🚀 go-pugleaf

seamonster76@yahoo.com (Andy Lai) wrote in
news:d2e7d2dd.0304031155.e2ec215@posting.google.com: 

> GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message
> news:<Xns93526CE12E65Bgohabsgohotpopdotcom@130.133.1.4>... 
>> seamonster76@yahoo.com (Andy Lai) wrote in
>> news:d2e7d2dd.0304021634.2b28c92 
>> > Do anyone know anything more about the Java SAF Apis? Any help is
>> > appreciated. 
>> 
>> I do have a Java RMI application running on that is used to
>> authenticate users and groups against our RACF database before
>> allowing them to run applications. 
>> 
>> Do you have a specific question?  Maybe I can help.
> 
> What is the relationship between SAF and RACF?

I can't remember what the acronym SAF stands for, but I think it is used as 
a generic name for Security Access Facility?  In other words,  it is a 
specified format that security calls are done to the security product 
whether it be RACF, CA-TopSecret or CA-ACF2.


> My application wants to make sure an user has read privilege before
> reading a file on OS/390 from HFS or USS. And I learned SAF from the
> IBM OS/390 java support website but I'm not sure how to use them.

> Can you provide some simple code sample how to check user privileges
> for file reading/writing?

There's a pretty good explanation of the java security classes in the 'Java 
Programming Guide for OS/390' redbook - sc24-5619-00.

There's some examples there, even one to check a user's access to a 
resource:

PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY", 
"BPX.SERVER", PlatformAccessLevel.READ);

Here you're checking the current user - you would first need to do the 
PlatformUser call with userid/password, so it knows who to check the 
permission for.  I've not tested this, but that is my understanding of how 
it would work.  We only use it for authenticating that users have access to 
a particular application by checking the PlatformUser.isUserInGroup method.  
The user is not accessing resources on OS/390, but rather on some other 
unix servers, but the authentication is verified centrally against RACF.

In the example here, I assume the "FACILITY" is a "resource type" and 
"BPX.SERVER" would be a "resource name". 

PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY", 
"BPX.SERVER", PlatformAccessLevel.READ);

to check a dataset, I think it would look something like this:
PlatformReturned pr = PlatformAccessControl.checkPermission("DATASET", 
"YOUR.SECURED.DATASET.NAME", PlatformAccessLevel.READ);

* I have not tested the dataset name resource checking - so the literal 
"DATASET" may or may not be correct.  Try a google search for 
PlatformAccessControl and see if you find anything!

Good Luck,

Larry