The SRTT module must be coded to enable task-level security. When using an external security manager (ESM), this could be done in the following manner:
#SECRTT TYPE=ENTRY, X
RESTYPE=TASK, X
SECBY=EXTERNAL , X
EXTNAME=(RESTYPE,RESNAME), X
EXTCLS='CA@IDMS'
or to give access specifically to one or more tasks (in this case, to ADS):
#SECRTT TYPE=ENTRY, RESTYPE=TASK, X
SECBY=OFF, X
EXTNAME=(RESTYPE,RESNAME),EXTCLS='CA@IDMS'
with an OCCUR statement for each task:
#SECRTT TYPE=OCCUR,RESTYPE=TASK, X
SECBY=EXTERNAL, X
RESNAME='ADS'
Using the above examples, the ESM must be configured to grant access for resource name "TASK.task-name" to security group (or role) USER, for security class "CA@IDMS", where "task-name" is one of the user-level tasks listed. This grant must be repeated for each Task in the list. The appropriate ESM rules must then be given to the appropriate users. For instance, in Top Secret:
TSS PER(user_id) CA@IDMS(TASK.ADS)
In ACF2:
$KEY(TASK.ADS) TYPE(CA@IDMS)
UID(user_id) ALLOW
In RACF:
PERMIT TASK.ADS CLASS(CA@IDMS) ID(user_id) ACCESS(READ)
After making the above changes, assemble and link RHDCSRTT to create a new SRTT. To implement the new SRTT, either recycle any CVs that use the SRTT or issue these commands:
DCMT VARY NUCLEUS MODULE RHDCSRTT NEW COPY
DCMT VARY NUCLEUS RELOAD