STARTED class
The RACF class that decides which user ID each started task runs under.
Also written STARTED, STDATA, started task user ID, ICHRIN03
Started tasks, such as CICS regions, DB2 and system components, are started by an operator command, not by a person logging on. They still need a user ID, because RACF checks everything they access. The STARTED class decides which one.
Each profile in the class is named after the procedure name of a started task, often with a generic pattern. Its STDATA segment names the user ID, and optionally the group, to assign. For example, a profile CICSPROD.* could give every production CICS region the user ID CICSPROD. An older method uses a table called ICHRIN03, which you may still see mentioned.
The user IDs used for started tasks are usually PROTECTED: they have no password and nobody can log on with them. They only exist to give the task an identity.
When a new started task fails with security errors, or runs with far more access than it should, the STARTED class profile is the place to check. Changes to it need a RACLIST refresh before they take effect.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- Started taskA long-running program that the system starts and leaves running, rather than a job that runs once and finishes.
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- General resource profileA RACF profile that protects something other than a dataset, such as a CICS transaction, a program or an operator command.
- RACF user attributesSettings on a RACF user ID that give it special powers, such as managing security or auditing, or limit it, such as being revoked.
- CICS regionOne running copy of CICS, with its own programs, files and users. A site typically runs several.