🚀 go-pugleaf

Go to www.ibm.com/ and in the search box enter SAF.  Below is the first
item on the page:

1. z/OS UNIX FAQ: We have an NT Java program that talks to an OS/390 Java
program, and would ...
program, and would like the OS/390 side to verify that this is indeed a
valid user for our system. How do you make SAF calls from Java, and does
anyone know where it's documented? More pages like this
URL: http://www-1.ibm.com/servers/eserver/zseries/zos/unix/fa... 


Andy Lai <seamonster76@yahoo.com> wrote in article
<d2e7d2dd.0304031957.73f1d814@posting.google.com>...
> GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message
news:<Xns9352A37E6F15Dgohabsgohotpopdotcom@130.133.1.4>...
> > seamonster76@yahoo.com (Andy Lai) wrote in
> > news:d2e7d2dd.0304031155.e2ec215@posting.google.com: 
> > 
> > > GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message
> > > news:<Xns93526CE12E65Bgohabsgohotpopdotcom@130.133.1.4>... 
> > >> seamonster76@yahoo.com (Andy Lai) wrote in
> > >> news:d2e7d2dd.0304021634.2b28c92 
> > >> > Do anyone know anything more about the Java SAF Apis? Any help is
> > >> > appreciated. 
> > >> 
> > >> I do have a Java RMI application running on that is used to
> > >> authenticate users and groups against our RACF database before
> > >> allowing them to run applications. 
> > >> 
> > >> Do you have a specific question?  Maybe I can help.
> > > 
> > > What is the relationship between SAF and RACF?
> > 
> > I can't remember what the acronym SAF stands for, but I think it is
used as 
> > a generic name for Security Access Facility?  In other words,  it is a 
> > specified format that security calls are done to the security product 
> > whether it be RACF, CA-TopSecret or CA-ACF2.
> > 
> > 
> > > My application wants to make sure an user has read privilege before
> > > reading a file on OS/390 from HFS or USS. And I learned SAF from the
> > > IBM OS/390 java support website but I'm not sure how to use them.
> >  
> > > Can you provide some simple code sample how to check user privileges
> > > for file reading/writing?
> > 
> > There's a pretty good explanation of the java security classes in the
'Java 
> > Programming Guide for OS/390' redbook - sc24-5619-00.
> 
> Thanks for your reference.
> 
> 
> > There's some examples there, even one to check a user's access to a 
> > resource:
> > 
> > PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY",

> > "BPX.SERVER", PlatformAccessLevel.READ);
> > 
> > Here you're checking the current user - you would first need to do the 
> > PlatformUser call with userid/password, so it knows who to check the 
> > permission for.  I've not tested this, but that is my understanding of
how 
> > it would work.  We only use it for authenticating that users have
access to 
> > a particular application by checking the PlatformUser.isUserInGroup
method.  
> > The user is not accessing resources on OS/390, but rather on some other

> > unix servers, but the authentication is verified centrally against
RACF.
> > 
> > In the example here, I assume the "FACILITY" is a "resource type" and 
> > "BPX.SERVER" would be a "resource name". 
> > 
> > PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY",

> > "BPX.SERVER", PlatformAccessLevel.READ);
> > 
> > to check a dataset, I think it would look something like this:
> > PlatformReturned pr = PlatformAccessControl.checkPermission("DATASET", 
> > "YOUR.SECURED.DATASET.NAME", PlatformAccessLevel.READ);
> > 
> > * I have not tested the dataset name resource checking - so the literal

> > "DATASET" may or may not be correct.  Try a google search for 
> > PlatformAccessControl and see if you find anything!
> 
> I tried to google "PlatformAccessControl" but no luck. I also tried
> "IBM SAF" or something similar but I could not find the defined string
> literals in their documentations.
> 
> Currently the mainframe I was accessing is under maintenance, and once
> I get my access back, I'll try "DATASET" and let you know.
> 
> Thanks,
> Andy
>