This section describes how you can control with Natural Security the use of various Natural utilities. It covers the following topics:
The utility protection provided by Natural Security, as described in this section, is function-oriented, which means that it is based on the concept that you can allow or disallow individual functions of a utility. You control the use of a utility by defining utility profiles for it, in which you allow/disallow its functions. The utilities that can be protected in this manner are listed below.
To invoke a Natural utility, you usually enter the utility name as a system command (for example, to invoke the SYSERR utility, you enter the system command SYSERR). If a utility is invoked in this way, one of the utility profiles defined for this utility applies and controls the use of the utility - thus providing consistent protection of the utility.
Invoking a utility does not change the library you are currently in; that is, when you exit the utility, you are still in the same library from which you invoked the utility. See also the section Utility Activation in the Natural Utilities documentation.
To control the use of a utility, you need not define a library profile for the library which contains the utility. A library profile for a utility is only relevant if the utility requires access to programs in other libraries (for example, user exits contained in steplibs).
If a library profile is defined for a library containing a utility,
and you log on to a utility library, the same logon rules apply as for a logon
to any other library (as described in the section
Logging On). From
within the utility library, the utility may be invoked either by entering the
utility name as system command (as from any other library) or by the startup
transaction MENU (if defined in the utility's library profile)
being executed. In the latter case, however, a
LOGOFF command will be performed when you exit the
utility.
The utilities SYSERR and SYSMAIN process the contents of libraries; if the use of these utilities is not controlled by utility profiles, the Utilities option in the library profile of the library processed applies.
The use of the following Natural utilities can be controlled with utility profiles:
This section covers the following topics:
Basically, a utility profile consists of a list of the utility's functions, each of which can be allowed or disallowed by marking it with "A" or "D" respectively.
For each utility listed under Which Utilities Can Be Protected? (see above), you can define:
a default profile,
user-specific profiles,
library-specific profiles,
user-library-specific profiles.
Each utility is treated individually; that is, any utility profiles only apply to the utility they are defined for, and not to any other utilities.
Note:
If the use of a utility is protected by a utility profile, the
Natural profile parameter settings MADIO=0 and
MAXCL=0 apply automatically.
The default profile of a utility applies for all users (except those for which user-specific profiles are defined). It determines which of the utility's functions the users may use and which not.
If an individual user is to use (or not to use) other functions than the other users, you can define a user-specific utility profile.
Such a profile only applies to this user, it overrides the default profile, and determines which of the utility's functions this particular user may use and which not.
In this example, the SYSBPM function "Delete Object from Buffer Pool" is disallowed for all users - except for the user UX, for whom it is allowed. This means that UX is the only user who may delete objects from the buffer pool.
User-specific utility profiles can be defined for users of types "Group", "Administrator" and "Person".
A user-specific utility profile can only be defined if a default profile (or a template) has been defined for that utility. (Templates are described under Defining Default Profiles below.)
Several utilities affect individual Natural libraries (for example, SYSERR can be used to maintain error messages that belong to a specific library). Generally, the utility's default profile applies to all affected libraries.
However, if some of the utility's functions are only to be allowed/disallowed for a particular library, you can define a library-specific utility profile.
Such a profile only applies to this library, it overrides the default profile as well as any user-specific profiles for that utility, and determines which of the utility's functions may be applied to this library and which not.
In this example, the SYSERR function "Delete messages" is allowed for all libraries - except for the library MYLIB, for which it is disallowed. This means that all users can delete user error messages from any library, except from library MYLIB. No-one can delete messages from MYLIB. (If any user-specific profiles were defined for SYSERR, they would apply to all other libraries, but not to library MYLIB.)
In this example, the SYSERR function "Delete messages" is disallowed for all libraries - except for the library PLAYLIB, for which it is allowed. For the user UX, the function "Delete messages" is allowed for all libraries. This means that all users can delete error messages from library PLAYLIB. However, no user - except user UX - can delete messages from any other library. User UX is the only user who may delete messages from any library (including PLAYLIB). Please note that user UX's permission to delete messages from PLAYLIB depends on the library-specific profile, not the user-specific profile.
Library-specific utility profiles can be defined for the following utilities: SYSBPM, SYSDDM, SYSERR, SYSMAIN, SYSOBJH.
A library-specific utility profile can only be defined if a default profile has been defined for that utility.
As described above, several utilities affect individual Natural libraries. Two kinds of situations may occur in which a user-library-specific utility profile may have to be defined:
A user-specific utility profile determines which of a utility's functions a particular user may use, regardless of the libraries which are affected by the functions (provided that no library-specific profiles are defined for this utility). However, if this user is to have different function usage permissions for a particular library affected by the utility's functions, you can define these in a user-library-specific utility profile.
A library-specific utility profile determines which of a utility's functions may be used when applied to a particular library; for this library, it applies for all users (regardless of any user-specific profiles). However, if a particular user is to have different function usage permissions for this library, you can define these in a user-library-specific utility profile.
A user-library-specific profile only applies for one user and one library, it overrides the library-specific utility profile of that library as well as the user-specific profile of that user, and it determines which of the utility's functions the user may use for this library.
In this example, the SYSERR function "Delete messages" is disallowed for all users (due to the default profile). The SYSERR function "Modify messages" is also disallowed for all users (due to the default profile) - except for user UX, for whom it is allowed (due to his/her user-specific profile). Also, for the user UX both functions are allowed for the library MYLIB (due to the user-library-specific profile). This means that no user can modify or delete any error messages from any library. The only exception is user UX: User UX may modify messages from any library; moreover, user UX may delete messages from library MYLIB (but not from any other library). Please note that user UX's permission to modify messages from MYLIB depends on the user-library-specific profile, not the user-specific profile.
This example results in the following setup:
Error messages of library MYLIB may only be modified by user UX.
Error messages of any other library may be modified by any user.
Error messages of library MYLIB cannot be deleted by any user.
Error messages of any other library may only be deleted by user UX, but not by any other user.
User-library-specific utility profiles can be defined for the following utilities: SYSBPM, SYSDDM, SYSERR, SYSMAIN, SYSOBJH.
A user-library-specific utility profile can only be defined for a user for which a user-specific utility profile has been defined.
When a user tries to use a utility function, Natural Security searches for the appropriate utility profile to determine whether the user is allowed to perform the function.
As shown below, you can influence the search sequence with the Session Options Privileged Groups and *GROUP Only, which can be set in a utility's default profile.
If *GROUP Only is set to "N", Natural Security searches for the following utility profiles in the following order:
the user-library-specific profile
of the user for the library affected (only if the user is of type A or P);
of a privileged group for the library affected (only if Privileged Groups is set to "Y");
of the current group in which the user is contained for the library affected;
of another group in which the user is contained for the library affected;
the library-specific profile of the library affected;
the user-specific profile
of the user (only if the user is of type A or P);
of a privileged group (only if Privileged Groups is set to "Y");
of the current group in which the user is contained;
of another group in which the user is contained;
the utility's default profile.
If *GROUP Only is set to "Y", Natural Security searches for the following utility profiles in the following order:
the user-library-specific profile
of the user for the library affected (only if the user is of type A or P);
of the current group in which the user is contained for the library affected;
the library-specific profile of the library affected;
the user-specific profile
of the user (only if the user is of type A or P);
of the current group in which the user is contained;
the utility's default profile.
For the search, the user and current group are determined by the
current values of the Natural system variables *USER and
*GROUP respectively. Privileged groups are the groups which are
specified as Privileged Groups in
the user's security profile; their IDs are processed in the sequence in which
they are specified in the user profile. IDs of other groups are processed in
alphabetical order.
The first profile encountered in this search determines whether the user is allowed to perform the function.
If none of the above profiles exists and the utility function affects the contents of a library, the Utilities option in the library profile applies.
A user may obtain information about the utility profile which
currently applies by using the Natural system command
PROFILE (see also the
PROFILE
Command in the section Protecting
Libraries).
The following diagram shows the hierarchy of the utility profiles.
Assume the following situation: User UX (user type A), who is contained in group GX, wants to copy programming objects with the SYSMAIN utility from library LIB1 to library LIB2.
First, Natural Security checks if the user may copy programming objects with SYSMAIN from library LIB1; that is, if the Copy function for Programming Objects is allowed:
It checks the user-library-specific profile of user UX and library LIB1 for SYSMAIN.
If no such profile exists, it checks the user-library-specific profile of user GX and library LIB1 for SYSMAIN.
If no such profile exists, it checks the library-specific profile of library LIB1 for SYSMAIN.
If no such profile exists, it checks the user-specific profile of user UX for SYSMAIN.
If no such profile exists, it checks the user-specific profile of user GX for SYSMAIN.
If no such profile exists, it checks the default profile of SYSMAIN.
Then, Natural Security checks if the user may copy programming objects with SYSMAIN into library LIB2; that is, if the Copy function for Programming Objects is allowed:
It checks the user-library-specific profile of user UX and library LIB2 for SYSMAIN.
If no such profile exists, it checks the user-library-specific profile of user GX and library LIB2 for SYSMAIN.
If no such profile exists, it checks the library-specific profile of library LIB2 for SYSMAIN.
If no such profile exists, it checks the user-specific profile of user UX for SYSMAIN.
If no such profile exists, it checks the user-specific profile of user GX for SYSMAIN.
If no such profile exists, it checks the default profile of SYSMAIN.
As the various Natural utilities and their functions differ greatly from one another, the time when Natural Security checks whether a user may use a requested utility function differs from utility to utility, and from function to function.
When a user uses a utility under the control of a utility profile,
the only Natural system commands available to the user within the utility are:
FIN, LOGON,
MAIL and PROFILE; all
other system commands cannot be used. The reason for this is to preclude any
"loopholes" in the protection established by the utility profiles.
To define default profiles, you use the Administrator Services section of Natural Security (as described under Defining Default Profiles below).
To define all other utility profiles, you use the Utility Maintenance section of Natural Security (as described under Defining Individual Profiles - Utility Maintenance below).
On the Main Menu, select Administrator Services.
If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.
Press PF8.
On the Administrator Services Menu 2, select Utility Defaults/Templates.
The Define Utility Defaults/Templates screen will be displayed, listing all the utilities for which profiles can be defined.
The status of a utility (as indicated in the Message field) can be one of the following:
| Status | Meaning |
|---|---|
| Nothing defined | No profile is defined for the utility.
If a utility function affects the contents of a library, its use is controlled by the Utilities option in the library security profile. |
| Default defined | A default profile has been defined for the utility. This
default profile applies for all users for which no individual user-specific
profile is defined.
The Utilities option in library security profiles is ignored for this utility. |
| Template defined | A profile has been defined for the utility. However,
this profile can only be used as a template to define individual user-specific
utility profiles.
If a utility function affects the contents of a library, its use is controlled by the Utilities option in the library security profile - except for those users for which a user-specific utility profile is defined. |
Whether a default profile is a "real" profile or only a template is determined by the field Applies as Default Profile (see below) within the profile.
 |
Warning: To avoid the applicability of utility profiles and the Utilities option in library profiles getting mixed up, you should always define a default profile (not only a template) for a utility if you intend to define user-specific profiles for that utility. |
On the Define Utility Defaults/Templates screen, you can mark a utility with one of the following function codes:
| Code | Function |
|---|---|
AD
|
Define a default profile or template for the utility. |
MO
|
Modify the utility's existing default profile or template. |
DE
|
Delete the utility's existing default profile or template. |
DI
|
Display the utility's existing default profile or template. |
When you mark a utility with code DE, a window will be
displayed in which you confirm the deletion by entering the utility name. When
you delete a utility's default profile or template, all other profiles for that
utility - that is, user-specific, library-specific and user-library-specific
utility profiles - will also be deleted.
When you mark a utility with code AD, MO
or DI, its default profile or template will be displayed.
The default profile/template for each utility provides several options, which correspond to functions of the utility concerned. The options for each utility are described under Components of Utility Profiles below.
You can allow or disallow each option by marking it with "A" or "D" respectively. Initially, all options are disallowed.
With PF16 and PF17, you can set all options in a utility profile simultaneously to "A" or "D" respectively.
Note:
Natural Security performs consistency checks on the combinations
of allowed and disallowed options - impossible combinations of "A" and "D" are
automatically rejected.
Moreover, each profile provides the following field, which determines whether the profile is a "real" default profile or only a template:
| Y | Default Profile - The profile applies for all users for which no individual utility profile is defined. |
|---|---|
| N | Template - The profile does not apply for any user. It can only be used as a template for the definition of individual user-specific utility profiles. |
Once this field is set to "Y" and any user-specific or library-specific profiles have been defined for that utility, you cannot reset it to "N". This is to ensure consistent utility protection.
Natural Security's Utility Maintenance is used to perform all functions related to the maintenance of individual utility profiles: user-specific profiles, library-specific profiles and user-library-specific profiles.
The components of an individual profile correspond to those of the corresponding default profile; they are described under Components of Utility Profiles below.
Note:
Owner logic applies to the creation/maintenance of individual
utility profiles.
This section covers the following topics related to utility profile creation/maintenance:
To invoke utility maintenance:
On the Main Menu, select Maintenance.
A window will be displayed.
In the window, mark the object type Utility with a character or with the cursor.
The Utility Maintenance selection list will be displayed.
It shows all utilities for which either a default profile or a template has been defined. For each utility, the following information is displayed:
| Field | Explanation |
|---|---|
| Default | Indicates whether a default profile has been defined
for this utility (YES/NO). NO means that only a
template has been defined.
|
| User | Indicates whether any user-specific profiles exist for
this utility (YES/NO).
|
| Library | Indicates whether any library-specific profiles exist
for this utility (YES/NO).
|
| User-Lib. | Indicates whether any user-library-specific profiles
exist for this utility (YES/NO).
|
From the Utility Maintenance selection list, you invoke all functions for the creation, modification, deletion and display of individual utility profiles.
The following functions are available:
| Code | Function |
|---|---|
| DD | Display default profile or template.
This function displays the default profile (or the template) defined for a utility. |
| Functions for user-specific utility profiles: | |
| DU | Display user-specific profiles.
This function displays a list of existing user-specific profiles for a utility. From the list, you can select the profiles to be displayed. |
| AU | Add or maintain user-specific profiles.
This function displays a list of users (of types A, P and G). From the list, you can select the users for which you wish to define user-specific profiles for a utility. |
| MU | Maintain user-specific profiles.
This function displays a list of existing user-specific profiles for a utility. From the list, you can select the profiles to be maintained. |
| Functions for library-specific utility profiles: | |
| DL | Display library-specific profiles.
This function displays a list of existing library-specific profiles for a utility. From the list, you can select the profiles to be displayed. |
| AL | Add or maintain library-specific profiles.
This function displays a list of libraries. From the list, you can select the libraries for which you wish to define library-specific utility profiles. |
| ML | Maintain library-specific profiles.
This function displays a list of existing library-specific profiles for a utility. From the list, you can select the profiles to be maintained. |
| Functions for user-library-specific utility profiles: | |
| DX | Display user-library-specific profiles.
This function displays a list of existing user-library-specific profiles of a specific user for a utility. From the list, you can select the profiles to be displayed. |
| AX | Add or maintain user-library-specific profiles.
This function displays a list of libraries. From the list, you can select the libraries for which you wish to define user-library-specific utility profiles for a specific user. |
| MX | Maintain user-library-specific profiles.
This function displays a list of existing user-library-specific profiles of a specific user for a utility. From the list, you can select the profiles to be maintained. |
The "Add or Maintain" functions (codes
AU, AL, AX) display lists of all
users/libraries, comprising those for which utility profiles exist as well as
those for which no utility profiles have been defined. They allow you to add
new utility profiles as well as modify, delete and display existing utility
profiles.
The "Maintain" functions (codes MU,
ML, MX) display lists of only those users/libraries
for which utilities profiles exist. They allow you to modify, delete and
display existing utility profiles.
You can "switch" directly from "Add or Maintain" to "Maintain" by reducing the displayed list from a list of all users/libraries to a list of only those with existing profiles. To do so, you mark with "X" the selection criterion field "U" (user-specific profile exists) "L" (library-specific profile exists) or "U-L" (user-library-specific profile exists) respectively in the heading of the list.
However, if you know beforehand that you are going to only
maintain existing profiles but not add any new ones, it is recommended (for
better performance) that you directly use codes MU,
ML and MX respectively.
Each of the functions listed displays a list of items (users, libraries, profiles). When you invoke a function, a window will be displayed in which you can enter a start value for the list of items to be displayed.
For functions related to user-library-specific profiles, the ID of the user whose user-library-specific profiles are to be listed must also be specified in the start value window.
When you invoke one of the functions listed, you get a list of items (users, libraries or utility profiles).
On this list, you mark one or more items with a code to invoke a subfunction to be performed on the item.
The available subfunctions (Add, Modify, etc.) differ depending on the function invoked.
For a list of available subfunctions, you enter a question mark (?) in the field Co.
On the selection list of users displayed with function codes
AU, DU and MU, the following information
is displayed for each user:
| Type | Indicates the user type (A, P or G). |
|---|---|
| U | An "X" indicates that the user has a user-specific profile for this utility. |
| U-L | An "X" indicates that the user has one or more user-library-specific profiles for this utility. |
On the selection list of libraries displayed with function codes
AL, DL and ML, the following information
is displayed for each library:
| Prot. | Indicates the "people-protected" and "terminal-protected" settings as defined in the library security profile. |
|---|---|
| Link | (empty) |
| L | An "X" indicates that the library has a library-specific profile for this utility. |
| U | An "X" indicates that the library has one or more user-library-specific profiles for this utility. |
On the selection list of libraries displayed with function codes
AX, DX and MX, the following information
is displayed for each library:
| Prot. | Indicates the "people-protected" and "terminal-protected" settings as defined in the library security profile. |
|---|---|
| Link | Indicates whether the user is linked to the library (LK = normal link, SL = special link). |
| U-L | An "X" indicates that the user has a user-library-specific profile for this library for this utility. |
| L | An "X" indicates that the library has a library-specific profile for this utility. |
A user-specific utility profile can only be defined for a utility for which either a default profile or a template exists.
To add a user-specific utility profile:
Mark the desired utility on the Utility
Maintenance selection list with AU.
A window will be displayed in which you can enter a start value for the list of users to be displayed. Then a list of users (of types A, P and G) will be displayed.
On that list, mark the desired user with AD.
The user-specific profile for the utility will be displayed for you to define.
The options you can allow or disallow within the profile are the same as in the corresponding default profile or template (see Components of Utility Profiles below).
The initial "allowed/disallowed" settings in the user-specific profile are taken from the default profile or the template.
To modify or display a user-specific utility profile:
Mark the desired utility on the Utility
Maintenance selection list with MU or DU
respectively.
A window will be displayed in which you can enter a start value for the list of user-specific profiles to be displayed. Then a list of existing user-specific profiles for the selected utility will be displayed.
On that list, mark the desired profile with MO
(modify) or DU (display) respectively.
The profile will be displayed for modification/display.
The options in the profile are the same as in the corresponding default profile or template (see Components of Utility Profiles below).
To delete a user-specific utility profile:
Mark the desired utility on the Utility
Maintenance selection list with MU.
A window will be displayed in which you can enter a start value for the list of user-specific profiles to be displayed. Then a list of existing user-specific profiles for the selected utility will be displayed.
On that list, mark the desired profile with DE.
A window will be displayed in which you confirm the deletion.
When you delete a user-specific utility profile, all user-library-specific utility profiles for this user for this utility will also be deleted.
A library-specific utility profile can only be defined for a utility for which a default profile (not only a template) has been defined.
To add a library-specific utility profile:
Mark the desired utility on the Utility
Maintenance selection list with AL.
A window will be displayed in which you can enter a start value for the list of libraries to be displayed. Then a list of libraries will be displayed.
On that list, mark the desired library with AD.
The library-specific profile for the utility will be displayed for you to define.
The options you can allow or disallow within the profile are the same as in the corresponding default profile (see Components of Utility Profiles below).
The initial "allowed/disallowed" settings in the library-specific profile are taken from the default profile.
To modify or display a library-specific utility profile:
Mark the desired utility on the Utility
Maintenance selection list with ML or DL
respectively.
A window will be displayed in which you can enter a start value for the list of library-specific profiles to be displayed. Then a list of existing library-specific profiles for the selected utility will be displayed.
On that list, mark the desired profile with MO
(modify) or DL (display) respectively.
The profile will be displayed for modification/display.
The options in the profile are the same as in the corresponding default profile (see Components of Utility Profiles below).
To delete a library-specific utility profile:
Mark the desired utility on the Utility
Maintenance selection list with ML.
A window will be displayed in which you can enter a start value for the list of library-specific profiles to be displayed. Then a list of existing library-specific profiles for the selected utility will be displayed.
On that list, mark the desired profile with DE.
A window will be displayed in which you confirm the deletion.
A user-library-specific utility profile can only be defined for a user for which a user-specific profile for that utility exists.
To add a library-specific utility profile:
Mark the desired utility on the Utility
Maintenance selection list with AX.
A window will be displayed in which you enter the ID of the user for whom a user-library-specific profile is to be defined; also, you can enter a start value for the list of libraries to be displayed. Then a list of libraries will be displayed.
On that list, mark the desired library with AD.
The user-library-specific profile for the specified user for this library will be displayed for you to define.
The options you can allow or disallow within the profile are the same as in the corresponding default profile (see Components of Utility Profiles below).
The initial "allowed/disallowed" settings in the user-library-specific profile are taken from the corresponding library-specific profile; if no such profile exists, they are taken from the corresponding user-specific profile.
To modify or display a library-specific utility profile:
Mark the desired utility on the Utility
Maintenance selection list with MX or DX
respectively.
A window will be displayed in which you enter the ID of the user whose user-library-specific profile(s) are to be listed; also, you can enter a start value for the list of profiles to be displayed. Then a list of existing user-library-specific profiles of the specified user for the selected utility will be displayed.
On that list, mark the desired profile with MO
(modify) or DX (display) respectively.
The profile will be displayed for modification/display.
The options in the profile are the same as in the corresponding default profile (see Components of Utility Profiles below).
To delete a user-library-specific utility profile:
Mark the desired utility on the Utility
Maintenance selection list with MX.
A window will be displayed in which you enter the ID of the user whose user-library-specific profile(s) are to be listed; also, you can enter a start value for the list of profiles to be displayed. Then a list of existing user-library-specific profiles of the specified user for the selected utility will be displayed.
On that list, mark the desired profile with DE.
A window will be displayed in which you confirm the deletion.
A utility profile provides several options which correspond to the functions of the utility concerned. These options are the same in every profile related to that utility: default profile, user-specific, library-specific and user-library-specific profiles.
The individual options are described below for each utility:
The profiles for the PROFILER utility provide several options. Each option corresponds to the PROFILER function of the same name. By allowing/disallowing an option you determine whether the user may use the corresponding function.
The SYSBPM utility is only available with Natural on mainframe computers.
The profiles for the SYSBPM utility provide several options. Each option corresponds to the SYSBPM function/command of the same name. By allowing/disallowing an option you determine whether the user may use the corresponding function/command.
The profiles for the SYSCP utility (Natural Code Page Administration) provide several options. Each option corresponds to the Natural Code Page Administration function of the same name. By allowing/disallowing an option you determine whether the user may use the corresponding function.
The SYSDB2 utility (Natural Tools for DB2) is only available with Natural on mainframe computers.
The profiles for the SYSDB2 utility provide several options. Each option corresponds to the Natural Tools for DB2 function/command of the same name. By allowing/disallowing an option you determine whether the user may use the corresponding function/command.
The SYSDDM utility is only available with Natural on mainframe computers and Linux (on Linux it is called "DDM Services").
The profiles for the SYSDDM utility provide several options. Each option corresponds to the SYSDDM function of the same name. By allowing/disallowing an option you determine whether the user may use the corresponding function.
The profiles for the SYSERR utility provide the following options:
| Option | Explanation |
|---|---|
| Add New Messages | Determine whether the user may use the SYSERR functions of the same names. |
| Delete Messages | |
| Display Messages | |
| Modify Messages | |
| Print Messages | |
| Scan in Messages | |
| Select Messages from a List | |
| Translate Messages into Another Language |
You can allow/disallow these options separately for:
user messages (PF7),
Natural system messages (PF8).
In addition, by pressing PF8 again, you can allow/disallow the use of the following SYSERR direct commands:
| Command | Explanation |
|---|---|
| EXPORT | Possible values for each command:
|
| IMPORT | |
| LAYOUT | |
| NEXT | |
| RESTART | |
| SAMPLE | |
| SHIFT | |
| TRACE | |
| USER |
As the SYSMAIN utility is not identical on all platforms, some SYSMAIN options/functions may not be available on some platforms.
The SYSMAIN utility can be invoked in two ways:
with the command SYSMAIN,
via the application programming interface
MAINUSER.
By default, utility profiles defined for the SYSMAIN utility apply
to both ways. However, it is possible to define a separate set of utility
profiles which control the use of SYSMAIN functions when invoked via
MAINUSER. See MAINUSER
API under Additional Options below for
details.
The profiles for the SYSMAIN utility provide the following options:
| Option | Explanation |
|---|---|
| Programming Objects | This general setting in the first column
of the screen determines whether the user may use SYSMAIN at all for this type
of object.
If this is set to "D" (disallowed), all subordinate function specifications for this object type must also be set to "D". |
| Debug Environments | |
| User Messages | |
| DDMs | |
| Natural Messages | |
| Profiles | |
| Rules | |
| Resources | |
| Predict Sets (on mainframes only) |
In addition, you can allow/disallow the following functions for each object type individually:
| Option | Determines whether the user may use: |
|---|---|
| Co | The SYSMAIN function COPY for this type of object. |
| De | The SYSMAIN function DELETE for this type of object. |
| Fi | The SYSMAIN function FIND for this type of object. |
| Im | The SYSMAIN function IMPORT for this type of object. |
| Li | The SYSMAIN function LIST for this type of object. |
| Mo | The SYSMAIN function MOVE for this type of object. |
| Ren | The SYSMAIN function RENAME for this type of object. |
| Rep | The SYSMAIN function REPLACE for this type of object. |
| FNAT | The SYSMAIN function SET FNAT for this type of object. |
| FSEC | The SYSMAIN function SET FSEC for this type of object. (*) |
| FDIC | The SYSMAIN function SET FDIC for this type of object. (*) |
(*) These options can be set in the default profile and in user-specific profiles, but not in library-specific or user-library-specific profiles.
The profiles for the SYSOBJH utility (Natural Object Handler) provide the following options:
| Option | Explanation |
|---|---|
| Unload | Determine whether the user may use the Object Handler functions of the same names. |
| UnDeLi | |
| Load | |
| Delete | |
| Scan |
In addition, you can allow/disallow the above functions for each object type individually:
| Option | Determines whether the function may be applied to: |
|---|---|
| Nat | Natural programming objects. |
| Err | Error messages. |
| CPr | Command processors. |
| NRe | Natural-related objects. |
| Ext | External objects. |
| FDT | Adabas FDTs. |
| MfD | Mainframe DDMs. |
| MfR | Mainframe-related objects. |
| App | Applications. |
| Further Function-Related Options | |
| Del (*) | This option determines whether the
Object Handler parameter DELETEALLOWED may be specified for the
function.
|
| Par (*) | This option determines whether Object Handler parameters may be specified for the function. |
| Rep | This option determines whether the Object Handler
parameter REPLACE may be specified for the function.
|
(*) These options can only be set in user-specific profiles; their settings in the user-specific profiles also apply to the library-specific and user-library-specific profiles.
Note:
In library-specific and user-library-specific profiles, options
applying to object types which are not library-related cannot be
allowed/disallowed.
Also, the profiles for SYSOBJH provide the following general options:
| Option | Explanation |
|---|---|
| Admin | Determines whether the user may use the "Admin" section of the Object Handler. |
| FSEC | Determines whether the user may specify the Object Handler parameters of the same names. |
| FDIC | |
| Transfer only |
|
In the profiles for SYSOBJH, you can also allow/disallow the following Object Handler direct commands:
| Command | Explanation |
|---|---|
| Navigation Commands: | |
| GO |
Determine whether the user may use the Object Handler direct commands of the same names. |
| - GO HOME | |
| - GO UNLOAD | |
| - GO LOAD | |
| - GO SCAN | |
| - GO RESTART | |
| - GO ADMIN | |
| - GO VIEW | |
| - GO FIND | |
| Configuration Commands: | |
| SET |
Determine whether the user may use the Object Handler direct commands of the same names. |
| - SET TRACE ON | |
| - SET TRACE WORKFILE | |
| - SET TRACEFILE | |
| - SET FREE ON/OFF | |
| - SET EXECUTIONMSG ON/OFF | |
| - SET ADVANCEDCMD ON/OFF | |
| Show Commands: | |
| SHOW |
Determine whether the user may use the Object Handler direct commands of the same names. |
| - SHOW LAST RESULT | |
| - SHOW LAST MESSAGE | |
| - SHOW PROFILE | |
| - SHOW REPORT | |
| - SHOW STATUS | |
| - SHOW TRACE | |
| Other Commands: | |
| CHANGE WORKPLAN LIBRARY |
Determine whether the user may use the Object Handler direct commands of the same names. |
| CLEAR | |
| INIT | |
| READ PROFILE (*) | |
| SETTINGS | |
(*) The use of this command also depends on the user-profile option Profile Maintenance (described in the section User Maintenance).
The SYSPARM utility is only available with Natural on mainframe computers.
The profiles for the SYSPARM utility provide several options. Each option corresponds to the SYSPARM function of the same name. By allowing/disallowing an option you determine whether the user may use the corresponding function.
The SYSPCI utility is only available with Natural on Linux and Windows.
The profiles for the SYSPCI utility provide several options. Each option corresponds to the SYSPCI function of the same name. By allowing/disallowing an option you determine whether the user may use the corresponding function.
The profiles for the SYSRPC utility provide several options. Each option corresponds to the SYSRPC function of the same name. By allowing/disallowing an option you determine whether the user may use the corresponding function.
ZIIP is in fact a Natural system command. Due to its complexity, however, Natural Security handles it like a utility. ZIIP is only available with Natural on mainframe computers.
The utility profiles for ZIIP provide several options. Each option corresponds to the ZIIP function of the same name. By allowing/disallowing an option you determine whether the user may use the corresponding function.
The following Additional Options are part of the default security profiles of all utilities. They can only be set in the default profiles, but not in individual user-specific, library-specific or user-library-specific profiles. For each utility, the Additional Options settings apply to all utility profiles related to that utility.
If you press PF4 on a basic utility default profile screen, a window will be displayed from which you can select the following options:
Maintenance Information
Security Notes
Owners
Session Options
The options for which something has already been specified or defined are marked with a plus sign (+).
You can select one or more items from the window by marking them with any character. For each item selected, an additional window will be displayed:
| Additional Option | Explanation |
|---|---|
| Maintenance Information (display only) | In this window, the following information is
displayed:
|
| Security Notes | In this window, you may enter your notes on the security profile. |
| Owners | In this window, you may enter up to eight IDs of
administrators. Only the administrators specified here will be allowed to
maintain this utility security profile. If no owner is specified, any user of
type "Administrator" may maintain the security profile.
For each owner, the number of co-owners whose countersignatures will be required for maintenance permission may optionally be specified in the field after the ID. For an explanation of owners and co-owners, see the section Countersignatures. |
| Session Options | See below. |
If you mark Session Options in the Additional Options window with any character, the Session Options window will be displayed, where you can set the following options:
| Option | Explanation | |
|---|---|---|
| Access Recorded |
This option determines whether users' access to the utility is to be recorded or not.
|
|
| Privileged Groups |
With this option, you can influence the order in which Natural Security searches for the appropriate utility profile to apply. It determines whether or not utility profiles defined for groups which are specified as Privileged Groups in a user security profile are part of the search order. See the section Which Utility Profile Applies?.
If the option *GROUP Only (see below) is set to "Y", this option must be set to "N". |
|
| *GROUP Only |
With this option, you can influence the order in which Natural Security searches for the appropriate utility profile to apply:
See the section Which Utility Profile Applies? for details. If this option is set to "Y", the option Privileged Groups (see above) must be set to "N". |
|
| MAINUSER API |
This option is only available for the SYSMAIN utility.
It controls the use of SYSMAIN functions invoked via the application
programming interface (API) If you set this option to "Y", a separate entry named MAINUSER will be created on the Define Utility Defaults/Templates screen. With this, you can create a separate set of utility profiles to allow/disallow the use of SYSMAIN functions when invoked via the MAINUSER API. These profiles are independent of the "normal" SYSMAIN utility profiles which control the use SYSMAIN functions when invoked via the SYSMAIN command. The components of the MAINUSER utility profiles are the same as those of the SYSMAIN utility profiles. |
|
| Utilities option |
This option is only available for the utilities SYSMAIN and SYSOBJH. It can be used to apply the Utilities option in library profiles to these utilities.
|
|
| Xref option |
This option is only available for the utilities SYSMAIN on mainframe computers and SYSOBJH. It determines how Predict cross-reference data related to the objects processed with these utilities are handled.
|
|
| Enable Unrestricted Use of Libraries |
This option is only available for the SYSMAIN utility. It can be used to allow users of type Administrator unrestricted use of libraries with SYSMAIN.
|
|
| User-specific SYSMAIN utility profiles only: | ||
| Process All Libraries |
This option can only be set in user-specific SYSMAIN utility profiles of users of type Administrator, and only if the option Enable Unrestricted Use of Libraries (see above) is set to "Y" in the SYSMAIN default profile.
|
|