RACF user attributes
Settings on a RACF user ID that give it special powers, such as managing security or auditing, or limit it, such as being revoked.
Also written SPECIAL, OPERATIONS, AUDITOR, REVOKE, RESUME, PROTECTED, revoked user ID
Most of what a RACF user can do comes from the profiles they are permitted to. Attributes are different. They are set on the user ID itself and give it broad powers or limits.
The powerful ones are SPECIAL, which allows any RACF administration, including creating users and changing any profile; OPERATIONS, which gives wide access to datasets for storage work; and AUDITOR, which allows the user to set what is logged and to read all security settings. These can also be given at group level, which limits them to the group's resources. Auditors check carefully who has them, because few people should.
Other attributes limit a user. REVOKE stops the user from logging on, and RACF can set it automatically after too many wrong passwords. RESUME removes it. PROTECTED means the user ID has no password at all and cannot be used to log on, which is normal for the IDs that started tasks run under.
If you cannot log on and the message says your user ID is revoked, the security team needs to resume it. If you see SPECIAL on your own ID in a training system, treat it with care.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- RACF user IDA person or program's identity on the system. Short, unique, and the basis of every access decision.
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- RACF groupA named collection of users, used to grant access to many people at once rather than one at a time.
- Access levelHow much a user may do to a resource: read it, change it, or control it, with each level including the ones below.
- SAFThe interface z/OS and its subsystems use to ask the security manager whether something is allowed.