ACF2
A security manager for z/OS from Broadcom, used by some sites instead of RACF.
Also written CA ACF2, Access Control Facility 2, logonid, ACF2 rules
ACF2 is a security manager for z/OS, now sold by Broadcom. It does the same job as RACF: it decides who can log on and what each person can access. z/OS and its subsystems ask their security questions through SAF, so they work the same way whichever product a site uses.
The way rules are written is different. In ACF2, users are called logonids. Access to datasets is controlled by rules grouped by the first part of the dataset name, and each rule line says which users can read or write which datasets. By default, anything without a rule that allows it is refused.
Most of the ideas are the same as in RACF: users, groups of users, read and update access, logging of failures and careful control of powerful privileges. The commands and words are different.
Sites usually chose their security manager many years ago and rarely change it. If you learn RACF, you will understand what an ACF2 site is trying to do, and you can learn its commands at work.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- SAFThe interface z/OS and its subsystems use to ask the security manager whether something is allowed.
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- Top SecretA security manager for z/OS from Broadcom, used by some sites instead of RACF or ACF2.
- Dataset profileA security rule describing which datasets it covers and who is allowed to do what to them.
- Access levelHow much a user may do to a resource: read it, change it, or control it, with each level including the ones below.