This section describes the aspects of the SYSTEM/USERDATAFILE that control the ability of a user to access the system.

The SYSTEM/USERDATAFILE is a database that

Because only usercodes defined in the USERDATAFILE are valid for logging on to the system, the USERDATAFILE is the most basic method of controlling system access.

Refer to the System Software Utilities Operations Reference Manual for a description of the mechanics of assigning access rights and designating values for them.

Some usercode attributes are effective features only if your system includes either the Secure Access Control Module security-enhancement software or one of the Secure Access Control Module security feature packages, as shown in Required Secure Access Control Module Software.

System Access (USERCODE)

The usercode

The first part of every file name is a usercode, which appears in parentheses. When files have no associated usercode, an asterisk (*) appears in place of a usercode in the file name. File ownership is the basis for file access control.

For systems where security is a concern, define for each user only one usercode. Avoid permitting groups of individuals to share the same usercode.

Because the usercode is the primary means of user identification, you might choose, for identification purposes, to have each printer listing labeled with the usercode responsible for the creation of the listing.

The appearance of the usercode, the accesscode, or both on the banner, header, or trailer page of a printer listing is controlled, respectively, by the Print System PS BANNER, PS HEADER, or PS TRAILER command.

Usercode Restrictions

The options listed in Usercode Restriction Options are available to restrict access by certain usercodes.

Usercode Access (PASSWORD)

Assign a secret password to a usercode to restrict access. Only a user who knows the password can log-on to the system by using both the usercode and password.

Passwords

The password associated with a usercode should be one that, given the usercode or information about the user, is not easily guessed. A longer password might be more difficult to guess than a shorter one. You can install a password change library to enforce custom password rules. A standard library is available. Refer to the Security Software Developers Kit (SDK) for more information.

The value of the MAXPW attribute limits the number of passwords that can be associated with a single usercode at one time. On systems where security is a concern, it is advisable to assign only one password to each usercode.

The security option CASESENSITIVEPW determines how a log-on agent (such as MARC or CANDE) handles a password. If the option is reset, passwords not enclosed in quotation marks are converted to uppercase letters before being validated. If the option is set, you can use lowercase characters and special characters in your password without having to enclose the password in quotation marks. Using case-sensitive passwords and passwords containing special characters is more secure than using just uppercase letters and numbers.

Password Attributes describes the password attributes. These recommendations are for usercode centric systems where each user is assigned a unique usercode. If using a shared usercode system where each user is assigned an accesscode, substitute in the accesscode user attributes where applicable.

Multi-Factor Authentication Required (MFAREQUIRED)

If the MFA option of the SECOPT (Security Options) system command is enabled, users might be required to perform two-factor authentication to gain system access.

If the MFAREQUIRED attribute is set and the MFA security option is enabled, two-factor authentication is required. This attribute is used in conjunction with the MFAPROTOCOL attribute.

Multi-Factor Authentication Protocol (MFAPROTOCOL)

The MFAPROTOCOL attribute identifies the method that is used to perform two-factor authentication. The supported protocols are

Multi-Factor Authentication Username (MFAUSERNAME)

If the MFA option of the SECOPT (Security Options) system command is enabled and the MFAREQUIRED attribute is set, two-factor authentication is required.

The MFAUSERNAME attribute functions similarly to the IDENTITY attribute when a request is sent to a device for authentication. For MFA configurations that use Duo Security, the value specified for the MFAUSERNAME attribute is populated on the Duo dashboard, as well information on whether the authentication was successful. These records can help a Duo administrator audit the users that are authenticating using Duo.

If the MFAUSERNAME is not set, the MCP usercode of the authenticating user is used to authenticate the user in the Duo Portal.

Privileged User Access (PU)

Privileged-user status is the most powerful usercode attribute.

To confer privileged-user status, designate PU for the usercode. A privileged usercode can, in general, access any file on the system. Privileged users can also use procedures such as GETSTATUS and SETSTATUS.

A job or task running under a privileged usercode is itself privileged and has the same access rights as the usercode.

It is recommended that you give a usercode privileged-user status only if it is necessary for the user to have that level of file and system access, and the user can be trusted with that level of access.

To provide a usercode with a subset of the capabilities associated with privileged-user status, use the granulated privilege access rights. Detailed information about granulated privilege access rights are provided later in this section.

Some of the access rights of a privileged user are restricted when the system SECADMIN option is TRUE and SECADMIN is designated in the USERDATAFILE for at least one usercode. The following pages describe these restrictions.

System-Enforced Security-Administrator Status

System-enforced security-administrator status denies access to security-sensitive functions to anyone who is not specifically designated as a security administrator in the USERDATAFILE.

System-enforced security-administrator status denies access to security-sensitive functions to anyone who is not specifically designated as a security administrator in the USERDATAFILE.

When this feature is enabled, the following are among the functions that are available only to a security administrator:

For a list of functions that are restricted to the security administrator, see “Security Function Access (SECADMIN)” in Controlling System Access.

Security Function Access (SECADMIN)

The SECADMIN designation used in conjunction with the system primitive command ??SECAD provides greater protection of system functions and files.

If the system SECADMIN option is TRUE,

You can designate SECADMIN for as many usercodes as you choose.

If no usercode has the SECADMIN option specified, any usercode with either the PU or the USERDATA option can create or modify a USERDATAFILE, regardless of the value of the system SECADMIN option.

If only one usercode has the SECADMIN option specified and no usercode has been designated USERDATA in the USERDATAFILE

It is advisable to define more than one usercode with either SECADMIN status or USERDATA privilege so that more than one individual has the ability to alter the USERDATAFILE. However, this status should be given only to those who need to have it and who can be trusted with it.

Granulated Authorization Access

Granulated authorization enables you to provide users with a subset of the privileges associated with privileged users (users with PU and SECADMIN privileges). Although SYSTEMUSER is listed as a granulated privilege, it is not a subset of PU and SECADMIN privileges. This capability enables you to specify a subset of privileges for a user to give the user the necessary privileges to accomplish required tasks and also limit unnecessary access to the system. Granulated authorization introduces the concept of least privilege: specific privileges can be defined for a user without providing that user with the more general capabilities associated with full privileged user status.

Granulated privileges can be specified for both usercodes and code files. However, the Security Identification Facility is required before granulated privileges associated with usercodes can be used.

The following granulated privileges are available.

CHANGE

This privilege enables users to change the titles, including the file ownership, of the disk files of other users. If the new file name is identical to an existing disk file name, the REMOVE privilege is also required.

CHANGESEC

This privilege provides users with the ability to modify the security file attributes of files that belong to other users.

CREATEFILE

This privilege enables users to create disk files under another usercode as long as a file with the same name does not already exist. This privilege does not apply to files created using the WFL CHANGE command or the Library Maintenance copy operation.

EXECUTE

This privilege provides users with the ability to execute the code files of other users.

GETSTATUS

This privilege provides users with the capability to use the GETSTATUS intrinsic to retrieve information about jobs, tasks, the status of peripherals, the status of the operating system and mainframe configuration. However, it does not include those GETSTATUS directory and volume requests where privileged-user status is required.

GSDIRECTORY

This privilege provides users with the capability to see the private directories and filenames of other users. Users also have access to restricted GETSTATUS directory and volume requests that normally require privileged-user status.

IDC

This privilege determines whether a user has the capabilities associated with the IDC attribute. If IDC is set, a user can update the current datacominfo file through DATACOMSUPPORT entrypoints, which are used by the SYSTEM/IDC utility.

LOCALCOPY

This privilege enables users to copy files and directories belonging to other users on the local host using Library Maintenance.

LOGINSTALL

This privilege provides users with the capability to create Installation Log records using the MCSLOGGER intrinsic.

LOGOTHERS

This privilege provides users with the capability to create log records that normally require privileged status using MCSLOGGER. Refer to the System Log Programming Reference Manual for a list of the record types.

PLATFORMACCESS

The PLATFORMACCESS granulated privilege enables you to build and execute image files using the BUILDX compiler, execute an image codefile created by the BUILDX utility, and execute Docker commands using the UTILX utility. User codes with the PLATFORMACCESS granulated privilege assigned must have a corresponding Windows user account for each MCP usercode and have an MCP credentials file to maintain the Windows user account credentials for the Windows system. For more information, see Configuring Windows User Accounts and Associating a Windows User Account with an MCP Usercode in the ClearPath Extension Kit for MCP Getting Started and Best Practices Guide.

PLATFORMADMIN

The PLATFORMADMIN granulated privilege enables you to have additional administrative access to the firmware environment through the use of the RUNX and EPMSUPPORT library command and control interface. Typically, a usercode assigned the PLATFORMADMIN granulated privilege has an MCP credentials file that maps to a Windows user account with administrator privileges.

When a corresponding Windows user account has administrator privileges, the PLATFORMADMIN granulated privilege enables you to manage the Windows environment from the MCP Environment. For example, using the PLATFORMADMIN granulated privilege, you can do the following from the MCP Environment:

On systems that authorize security-administrator status for the system (SECOPT SECADMIN option set to TRUE), an MCP usercode that has the SECADMIN privilege is granted PLATFORMACCESS and PLATFORMADMIN granulated privileges.

On systems that do not authorize security-administrator status for the system (SECOPT SECADMIN option set to FALSE), an MCP usercode with the PU privilege is granted PLATFORMACCESS and PLATFORMADMIN granulated privileges.

READ

This privilege provides users with read access to private files of other users regardless of the security attributes associated with the files.

REMOVE

This privilege enables users to remove files belonging to other users. This privilege can be used with the CREATEFILE, LOCALCOPY, and CHANGE privileges to manipulate existing disk files. A user requires this privilege to perform a close with purge operation on a file that belongs to another user.

SETSTATUS

This privilege provides users with the capability to use the SETSTATUS intrinsic to control MCP, mix, unit, and operational functions. However, it does not include those SETSTATUS directory and volume requests where privileged-user status is required.

SYSTEMUSER

Refer to the System Command Access (SYSTEMUSER) entry in this section for information about SYSTEMUSER privileges.

UNWRAPRESTRICT

This privilege enables users to specify that hazardous files are not marked restricted during an UNWRAP operation.

USERDATA

This privilege provides users with the ability to access the USERDATA intrinsic. A user with this privilege also has logical I/O access to files that have the file attribute SECURITYADMIN set to TRUE.

WRITE

This privilege provides a user with write access to the private files of other users. Access is provided regardless of the security attributes of the files and also includes use of the ERASEFILE and EXCHANGE intrinsics. This privilege also allows modification of nonsecurity-related file attributes.

All of the granulated privileges listed above are assigned to a user with PU privilege with the following exceptions:

System Command Access (SYSTEMUSER)

A user with a usercode designated as a SYSTEMUSER

If the system SECADMIN option is TRUE, some system commands are available only to those with SECADMIN specified for their usercodes.

A user who is not privileged

For example, when a nonprivileged SYSTEMUSER enters the PD (Print Directory) system command, the system displays the names only of files under that user's usercode directory and of public files belonging to other users (when SHOWFILES is designated for those other users).

Because system commands control many fundamental aspects of system operation, only trusted individuals who require the capability should have SYSTEMUSER status.

System Administrator (SYSADMIN)

A user with a usercode designated as a SYSADMIN

A user who is not privileged does not gain any special file-access privileges by being made a SYSADMIN.

Guarded File Access (ACCESSCODELIST)

You use this usercode attribute to associate an accesscode with a usercode.

The accesscode

A user is permitted to log-on under an accesscode only if the accesscode is designated for the usercode in the USERDATAFILE.

Accesscodes also provide additional user identification when the user logs on to the system. The accesscode can have an accesscode password associated with it. If it does, the user must enter the accesscode password along with the accesscode.

In the same way that a usercode password can have password aging attributes, an accesscode, which has a password specified can also have password aging attributes. The following attributes have the same functionality as the corresponding usercode password attributes.

If accesscode password aging is enabled for a usercode, it is enabled for all accesscodes in the ACCESSCODELIST that have passwords specified.

To require a user to enter an accesscode during log-on, specify ACCESSCODENEEDED for the user's usercode in the USERDATAFILE.

Refer to Controlling File Access for a description of how to use accesscodes to define groups of users with common access to certain files.

File Title Access (SHOWFILES)

SHOWFILES does not in any way limit access to a file.

If you designate

As a rule, all sensitive files should be private—that is, their SECURITYTYPE file attribute should be equal to PRIVATE. If this is the case, designating SHOWFILES for a usercode does not result in any breach of security.

CANDE Control Command Access (CANDECONTROL)

This attribute enables the user to access CANDE network control commands. A CANDECONTROL user has access to commands that configure the CANDE data comm network and interrogate that configuration.

When a user designated as CANDECONTROL logs on at a terminal, that terminal becomes a CANDE control station for the time the user is logged on.

Because of the power of some CANDE control commands, it is recommended that only highly trusted individuals be made CANDECONTROL users.

If a usercode is not designated as CANDECONTROL, the user could still possibly access CANDE control commands. For a discussion of the conditions that would permit this situation to occur, see Access Rights Associated with CANDE.

COMS Utility Window Access (COMSCONTROL)

The COMS Utility window enables you to control the users and stations in the Transaction Server system.

Designate COMSCONTROL only for trusted individuals who require the use of the COMS Utility window.

To regulate access to the COMS Utility window, use the LIMITCOMSUTIL option of the SECOPT (Security Options) system command.

If this option is

Refer to Security Configuration for information about the SECOPT command.

Even when COMSCONTROL is designated for a usercode, the COMS Utility window must be included in the window list for the usercode in Transaction Server.

Specify the COMS Utility window either explicitly in the window list or use the ALL window list designation.

The ALL window list designation is the default.

Group Access

The GROUPCODE and SUPPLEMENTARYGRPS USERDATA attributes are used to control access to files. These attributes associate sets of users for the purpose of sharing files and other data objects, such as semaphores, that are defined by POSIX and X/Open standards.

Members of a group share access to files by using the GROUP and SECURITYMODE file attributes. Tasks running under a usercode that is different than the usercode of the owner of the file, can still access the file if the tasks GROUPCODE attribute value, or one of its SUPPLEMENTARYGRPS matches the GROUP attribute value of the file. If a match occurs, the task has all the access rights specified for that group in the SECURITYMODE attribute.

To use groups for file sharing

These attributes are explained in greater detail later in this manual.