Converting universal groups to normal Racf group



All about SAF, RACF, encryption, Firewall, Risk assessment and integrity concepts

Converting universal groups to normal Racf group

Postby aarvalar1 » Thu May 23, 2024 10:15 pm

Hi Team,
I have a requirement to delete the universal RACF groups and recreate them as normal group I. Universal attribute
As there are hardly 2000 users in the system. So there is no requirement for universal group.

I have read some posts regarding RACKILL utility so thought of making use of this utility to delete the universal groups and recreate them as this will delete the entry '0100' from RACF flatfile so the user connection and the profile Permissions to the group remain as it is.

Can somet assist if this is the right option to do as I don't find many materials about this utility?
aarvalar1
 
Posts: 11
Joined: Fri Apr 14, 2023 3:12 pm
Has thanked: 2 times
Been thanked: 0 time

Re: Converting universal groups to normal Racf group

Postby Robert Hansel » Sat Jun 01, 2024 5:21 pm

BTDT many times. Do NOT use RACKILL. The safe and proper way to replace a Universal group with a normal group is to REMOVE all the users from the Universal group, DELGROUP the Universal group, ADDGROUP the replace group, and CONNECT the users to the new group with the same connect attributes they had previously. If a Universal group is the default group for any users, you will need to temporarily change the default group for these users to another group before you proceed with replacing the Universal group. Create all your commands in advance so all you have to do is submit batch jobs to perform these actions in short order. We've used the RACF database unload to automate the generation of the commands. I suggest doing this during a system maintenance period when the affected users are not likely to be online. Special handling is required if any of the IDs affected are active Started Tasks to avoid disrupting them.
Regards, Bob

Robert S. Hansel
Lead RACF Specialist
RSH Consulting, Inc.
617-969-8211
www.linkedin.com/in/roberthansel
www.rshconsulting.com
Robert Hansel
 
Posts: 9
Joined: Fri Sep 17, 2010 12:24 am
Has thanked: 0 time
Been thanked: 2 times

Re: Converting universal groups to normal Racf group

Postby aarvalar1 » Mon Jun 10, 2024 4:29 pm

Hi Robert, thanks for the clarification.

In our shop, DB2 security is not administered by RACF.
If I am deleting and recreating the group which is having DB2 permissions attached to it., will that affect the DB2 permission, of the group?
aarvalar1
 
Posts: 11
Joined: Fri Apr 14, 2023 3:12 pm
Has thanked: 2 times
Been thanked: 0 time

Re: Converting universal groups to normal Racf group

Postby Robert Hansel » Mon Jun 10, 2024 6:13 pm

If your RACF groups are DB2 secondary AUTHID groups, then for the brief period when you remove users from the UNIVERSAL group and before you connect them to the new non-UNIVERSAL group, these users will not have the access provided by secondary AUTHID groups. If you schedule this task during a system maintenance period, it is doubtful anyone will be affected. The RACF group delete/recreate process should have no effect on the access of the groups within DB2.

Regards, Bob
Regards, Bob

Robert S. Hansel
Lead RACF Specialist
RSH Consulting, Inc.
617-969-8211
www.linkedin.com/in/roberthansel
www.rshconsulting.com

These users thanked the author Robert Hansel for the post:
aarvalar1 (Tue Jun 11, 2024 6:41 pm)
Robert Hansel
 
Posts: 9
Joined: Fri Sep 17, 2010 12:24 am
Has thanked: 0 time
Been thanked: 2 times


Return to Mainframe Security

 


  • Related topics
    Replies
    Views
    Last post