🚀 go-pugleaf

GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message news:<Xns9352A37E6F15Dgohabsgohotpopdotcom@130.133.1.4>...
> seamonster76@yahoo.com (Andy Lai) wrote in
> news:d2e7d2dd.0304031155.e2ec215@posting.google.com: 
> 
> > GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message
> > news:<Xns93526CE12E65Bgohabsgohotpopdotcom@130.133.1.4>... 
> >> seamonster76@yahoo.com (Andy Lai) wrote in
> >> news:d2e7d2dd.0304021634.2b28c92 
> >> > Do anyone know anything more about the Java SAF Apis? Any help is
> >> > appreciated. 
> >> 
> >> I do have a Java RMI application running on that is used to
> >> authenticate users and groups against our RACF database before
> >> allowing them to run applications. 
> >> 
> >> Do you have a specific question?  Maybe I can help.
> > 
> > What is the relationship between SAF and RACF?
> 
> I can't remember what the acronym SAF stands for, but I think it is used as 
> a generic name for Security Access Facility?  In other words,  it is a 
> specified format that security calls are done to the security product 
> whether it be RACF, CA-TopSecret or CA-ACF2.
> 
> 
> > My application wants to make sure an user has read privilege before
> > reading a file on OS/390 from HFS or USS. And I learned SAF from the
> > IBM OS/390 java support website but I'm not sure how to use them.
>  
> > Can you provide some simple code sample how to check user privileges
> > for file reading/writing?
> 
> There's a pretty good explanation of the java security classes in the 'Java 
> Programming Guide for OS/390' redbook - sc24-5619-00.

Thanks for your reference.


> There's some examples there, even one to check a user's access to a 
> resource:
> 
> PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY", 
> "BPX.SERVER", PlatformAccessLevel.READ);
> 
> Here you're checking the current user - you would first need to do the 
> PlatformUser call with userid/password, so it knows who to check the 
> permission for.  I've not tested this, but that is my understanding of how 
> it would work.  We only use it for authenticating that users have access to 
> a particular application by checking the PlatformUser.isUserInGroup method.  
> The user is not accessing resources on OS/390, but rather on some other 
> unix servers, but the authentication is verified centrally against RACF.
> 
> In the example here, I assume the "FACILITY" is a "resource type" and 
> "BPX.SERVER" would be a "resource name". 
> 
> PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY", 
> "BPX.SERVER", PlatformAccessLevel.READ);
> 
> to check a dataset, I think it would look something like this:
> PlatformReturned pr = PlatformAccessControl.checkPermission("DATASET", 
> "YOUR.SECURED.DATASET.NAME", PlatformAccessLevel.READ);
> 
> * I have not tested the dataset name resource checking - so the literal 
> "DATASET" may or may not be correct.  Try a google search for 
> PlatformAccessControl and see if you find anything!

I tried to google "PlatformAccessControl" but no luck. I also tried
"IBM SAF" or something similar but I could not find the defined string
literals in their documentations.

Currently the mainframe I was accessing is under maintenance, and once
I get my access back, I'll try "DATASET" and let you know.

Thanks,
Andy