EzSM user gets ICH408I (RACF) error accessing temp. data set

Massimo,

So far, my research is not encouraging. I take it this a z/OS 1.9 or later system, and what I'm finding confirms your findings - when TEMPDSN is activated -only- the actual owner will have access - More importantly, apparently you cannot define profiles to TEMPDSN. We will have to dig further into this. We'll update here with our findings...

Dave Yates
EMC TSE3
Benevolent Host S/W & Mainframe Forum Moderator
"Il Moderatore Benevolo"

I've done some more digging and there are very few ways around TEMPDSN.

There are no profiles to define here.
https://www-03.ibm.com/servers/resources/servers_eserver_zseries_zos_racf_pdf_racf_starter_set_mvs_gg243120.pdf#page=65

Because of this, you must either be the data set name owner, or, have operations authority. The only other workaround I have seen for this is to alter the data sets from temporary to a non temp. data set - I found this from another vendor who was working around a similar issue.

Unless the users have operations authority, they will continue to get this error through EzSM while TEMPDSN remains active.

Best regards,
Dave Yates
EMC TSE3
Benevolent Host S/W & Mainframe Forum Moderator
"Il Moderatore Benevolo"

Here are the findings of our EzSM in a RACF TEMPDSN active environment:

First, the knowledgebase entry is here: http://csgateway.emc.com/primus.asp?id=emc223719

Now to the workaround. We replicated this failure and isolated it to the EC0TRANS started task that is spawned from the various functions of the ISPF windows. There are 6 temporary data sets in the started task, SORTIN, SORTOUT, SYSIN, ISPLOG, ISPLIST, ISPPROF.

In order to make this work seamlessly, you will need to change the data sets to non-temporary and still unique data set names keeping in mind that EC0TRANS can spawn several times per hour or user session. How?

One way you can make this work is to use symbolics in the PROC JCL; &YYMMDD + &HHMMSS. If you don't make the data sets unique on SORTIN, SORTOUT & SYSIN, the EC0TRANS spawned subsequent to the first one will wait on data sets. The results will be less desireable with ISPFLOG, ISPFLIST & ISPFPROF. These files in use could lock up the TSO session of the EzSM user.

Here's an example of symbolic use in the EC0TRANS proc:

//*SORTIN DD DISP=(,DELETE),
//SORTIN DD DSN=TECH.EZSM30TR.SORTIN.D&YYMMDD..T&HHMMSS.,
// UNIT=SYSDA,SPACE=(CYL,(50,20)),
// LRECL=2048,RECFM=VB,DSORG=PS
//*SORTOUT DD DISP=(,DELETE),
//SORTOUT DD DSN=TECH.EZSM30TR.SORTOUT.D&YYMMDD..T&HHMMSS.,
// UNIT=SYSDA,SPACE=(CYL,(50,20)),
// LRECL=2048,RECFM=VB,DSORG=PS
//*SYSIN DD DISP=(,DELETE),
//SYSIN DD DSN=TECH.EZSM30TR.SYSIN.D&YYMMDD..T&HHMMSS.,
// UNIT=SYSDA,SPACE=(TRK,(2,2)),
// LRECL=80,RECFM=FB,DSORG=PS

Using the above changes, I was able to use about 85-90 percent of the product functionality. I got errors on the DASD volumes selection because they make use of the ISP... DD statements.

The ISPLOG, ISPLIST, ISPPROF DD statements have a different disposition; (NEW,PASS). If a subsequent EC0TRANS is launched with a permanent, non-unique data set name the task will end with a duplicate data set name / JCL error.

These DD statements need to be changed to something like:

//ISPLIST DD DSN=TECH.EZSM30TR.ISPLIST.D&YYMMDD..T&HHMMSS.,
// DISP=(NEW,DELETE),
// UNIT=SYSDA,SPACE=(CYL,(10,10)),
// DCB=(LRECL=121,RECFM=FBA,BLKSIZE=27951)
//*ISPLOG DD DISP=(NEW,PASS),
//ISPLOG DD DSN=TECH.EZSM30TR.ISPLOG.D&YYMMDD..T&HHMMSS.,
// DISP=(NEW,DELETE),
// UNIT=SYSDA,SPACE=(CYL,(10,10))
//*ISPPROF DD DISP=(NEW,PASS),
//ISPPROF DD DSN=TECH.EZSM30TR.ISPPROF.D&YYMMDD..T&HHMMSS.,
// DISP=(NEW,DELETE),
// UNIT=SYSDA,SPACE=(CYL,(10,10,44)),
// DCB=(LRECL=80,RECFM=FB)

Note: I left the old JCL statements commented out in the above example.

Another way we have conceived of, but not tested is to use Generation Data Groups (GDG) defined for each of the currently temporary data sets. Although they would have to be cataloged they would be self policing.

Best regards,
Dave Yates
EMC TSE3
Benevolent Host S/W & Mainframe Forum Moderator
"Il Moderatore Benevolo"