ALTUSER
Changes an existing user in RACF.
Also written ALU
Why it matters. People forget passwords and people leave. ALTUSER is how you reset one and block the other.
Syntax
{ALTUSER | ALU} userid [PASSWORD(password) [NOEXPIRED] | PHRASE('passphrase')] [REVOKE[(date)] | RESUME[(date)]]
ALTUSER userid [NAME('user-name')] [DFLTGRP(group)] [OWNER(userid | group)] [SPECIAL | NOSPECIAL]- userid
- The user to change. It comes first.
- PASSWORD(pw)
- Set a new password. It is marked expired, so the user must change it at the next sign-on.
- NOEXPIRED
- With PASSWORD: do not mark it expired. The normal password rules then apply.
- REVOKE
- Block the user. With no date it takes effect the next time the user tries to sign on. A date (mm/dd/yy) sets a later start.
- RESUME
- Let a revoked user back in.
- NAME('name')
- Change the name. Users may do this on their own ID.
- DFLTGRP(group)
- Change the default group. Users may do this on their own ID.
- OWNER(id)
- Change who owns the profile.
Try it ALTUSER
- 1
Give ZB0002 a new password, TEMP2.
ALTUSER ZB0002 PASSWORD(TEMP2) - 2
Block ZB0002 from signing on.
ALTUSER ZB0002 REVOKE - 3
Let ZB0002 back in.
ALTUSER ZB0002 RESUME
Remember
- ALTUSER changes a user that already exists.
- PASSWORD resets. REVOKE blocks. RESUME unblocks.
- Success is silent. Check with LISTUSER.
The usual mistake
ALTUSER PASSWORD(TEMP2)
The user ID must come first. Without it, RACF has no idea whose password to change.
ALTUSER ZB0002 PASSWORD(TEMP2)
On real z/OS
MF/OS models PASSWORD, PHRASE, NOEXPIRED, REVOKE, RESUME, NAME, DFLTGRP, OWNER and the main attributes, and lists any operand it ignores. REVOKE and RESUME dates and the segment operands (TSO, OMVS, CICS and so on) are not modelled. Real ALTUSER prints nothing on success, so MF/OS adds a 'Mainframe101 sim:' note.
Where can I practise ALTUSER?
Right here, at ZedBank. You take a junior job at a simulated bank and use ALTUSER in real work, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- RACF user IDA person or program's identity on the system. Short, unique, and the basis of every access decision.
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- TSOTime Sharing Option: the interactive login environment on z/OS, where you get a command prompt and a session of your own.