNED) | The volumes to which the user has access. |
| ATTRIBUTES | A dynamic field that either contains a list of user privileges or resource-specific settings associated with the record being displayed. |
| VOLSER(OWNED)2 | Report showing the DASD volumes that are owned by a specific ACID. |
| ATTRIBUTES2 | The ATTRIBUTE continuation records contain the rest of the miscellaneous flags and options for the ACID. |
| NAME | Identifies the ACID name. Names can be up to 32 characters in length, must be surrounded by single quotes if embedded with blanks, and can use letters, numbers, and special characters. |
| SITRAN | Specifies which CICS transaction CA-TopSecret automatically executes after an ACID successfully signs on to a facility. If a SITRAN is added to an ACID that already has a CICS transaction defined, the transaction is replaced. |
| HOME | Defines the initial directory pathname. This is the initial directory used when a user enters the OMVS command or enters the ISPF shell. The HOME keyword accepts from one to 1024 characters. Both uppercase and lowercase characters are allowed. If HOME isn't defined, OpenEdition MVS sets the initial directory for the user to the root directory. HOME is optional. |
| XA ACID | XAUTH Resource Class Name |
| MULTIPW | Used to assign or remove multiple password attributes, which means ACIDs need a different password to access each facility. |
| NOADSP | Used to prevent data sets, created by an ACID, from being automatically secured by MVS by setting the RACF bit. NOADSP is used to define an ACID that will be used to create data sets that cannot be automatically protected by CA-TopSecret. |
| AUDIT | Used to allow an audit of ACID activity. |
| NOPWCHG | To prevent ACIDs from changing passwords at either signon or initiation. |
| OIDCARD | Used to support the physical identification of users through operator identification cards. |
| TRACE | Used to activate a diagnostic trace on all ACID activity (initiations, resource access, violations, user's security mode, etc.) |
| SUSPEND | Used to prevent ACIDs from accessing the system when a violation occurs. |
| MRO | Used to support the use of the multi-region option. |
| CONSOLE | Used to grant or remove an ACID's ability to modify control options. For VM, options are modified through the TSS MODIFY command only. With VSE and OS/390, options are modified at the O/S console or through the TSS MODIFY command function. |
| GAP | Used to specify that a profile will become, or will cease to be, globally administrable. |
| DUFXTR | Used to add or remove the DUFXTR attribute to an ACID. DUFXTR enables an ACID to use a RACROUTE REQUEST=AUTH (RACHECK) macro or the CA-TopSecret Application Interface to extract installation data (INSTDATA) or field data from a Security Record. DUFXTR is a component of the CA-TopSecret Dynamic Update Facility (DUF). |
| DUFUPD | Used to add or remove the DUFUPD attribute to an ACID. DUFUPD enables an ACID to use the CA-TopSecret Application Interface to update the installation data (INSTDATA) or field data from a Security Record. DUFUPD is a component of the CA-TopSecret Dynamic Update Facility (DUF). |
| TSOMPW | Used to support multiple TSO UADS passwords, on a user-by-user basis. |
| NOATS | Used to prevent an ACID in CICS and CA-IDMS from signing on through ATS (Automatic Terminal Signon). |
| ACEDEFAU | Indicates whether a specific user or ACID has the ACE Default User privilege. |
| ASUSPEND | Used to remove the suspension of an ACID that was suspended for administrative reasons. |
| WHO HAS RESOURCE | Which ACIDs have been permitted access to a specified resource, facility, field, or attribute. |
| PROFILE ACID | Used to assign profiles to an ACID. |
| PASSWORD | Used to assign a password, along with values that control its use, to a previously defined ACID. |
| PASSWORD EXPIRES DATE | The date, in string format, that the password expires. |
| PASSWORD INTERVAL | The interval in which the password must be changed. |
| PASSWORD FACILITY | The facility name applied to ACIDs with the multipw attribute. |
| OPIDENT | Used to assign or remove a CICS operator identification value that is equal to the ACID's OPIDENT entry in the CICS SNT (Signon Table). The OPIDENT value is placed into the ACID's TCT at signon. |
| OPPRTY | Used to assign or remove a CICS operator priority from the associated ACID. The OPPRTY value is placed into the ACID's TCT (Terminal Control Table) at signon. |
| PROGRAM | Used to secure system programs and utilities. |
| WHOHAS ADMIN | Used to determine who has administrative authority on the application. |
| ACIDS2 | Specifies the second ACID to compare. |
| SOURCES | The specific terminals, locations, or entry points from which a user (ACID) is permitted to access the system. |
| TSOLPROC | Used to provide a default procedure to be used for TSO logon. The one- to eight-character logon procedure name. Procedure names are also TSO-related resources and the user must be permitted to any procedure name with which he attempts to log on. |
| DIV ACID | Specifies the Division ACID to which the ACID is attached. |
| DIV NAME | The name assigned to the ACID within the zone. |
| SUSPENDED | The date, in string format, that the suspension ends. |
| WHOHAS XAUTH | A list of resources that may be accessed by the ACID shown in the command, the level at which the ACID may access the resource, and the owner of the resource. |
| TSOUNIT | The default unit name to be used for dynamic allocations under TSO. The one- to eight-character unit (device) name for dynamically allocated data sets. The name must be a defined generic unit class name at the installation. This field is not alterable by the user at logon and is not required for successful logon. |
| PHYSKEY | PHYSKEY (physical security key) supports external authentication devices. |
| ACID WITHIN DEPT/DIV/ZONE | Used to specify department, division, and zone to include. |
| DATE CREATED | The date on which the ACID was created. |
| DATE LAST MODIFIED | The date on which the ACID was last modified. |
| TIME LAST MODIFIED | The time at which the ACID was last modified. |
| ROOM NUMBER | The room number assigned to the ACID. |
| MISC2 | Used to give, or to remove, a CA-TopSecret administrator's authority to perform one or more administrative functions. |
| ACCESSLEVELS | Permissions granted to ACIDs on resources. |
| MISC8 | Used to give, or to remove, a CA-TopSecret administrator's authority to list the contents of the RDT, FDT or STC or to use the ASUSPEND administrative function. |
| XA MINIDISK | The minidisk authorization information for the ACID. |
| SCOPE | Used to give CA-TopSecret administrators the authority, or to remove their authority, to assign the SCOPE of an LSCA. |
| DIGITAL CERT NAME | The name of the digital certification. |
| DEPARTMENT | The Department ACID to which the ACID is attached. |
| DLFTGRP | The default group for the ACID. |
| WHO OWNS RESOURCE | The resources owned by the ACID. |
| TSOOPT | The default options that a TSO user may specify at logon. |
| WANAME | The person to whom SYSOUT information should be delivered for this ACID. |
| XA | General Resource Ownership. Used for other resource classes not covered by the dedicated records. |
| SYSID | The SYSID (which is actually the SMFID) that the authorizations for the ACID apply to. |
| BUILDING | The building in which the ACID is located. |
| TSOCOMMAND | Default commands issued upon login of the ACID. |
| DIGITAL CERT STARTS | The date, in string format, that the digital certification starts. |
| XAUTH LIBRARY | The libraries for which the ACID has authority. |
| WHOHAS FACILITY | Returns facility information for the ACID. |
| RESOURCE CLASS NAME | The resource class for which the ACID has authority. |
| FCT/PREFIX(OWNED) | Details the File Control Table resource ownership for an ACID, focusing on FCT entries that have been protected using a generic prefix. |
| FACILITIES | The facilities to which the user has access. |
| TSOHCLASS | The default hold class for TSO generated JCL for TSO the user. |
| DIGITAL CERT EXPIRES | The date, in string format, when the digital certification expires. |
| ZONE ACID | The Zone ACID to which the ACID is attached. |
| ZONE NAME | The name assigned to the ACID within the zone. |
| ADDRESS1 | Physical address for the ACID. |
| XAUTHDAYS | Days of the week the ACID is authorized on this application. |
| ACID TYPE | The ACID type, for example zone, division, or department. |
| ACID SIZE | The size of the ACID. |
| RESTRICT | Record type that specifies access restrictions placed on a user's ACID. |
| ADDRESS4 | Alternative physical address for the ACID. |
| NODSNCHK | To specify that no data set name check will be performed. That is, CA-TopSecret will bypass all data set access security checks. All data set access will be audited. |
| NOVOLCHECK | Lists all the security bypass attributes assigned to the ACID. |
| NOLCFCHK | Used to allow an ACID to execute any command or transaction for all facilities, regardless of LCF (Limited Command Facility) restrictions. No auditing is done. |
| NOSUBCHK | Used to allow an ACID to bypass alternate ACID usage as well as all job submission security checking. Thus, associated ACIDs may submit all jobs regardless of the (derived) ACID on the job card being submitted. |
| NORESCHK | Used to allow an ACID to bypass security checking, including auditing, for all owned resources except data sets and volumes. |
| NOVMDCHK | Used to allow an ACID to bypass all checking for minidisk links. All links will be audited. NOVMDCHK is intended only to be applied to special products such as DASD space managers, which may link to many minidisks. |
| NOSUSPEN | Used to allow an ACID to bypass suspension due to violations. |
| TSODEST | The default destination identifier for TSO generated JCL for TSO users. |
| XA VOLUMN | Reports on a user's Extended Authority (XA) over a specific DASD or Tape Volume. |
| TSODEFPRFG | The default TSO performance group. |
| RESOURCE CLASS NAME2 | An additional resource class for which the ACID has authority. |
| MISC1 | A CA-TopSecret administrator's authority to perform one or more administrative functions. |
| GID | IDs of the groups to which the ACID belongs. |
| TSOUDATA | The site-defined data fields for a TSO user. |
| ACCESSLEVELS2 | Used to list the XAUTH (Cross-Authorization) access levels granted to one ACID (Accessor ID) over another ACID's resources. |
| DSN/PREFIX(OWNED) | Reports ownership of Data Sets (DSNs) or Data Set Name Prefixes by an ACID (Accessor ID) |
| TSOMSIZE | The maximum region size (in kilobytes) that the TSO user can specify at logon. |
| EXPIRES | The date on which the ACID expires. |
| TSOSCLASS | The default SYSOUT class for TSO generated JCL for the TSO users. |
| XAUTH FAC | The list of FACILITY names that are authorized to access a particular resource, usually in the context of a Resource Access Level XAUTH record. |
| DEPT ACID | The Department ACID to which the ACID is attached. |
| DEPT NAME | The name assigned to the ACID within the department. |
| DATE LAST USED | Date the ACID was last used. |
| TIME LAST USED | Time the ACID was last used. |
| CPU | Name of the CPU on which the ACID was used. |
| FAC | System facilities defined to CA-TopSecret: BATCH, STC, TSO, IMS, CICS, NCCF, CA-Roscoe, WYLBUR, or any installation-defined facility. |
| COUNT | The Login count for a specific ACID (Accessor ID). |
| SEGMENT | Used to allow TSS administrators to list data about fields in a specific segment. |
| RESOURCES | The general resources that an ACID (user ID, profile, department, etc.) is either authorized to access or owns. |
| TSOJCLASS | The default job class for TSO generated job cards from TSO users. |
| ADMIN BY | Administrative Accountability record, which tracks which administrator modified the ACID and when. |
| XA DATASET | Indicates an extended authorization permit to a dataset resource. |
| XAUTH MODE | Mode of Extended Authorization XAUTH that is defined for a specific ACID. |
| TSOLACCT | The default account number used for TSO logon. |
| TSOLSIZE | The default region size (in kilobytes) for TSO. |
| LISTDATA | The administrative authority granted to a Security Administrator SCA, DCA, VCA, etc. that controls their ability to read or LIST specific security information about other users. |
| OMVSPGM | The user's OpenEdition MVS shell program. This is the first program started when the OMVS command is entered, or when an OpenEdition MVS batch job is started using the BPXBATCH program. |
| SMSSTOR | The default storage keyword for the ACID. |
| UID | The unique user ID for the ACID. |
| ADDRESS3 | Alternative physical address for the ACID. |
| XAUTH PRIVPGM | The program pathing, if privileged program is in use. |
| TIME ZONE | The time zone attached to the ACID. |
| MASTER FACILITY | Identifies the specific TSS facility that is automatically associated with a started task or Multi-User Address Space Server MUSASS region ACID. |
| LCF FACILITY | Information about the Limited Command Facility security definitions assigned to an ACID. |
| FACILITY NAME | ACID's permitted facilities or when listing facility-specific information. |
| FACILITY UNTIL DATE | Expiration date that limits an ACID's authorization to use a specific facility. |
| INSTDATA | Used to record or remove information about an ACID. Up to 255 characters of information about an associated ACID may be used for convenient record keeping, or for interrogation by a user-written Installation Exit. |
| ADDRESS2 | Alternative physical address for the ACID. |
| WAACCOUNT | Work Area Account Number attribute assigned to an ACID. |
| GROUP ACID | The Group ACID to which the ACID is attached. |
| TSOMCLASS | The default message class for TSO generated JCL for TSO users. |
| MISC9 | To give, or to remove, a TSS administrator's authority to perform one or more high-level administrative functions. |
| ACID | The fundamental user or system identity record. |