not able to read a dataset



All about SAF, RACF, encryption, Firewall, Risk assessment and integrity concepts

not able to read a dataset

Postby rahul2825 » Fri May 15, 2009 4:08 pm

iam doing some testing for which i copied a gdg file from prod to test Xmit and the used in Control M string but when i submit the job iam getting in SAR 4038 X code and

02.22.41 JOB04003 CTR103I Vss22090 IOATEST WR0077 - STEP NOT EXECUTED - DUE
02.22.43 JOB04003 ICH408I USER(DA1000 ) GROUP(DrOAP ) NAME(#.BATCH.JOB
203 Sj359.IsR22.SdC.DATA CL(DATASET ) VOL(CSC034)
203 INSUFFICIENT ACCESS AUTHORITY
203 FROM Sj359.** (G)
203 ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )

just two days back i got access on this machine
does it mean i have to ask RACF peolpe to give me Access to submit a job string in Control M.
any suggestions
rahul2825
 
Posts: 12
Joined: Tue Mar 31, 2009 3:40 pm
Has thanked: 0 time
Been thanked: 0 time

Re: not able to read a dataset

 

Re: not able to read a dataset

Postby swd » Fri May 15, 2009 4:59 pm

I'd go along to see the RACF people, it looks like something they will be able to sort out fairly quickly.
User avatar
swd
 
Posts: 109
Joined: Wed Feb 18, 2009 9:18 pm
Location: UK
Has thanked: 0 time
Been thanked: 0 time

Re: not able to read a dataset

Postby rahul2825 » Mon May 18, 2009 5:21 pm

swd wrote:I'd go along to see the RACF people, it looks like something they will be able to sort out fairly quickly.


actually i have copied GDG version from prod to test with my high level qualifier and and put that GDg version in CONTROL-M string by moidfying JCl but when i run the job ,its abending with the below error .

Sj359.IRj22.SbC.DATA CL(DATASET ) VOL(CSC034)
203 INSUFFICIENT ACCESS AUTHORITY
203 FROM Sj359.** (G)
203 ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )

i can edit the input gdg and view but im not able to unnderstand why job is abending.
any suggestions.
rahul2825
 
Posts: 12
Joined: Tue Mar 31, 2009 3:40 pm
Has thanked: 0 time
Been thanked: 0 time

Re: not able to read a dataset

Postby expat » Mon May 18, 2009 5:39 pm

Probably because the uid associated with CONTROL-M does not have access to that dataset.
expat
 
Posts: 382
Joined: Sat Jun 09, 2007 3:21 pm
Has thanked: 0 time
Been thanked: 1 time

Re: not able to read a dataset

Postby jaga123 » Fri Jun 19, 2009 2:28 pm

Yes, you need to approach the RACF administrator to getting the required access. It will be Dataset access or Privilege access.
jaga123
 
Posts: 9
Joined: Thu Aug 21, 2008 2:52 pm
Has thanked: 0 time
Been thanked: 0 time

Re: not able to read a dataset

Postby aquarius » Wed Sep 16, 2009 6:40 pm

You can ask your racf admin guys to look into your USER profile . So that they can see whether you have access to that particular dataset for which you dont have sufficient authority. Also, Control M is just Tool which acts along with the mainframe evironment. The issues is only with your racfid(userid) which needs access to that particular dataset which is currently protected by that dataset owner for some security reason's.
aquarius
 
Posts: 6
Joined: Wed Sep 16, 2009 6:34 pm
Has thanked: 0 time
Been thanked: 0 time

Re: not able to read a dataset

Postby parthiban » Wed Apr 13, 2011 5:32 pm

The user USER(DA1000 ) does not have read access to the dataset profile.kindly contact the RACF admin to get the access.By saying that the id DA1000 required read access to the dataset profile 'Sj359.** ' .

Thanks,
parthi
Parthiban jayaraman
mainframe rexxer,
Banglore
parthiban
 
Posts: 66
Joined: Mon Oct 20, 2008 7:54 pm
Location: Bangalore-India
Has thanked: 0 time
Been thanked: 0 time

Re: not able to read a dataset

Postby steve-myers » Thu Apr 14, 2011 12:19 am

There are three possible RACF / JESx issues when you use a third party (e.g., Control-M) to submit a job for you.
  • Dataset access, which you have already discovered.
  • The userid assigned to the submitted job.
  • The jobname.
Dataset access. You may be able to do something about this.
  • From the TSO READY prompt or ISPF option 6, issue

    LISTDSD DATASET('your-dataset-name') GENERIC

    Part of the output will be INFORMATION FOR DATASET xxxx (G). The xxxx is the actual RACF profile name used to control access to the dataset. If RACF allows you to list the profile, it may allow you to update the profile. You have two ways to allow Control-M to read the datasets controlled by the profile.
    • "Universal" access, to allow anyone (including Control-M) to read the datasets. Use this command.

      ALTDSD DATASET('xxxx') UACC(READ)
    • Allow Control-M to read the datasets. Use this command.

      ALTDSD DATASET('xxxx') ACCESS(READ) ID(the Control-M userid)
The userid assigned to the job. Normally, when you submit a job, it runs under your userid. If you use Control-M to submit a job it will run under Control-M's userid. If you want the job to run under your userid, you have two options.
  • Specify your userid and password in the JOB statement.
    This is not a Good Idea because you're exposing your password to anyone that can read your datasets, and whenever you change your password you will have to update the JOB statement
  • Specify just your userid in the JOB statement.
    If you are going to do this, your RACF support will have to update RACF to allow Control-M to submit the job. This may have already been done, but you should check with your RACF support.
The jobname. If you are going to run the job under your userid it probably is not a problem. If you are going to run the job under Control-M's userid it may be a problem, and you will have to discuss this with your RACF support.
steve-myers
Global moderator
 
Posts: 1886
Joined: Thu Jun 03, 2010 6:21 pm
Has thanked: 4 times
Been thanked: 197 times

Re: not able to read a dataset

Postby steve-myers » Thu Apr 14, 2011 12:23 am

jaga123 wrote:... It will be Dataset access or Privilege access.
There's no such thing as "Privilege access."
steve-myers
Global moderator
 
Posts: 1886
Joined: Thu Jun 03, 2010 6:21 pm
Has thanked: 4 times
Been thanked: 197 times


Return to Mainframe Security

 


  • Related topics
    Replies
    Views
    Last post