Renaming a TSO ID results in ISPF error at logon
Bob Bridges
At one of my clients we use Top Secret to administer security. I have a user who requested that we change his ID, and convinced us it was worth doing. So here's what we did:
1) Renamed his ID from <old ID> to <new ID>. (In TSS you can do that, unlike RACF and ACF2.)
2) Created a TSO alias <new ID>
3) He had only three datasets: <old ID>.BRODCAST, ...ISPF.PROFILE and ...<old ID>.SPFLOG1.LIST. I renamed those three datasets to <new ID>...
4) Deleted the TSO alias <old ID>.
Did this on six LPARs. This morning he reports that when he logged on, every LPAR presents this error:
TSS7220E 102 J=<new ID> A=<new ID> VOL=<volser> ACC=CREATE DSN=<old ID>.<new ID>.SPFLOG1.LIST
TSS7227E CREATE Access Not Granted to Dataset <old ID>.<new ID>.SPFLOG1.LIST
ISPF system data set allocation error - press Enter to continue.
Log file allocation error - ISPF will operate without a log data set.
DAIR RC = 12 dec, DARC = 970C hex.
It seems clear to me that something in ISPF is still yearning for his old ID. But what would it be? Any ideas?
PS: I searched his ISPF.PROFILE PDS and there are two members that refer to <old ID>. But neither of them would be consulted at logon.
---
Bob Bridges, robhb...@gmail.com, cell 336 382-7313
/* Misers are hard to live with, but they make great ancestors. -from "Money Talk", Jan 2009 */
Paul Gilmartin
> ...
> 4) Deleted the TSO alias <old ID>.
>
Can he take ISPF out of the picture and just try:
READY
allocate dsn(TEST.NAME) new ... ?
-- gil
Mark Zelden
-------- Original Message --------
Subject: [ISPF-L] Renaming a TSO ID results in ISPF error at logon
From: "Bob Bridges" <robhb...@gmail.com>
Date: Tue, January 28, 2020 12:14 pm
To: "'ISPF discussion list'" <ISP...@LISTSERV.ND.EDU>
Ok, here's an error I didn't expect and don't understand. If you tell me I should post the question at IBM-MAINFRAME instead, I will, but it clearly involves ISPF so I thought I'd start here.
At one of my clients we use Top Secret to administer security. I have a user who requested that we change his ID, and convinced us it was worth doing. So here's what we did:
1) Renamed his ID from <old ID> to <new ID>. (In TSS you can do that, unlike RACF and ACF2.)
2) Created a TSO alias <new ID>
3) He had only three datasets: <old ID>.BRODCAST, ...ISPF.PROFILE and ...<old ID>.SPFLOG1.LIST. I renamed those three datasets to <new ID>...
4) Deleted the TSO alias <old ID>.
Did this on six LPARs. This morning he reports that when he logged on, every LPAR presents this error:
TSS7220E 102 J=<new ID> A=<new ID> VOL=<volser> ACC=CREATE DSN=<old ID>.<new ID>.SPFLOG1.LIST
ISPF system data set allocation error - press Enter to continue.
Log file allocation error - ISPF will operate without a log data set.
DAIR RC = 12 dec, DARC = 970C hex.
It seems clear to me that something in ISPF is still yearning for his old ID. But what would it be? Any ideas?
PS: I searched his ISPF.PROFILE PDS and there are two members that refer to <old ID>. But neither of them would be consulted at logon.
---
Bob Bridges, robhb...@gmail.com, cell 336 382-7313
/* Misers are hard to live with, but they make great ancestors. -from "Money Talk", Jan 2009 */
--
You received this message because you are subscribed to the Google Groups "ISPF discussion list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ispf-l-list...@nd.edu.
To view this discussion on the web visit https://groups.google.com/a/nd.edu/d/msgid/ispf-l-list/04ca01d5d606%24c0fc84a0%2442f58de0%24%40gmail.com.
Mark Zelden
Lionel Dyck
Also, check out the user's ISPF Profile dataset – some members may have the userid as a variable within the individual profiles.
--------------------------------------------
Lionel B. Dyck <sdg>
Senior Software Engineer
21st Century Software
940 West Valley Road
Suite 1604
Wayne, PA 19087
www.21stcenturysoftware.com
lio...@21csw.com
(800) 555-6845 x610
(610) 710-4832 – Office
From the Leaders in Data Stewardship™
THIS E-MAIL MAY CONTAIN PRIVILEGED, CONFIDENTIAL, COPYRIGHTED, OR OTHER LEGALLY PROTECTED INFORMATION. IF YOU ARE NOT THE INTENDED RECIPIENT (EVEN IF THE E-MAIL ADDRESS ABOVE IS YOURS), YOU MAY NOT USE, COPY, OR RE-TRANSMIT IT. IF YOU HAVE RECEIVED THIS BY
MISTAKE PLEASE NOTIFY US BY RETURN E-MAIL, THEN DELETE. THANK YOU
To view this discussion on the web visit https://groups.google.com/a/nd.edu/d/msgid/ispf-l-list/20200128114947.d90885889c0c9fcd93eaf0c429666853.53dd83ee6c.wbe%40email15.godaddy.com.
Williams, Charles H
Based on the dataset names in your email, it doesn’t appear that you use a dataset profile prefix (i.e. TSO PROFILE NOPREFIX). I’m wondering if <old ID>.<new ID>.SPFLOG1.LIST is really <prefix>.<userid>. SPFLOG1.LIST. You might have him issue TSO PROFILE LIST command just to see if somehow PREFIX(<old ID>) got set instead of NOPREFIX. Or run this rexx…
/*REXX */
SAY 'Data set name prefix ' sysvar(SYSPREF)
SAY 'TSO User ID ' sysvar(SYSUID)
EXIT
Charles Williams |State of Missouri | Charles.H...@oa.mo.gov
To view this discussion on the web visit https://groups.google.com/a/nd.edu/d/msgid/ispf-l-list/DM6PR03MB465090937870C7871478D83AB80A0%40DM6PR03MB4650.namprd03.prod.outlook.com.
Sokolsky, Hayim Z.
The issue is simple. The user’s “UADS” entry – their TSO segment values were not updated. So the user’s TSO PREFIX value is his/her old-id. The result is everything created under ISPF will be old-id.new-id.stuff. The user can fix this themselves outside of ISPF by issuing the command:
PROFILE PREFIX(new-id)
Or you can do it yourself via a TSS command.
Hayim Sokolsky
Director, Security Architect
Security Architecture and Technology
Technology Risk Management
DTCC Tampa
Visit us at www.dtcc.com or follow us on Twitter @The_DTCC and on LinkedIn.
To learn about career opportunities at DTCC, please visit dtcc.com/careers.
The views I have expressed in this email are my own personal views, and are not endorsed or supported by, and do not necessarily express or reflect, the views, positions or strategies of my employer.
DTCC Public (White)
From: ispf-...@nd.edu <ispf-...@nd.edu> On Behalf Of
Lionel Dyck
Sent: Tuesday, 28 January, 2020 14:11
To: ispf-...@nd.edu
Subject: RE: [ISPF-L] Renaming a TSO ID results in ISPF error at logon
|
ATTENTION! This email originated outside of DTCC; exercise caution. |
To view this discussion on the web visit https://groups.google.com/a/nd.edu/d/msgid/ispf-l-list/DM6PR03MB465090937870C7871478D83AB80A0%40DM6PR03MB4650.namprd03.prod.outlook.com.
Paul Gilmartin
> ...
Trying to understand these behaviors, I found:
https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.3.0/com.ibm.zos.v2r3.cbcpx01/cbc1p210.htm
o If your system does not use RACF, z/OS XL C/C++ does not add a high-level
qualifier to the name you specified.
Hmmm. Should that be "... RACF or compatible security product, ..."?
Or does z/OS XL C/C++ strictly require the proprietary RACF?
Or, perhaps, "... the result is unspecified"?
-- gil
Mark Zelden
To view this discussion on the web visit https://groups.google.com/a/nd.edu/d/msgid/ispf-l-list/CY4PR15MB1781D1E437EDF067A414DC9ED80A0%40CY4PR15MB1781.namprd15.prod.outlook.com.