IBM Mainframe Forum

Dear all,

I have a piece of code that issues a couple commands and captures the output to a PS. So, the exec has "ADDRESS TSO" to allocated and write the ouput to a flat file and "ADDRESS SDSF" to issue the SDSF host commands. I was using this in TSO mode since i had only few commands. Today, I tried to execute it through a batch JCL. I ended up in some errors. when i coded ISFMSG stem variable i found that. I used IKJEFT01 for executing that exec since it has both TSO functions and SDSF functions.

ISF766I Request completed, status: NOT AUTHORIZED FOR CMD.

I searched Red books and landed here http://publibz.boulder.ibm.com/cgi-bin/ ... 3940&CASE=, which speaks about the ISFPARMS. But, everything seems to be proper in my ISFPARMS. Below is the ISFPARMS listing.

GROUP ILPROC(TECH),
ACTION(ALL),
ACTIONBAR(NO),
AUTH(ALL),
CMDAUTH(ALL),CMDLEV(7),
DADFLT(IN,OUT,TRANS,STC,TSU,JOB,READY),
DFIELD2(DAFLDG),
HFIELDS(HFLD1),
DSPAUTH(ALL),
PREFIX(USERID),
ILOGCOL(50),
VIO(VIO)


Can someone advise me where do I go wrong.

Regards,
Viswa

As usual with this sort of query: your SDSF authority may be different between online and batch. As you searched the forum before posting and found this information you went to the group that controls these authorities and they said...?

as explained in the SDSF manuals there are differences in the authorization logic used for batch TSO and interactive TSO

Hi NicC and Enrico,

Thanks for addressing the post. I read the manual and per my understanding, ILPROC is the parm which controls the batch mode sdsf execution for any user. If that is the case I have ILPROC is there in my ISFPARMS which i have posted here before. Could someone please explain or highlight which access will help me in getting the commands executed.


Regards,
Viswa...

Access to those who authorise access.

managing SDSF batch authorization thru ISFPARMS is pretty murky/UNSAFE

from the SDSF manual

When an SDSF batch session is started, it establishes the following values for these criteria:

User ID
Set to the user ID from the ACEE (accessor environment element), provided it contains a valid user ID OR Set to the job name minus the last character.
Logon proc
name Set to BATCH for program name SDSF, and AFD for program name ISFAFD.
Terminal name
Set to BATCH for program name SDSF, and the LU name for program name ISFAFD.
TSOAUTH for
ISFGRP Set to JCL authority.

You will end up giving command authority to everybody

the ONLY way to go is thru SAF and the corresponding RACF logic