🚀 go-pugleaf

seamonster76@yahoo.com (Andy Lai) wrote in message news:<d2e7d2dd.0304021634.2b28c92@posting.google.com>...
> Hello,
> 
> I'm trying the use the SAF interface in order to authenticate a user
> before accessing a resource in Java.
> 
> Here is the SAF information.
> http://www-1.ibm.com/servers/eserver/zseries/software/java/security.html
> 
> In the com.ibm.os390.security package,
> PlatformAccessControl.checkPermission() takes strings of resourceType
> and resourceName. However, I'm not able to find what strings it is
> looking for in google as well as the IBM website or documents.
<snip>

As soon as I saw this I immediately thought of RACF (Resource Access
Control Facility). Talk to the system programmers but appreciate that
they're going to be using an entirely different argot. They're more
used to terms like OS/MVS and VTAM and will likely be unfamiliar with
Java and OOP. Be patient with them...

seamonster76@yahoo.com (Andy Lai) wrote in news:d2e7d2dd.0304021634.2b28c92
> Do anyone know anything more about the Java SAF Apis? Any help is
> appreciated.

I do have a Java RMI application running on that is used to authenticate 
users and groups against our RACF database before allowing them to run 
applications.

Do you have a specific question?  Maybe I can help.

GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message news:<Xns93526CE12E65Bgohabsgohotpopdotcom@130.133.1.4>...
> seamonster76@yahoo.com (Andy Lai) wrote in news:d2e7d2dd.0304021634.2b28c92
> > Do anyone know anything more about the Java SAF Apis? Any help is
> > appreciated.
> 
> I do have a Java RMI application running on that is used to authenticate 
> users and groups against our RACF database before allowing them to run 
> applications.
> 
> Do you have a specific question?  Maybe I can help.

What is the relationship between SAF and RACF?

My application wants to make sure an user has read privilege before
reading a file on OS/390 from HFS or USS. And I learned SAF from the
IBM OS/390 java support website but I'm not sure how to use them.

Can you provide some simple code sample how to check user privileges
for file reading/writing?

Thanks,
Andy

seamonster76@yahoo.com (Andy Lai) wrote in
news:d2e7d2dd.0304031155.e2ec215@posting.google.com: 

> GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message
> news:<Xns93526CE12E65Bgohabsgohotpopdotcom@130.133.1.4>... 
>> seamonster76@yahoo.com (Andy Lai) wrote in
>> news:d2e7d2dd.0304021634.2b28c92 
>> > Do anyone know anything more about the Java SAF Apis? Any help is
>> > appreciated. 
>> 
>> I do have a Java RMI application running on that is used to
>> authenticate users and groups against our RACF database before
>> allowing them to run applications. 
>> 
>> Do you have a specific question?  Maybe I can help.
> 
> What is the relationship between SAF and RACF?

I can't remember what the acronym SAF stands for, but I think it is used as 
a generic name for Security Access Facility?  In other words,  it is a 
specified format that security calls are done to the security product 
whether it be RACF, CA-TopSecret or CA-ACF2.


> My application wants to make sure an user has read privilege before
> reading a file on OS/390 from HFS or USS. And I learned SAF from the
> IBM OS/390 java support website but I'm not sure how to use them.

> Can you provide some simple code sample how to check user privileges
> for file reading/writing?

There's a pretty good explanation of the java security classes in the 'Java 
Programming Guide for OS/390' redbook - sc24-5619-00.

There's some examples there, even one to check a user's access to a 
resource:

PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY", 
"BPX.SERVER", PlatformAccessLevel.READ);

Here you're checking the current user - you would first need to do the 
PlatformUser call with userid/password, so it knows who to check the 
permission for.  I've not tested this, but that is my understanding of how 
it would work.  We only use it for authenticating that users have access to 
a particular application by checking the PlatformUser.isUserInGroup method.  
The user is not accessing resources on OS/390, but rather on some other 
unix servers, but the authentication is verified centrally against RACF.

In the example here, I assume the "FACILITY" is a "resource type" and 
"BPX.SERVER" would be a "resource name". 

PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY", 
"BPX.SERVER", PlatformAccessLevel.READ);

to check a dataset, I think it would look something like this:
PlatformReturned pr = PlatformAccessControl.checkPermission("DATASET", 
"YOUR.SECURED.DATASET.NAME", PlatformAccessLevel.READ);

* I have not tested the dataset name resource checking - so the literal 
"DATASET" may or may not be correct.  Try a google search for 
PlatformAccessControl and see if you find anything!

Good Luck,

Larry



 

GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message news:<Xns9352A37E6F15Dgohabsgohotpopdotcom@130.133.1.4>...
> seamonster76@yahoo.com (Andy Lai) wrote in
> news:d2e7d2dd.0304031155.e2ec215@posting.google.com: 
> 
> > GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message
> > news:<Xns93526CE12E65Bgohabsgohotpopdotcom@130.133.1.4>... 
> >> seamonster76@yahoo.com (Andy Lai) wrote in
> >> news:d2e7d2dd.0304021634.2b28c92 
> >> > Do anyone know anything more about the Java SAF Apis? Any help is
> >> > appreciated. 
> >> 
> >> I do have a Java RMI application running on that is used to
> >> authenticate users and groups against our RACF database before
> >> allowing them to run applications. 
> >> 
> >> Do you have a specific question?  Maybe I can help.
> > 
> > What is the relationship between SAF and RACF?
> 
> I can't remember what the acronym SAF stands for, but I think it is used as 
> a generic name for Security Access Facility?  In other words,  it is a 
> specified format that security calls are done to the security product 
> whether it be RACF, CA-TopSecret or CA-ACF2.
> 
> 
> > My application wants to make sure an user has read privilege before
> > reading a file on OS/390 from HFS or USS. And I learned SAF from the
> > IBM OS/390 java support website but I'm not sure how to use them.
>  
> > Can you provide some simple code sample how to check user privileges
> > for file reading/writing?
> 
> There's a pretty good explanation of the java security classes in the 'Java 
> Programming Guide for OS/390' redbook - sc24-5619-00.

Thanks for your reference.


> There's some examples there, even one to check a user's access to a 
> resource:
> 
> PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY", 
> "BPX.SERVER", PlatformAccessLevel.READ);
> 
> Here you're checking the current user - you would first need to do the 
> PlatformUser call with userid/password, so it knows who to check the 
> permission for.  I've not tested this, but that is my understanding of how 
> it would work.  We only use it for authenticating that users have access to 
> a particular application by checking the PlatformUser.isUserInGroup method.  
> The user is not accessing resources on OS/390, but rather on some other 
> unix servers, but the authentication is verified centrally against RACF.
> 
> In the example here, I assume the "FACILITY" is a "resource type" and 
> "BPX.SERVER" would be a "resource name". 
> 
> PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY", 
> "BPX.SERVER", PlatformAccessLevel.READ);
> 
> to check a dataset, I think it would look something like this:
> PlatformReturned pr = PlatformAccessControl.checkPermission("DATASET", 
> "YOUR.SECURED.DATASET.NAME", PlatformAccessLevel.READ);
> 
> * I have not tested the dataset name resource checking - so the literal 
> "DATASET" may or may not be correct.  Try a google search for 
> PlatformAccessControl and see if you find anything!

I tried to google "PlatformAccessControl" but no luck. I also tried
"IBM SAF" or something similar but I could not find the defined string
literals in their documentations.

Currently the mainframe I was accessing is under maintenance, and once
I get my access back, I'll try "DATASET" and let you know.

Thanks,
Andy

Go to www.ibm.com/ and in the search box enter SAF.  Below is the first
item on the page:

1. z/OS UNIX FAQ: We have an NT Java program that talks to an OS/390 Java
program, and would ...
program, and would like the OS/390 side to verify that this is indeed a
valid user for our system. How do you make SAF calls from Java, and does
anyone know where it's documented? More pages like this
URL: http://www-1.ibm.com/servers/eserver/zseries/zos/unix/fa... 


Andy Lai <seamonster76@yahoo.com> wrote in article
<d2e7d2dd.0304031957.73f1d814@posting.google.com>...
> GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message
news:<Xns9352A37E6F15Dgohabsgohotpopdotcom@130.133.1.4>...
> > seamonster76@yahoo.com (Andy Lai) wrote in
> > news:d2e7d2dd.0304031155.e2ec215@posting.google.com: 
> > 
> > > GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message
> > > news:<Xns93526CE12E65Bgohabsgohotpopdotcom@130.133.1.4>... 
> > >> seamonster76@yahoo.com (Andy Lai) wrote in
> > >> news:d2e7d2dd.0304021634.2b28c92 
> > >> > Do anyone know anything more about the Java SAF Apis? Any help is
> > >> > appreciated. 
> > >> 
> > >> I do have a Java RMI application running on that is used to
> > >> authenticate users and groups against our RACF database before
> > >> allowing them to run applications. 
> > >> 
> > >> Do you have a specific question?  Maybe I can help.
> > > 
> > > What is the relationship between SAF and RACF?
> > 
> > I can't remember what the acronym SAF stands for, but I think it is
used as 
> > a generic name for Security Access Facility?  In other words,  it is a 
> > specified format that security calls are done to the security product 
> > whether it be RACF, CA-TopSecret or CA-ACF2.
> > 
> > 
> > > My application wants to make sure an user has read privilege before
> > > reading a file on OS/390 from HFS or USS. And I learned SAF from the
> > > IBM OS/390 java support website but I'm not sure how to use them.
> >  
> > > Can you provide some simple code sample how to check user privileges
> > > for file reading/writing?
> > 
> > There's a pretty good explanation of the java security classes in the
'Java 
> > Programming Guide for OS/390' redbook - sc24-5619-00.
> 
> Thanks for your reference.
> 
> 
> > There's some examples there, even one to check a user's access to a 
> > resource:
> > 
> > PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY",

> > "BPX.SERVER", PlatformAccessLevel.READ);
> > 
> > Here you're checking the current user - you would first need to do the 
> > PlatformUser call with userid/password, so it knows who to check the 
> > permission for.  I've not tested this, but that is my understanding of
how 
> > it would work.  We only use it for authenticating that users have
access to 
> > a particular application by checking the PlatformUser.isUserInGroup
method.  
> > The user is not accessing resources on OS/390, but rather on some other

> > unix servers, but the authentication is verified centrally against
RACF.
> > 
> > In the example here, I assume the "FACILITY" is a "resource type" and 
> > "BPX.SERVER" would be a "resource name". 
> > 
> > PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY",

> > "BPX.SERVER", PlatformAccessLevel.READ);
> > 
> > to check a dataset, I think it would look something like this:
> > PlatformReturned pr = PlatformAccessControl.checkPermission("DATASET", 
> > "YOUR.SECURED.DATASET.NAME", PlatformAccessLevel.READ);
> > 
> > * I have not tested the dataset name resource checking - so the literal

> > "DATASET" may or may not be correct.  Try a google search for 
> > PlatformAccessControl and see if you find anything!
> 
> I tried to google "PlatformAccessControl" but no luck. I also tried
> "IBM SAF" or something similar but I could not find the defined string
> literals in their documentations.
> 
> Currently the mainframe I was accessing is under maintenance, and once
> I get my access back, I'll try "DATASET" and let you know.
> 
> Thanks,
> Andy
> 

I have already done that and read the document. However, my question
was what are resourceType and resourceName? Apparently the answer is
not in that document, and its reference document (C/C++ Runtime Lib
reference) where was I was reading about _check_resource_auth_np().

I cannot find the answer from other documents returned by the search
either. That's why I'm seeking help here.

Thanks,
Andy

"Charles Hottel" <chottel@cpcug.org> wrote in message news:<01c2fa61$9c1ccca0$1093f243@chottel>...
> Go to www.ibm.com/ and in the search box enter SAF.  Below is the first
> item on the page:
> 
> 1. z/OS UNIX FAQ: We have an NT Java program that talks to an OS/390 Java
> program, and would ...
> program, and would like the OS/390 side to verify that this is indeed a
> valid user for our system. How do you make SAF calls from Java, and does
> anyone know where it's documented? More pages like this
> URL: http://www-1.ibm.com/servers/eserver/zseries/zos/unix/fa... 
> 
> 
> Andy Lai <seamonster76@yahoo.com> wrote in article
> <d2e7d2dd.0304031957.73f1d814@posting.google.com>...
> > GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message
>  news:<Xns9352A37E6F15Dgohabsgohotpopdotcom@130.133.1.4>...
> > > seamonster76@yahoo.com (Andy Lai) wrote in
> > > news:d2e7d2dd.0304031155.e2ec215@posting.google.com: 
> > > 
> > > > GoHabsGo <gohabsgoNOSPAM@hotPOP.com> wrote in message
> > > > news:<Xns93526CE12E65Bgohabsgohotpopdotcom@130.133.1.4>... 
> > > >> seamonster76@yahoo.com (Andy Lai) wrote in
> > > >> news:d2e7d2dd.0304021634.2b28c92 
> > > >> > Do anyone know anything more about the Java SAF Apis? Any help is
> > > >> > appreciated. 
> > > >> 
> > > >> I do have a Java RMI application running on that is used to
> > > >> authenticate users and groups against our RACF database before
> > > >> allowing them to run applications. 
> > > >> 
> > > >> Do you have a specific question?  Maybe I can help.
> > > > 
> > > > What is the relationship between SAF and RACF?
> > > 
> > > I can't remember what the acronym SAF stands for, but I think it is
>  used as 
> > > a generic name for Security Access Facility?  In other words,  it is a 
> > > specified format that security calls are done to the security product 
> > > whether it be RACF, CA-TopSecret or CA-ACF2.
> > > 
> > > 
> > > > My application wants to make sure an user has read privilege before
> > > > reading a file on OS/390 from HFS or USS. And I learned SAF from the
> > > > IBM OS/390 java support website but I'm not sure how to use them.
>  
> > > > Can you provide some simple code sample how to check user privileges
> > > > for file reading/writing?
> > > 
> > > There's a pretty good explanation of the java security classes in the
>  'Java 
> > > Programming Guide for OS/390' redbook - sc24-5619-00.
> > 
> > Thanks for your reference.
> > 
> > 
> > > There's some examples there, even one to check a user's access to a 
> > > resource:
> > > 
> > > PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY",
>  
> > > "BPX.SERVER", PlatformAccessLevel.READ);
> > > 
> > > Here you're checking the current user - you would first need to do the 
> > > PlatformUser call with userid/password, so it knows who to check the 
> > > permission for.  I've not tested this, but that is my understanding of
>  how 
> > > it would work.  We only use it for authenticating that users have
>  access to 
> > > a particular application by checking the PlatformUser.isUserInGroup
>  method.  
> > > The user is not accessing resources on OS/390, but rather on some other
>  
> > > unix servers, but the authentication is verified centrally against
>  RACF.
> > > 
> > > In the example here, I assume the "FACILITY" is a "resource type" and 
> > > "BPX.SERVER" would be a "resource name". 
> > > 
> > > PlatformReturned pr = PlatformAccessControl.checkPermission("FACILITY",
>  
> > > "BPX.SERVER", PlatformAccessLevel.READ);
> > > 
> > > to check a dataset, I think it would look something like this:
> > > PlatformReturned pr = PlatformAccessControl.checkPermission("DATASET", 
> > > "YOUR.SECURED.DATASET.NAME", PlatformAccessLevel.READ);
> > > 
> > > * I have not tested the dataset name resource checking - so the literal
>  
> > > "DATASET" may or may not be correct.  Try a google search for 
> > > PlatformAccessControl and see if you find anything!
> > 
> > I tried to google "PlatformAccessControl" but no luck. I also tried
> > "IBM SAF" or something similar but I could not find the defined string
> > literals in their documentations.
> > 
> > Currently the mainframe I was accessing is under maintenance, and once
> > I get my access back, I'll try "DATASET" and let you know.
> > 
> > Thanks,
> > Andy
> >

If you're sure your Java call is a wrapper to native C library, just read a
little bit about JNI --- Java Native Interface,
you will find C/C++ reference is really useful. There is no need to write
another reference manual for wrappers once you find JNI is a standard
interface mechanism.


Thomas Li
Once a Java Wrapper Writer For Printer Job