The SRTT module must be coded to enable task-level security. When using an external security manager (ESM), this could be done in the following manner:
#SECRTT TYPE=ENTRY, X
RESTYPE=TASK, X
SECBY=EXTERNAL , X
EXTNAME=(RESTYPE,RESNAME), X
EXTCLS='CA@IDMS'
or to give access specifically to one or more tasks (in this case, to ADSA):
#SECRTT TYPE=ENTRY, RESTYPE=TASK, X
SECBY=OFF, X
EXTNAME=(RESTYPE,RESNAME),EXTCLS='CA@IDMS'
with an OCCUR statement for each task:
#SECRTT TYPE=OCCUR,RESTYPE=TASK, X
SECBY=EXTERNAL, X
RESNAME='ADSA'
Using the above examples, the ESM must be configured to grant access for resource name "TASK.task-name" to security group (or role) DEVELOPER, for security class "CA@IDMS", where "task-name" is one of the developer-level tasks listed.
This grant must be repeated for each Task in the list. These rules should then be given to the appropriate users. For instance, in Top Secret:
TSS PER(user_id) CA@IDMS(TASK.ADSA)
In ACF2:
$KEY(TASK.ADSA) TYPE(CA@IDMS)
UID(user_id) ALLOW
In RACF:
PERMIT TASK.ADSA CLASS(CA@IDMS) ID(user_id) ACCESS(READ)
After making the above changes, assemble and link RHDCSRTT to create a new SRTT. To implement the new SRTT, either recycle any CVs that use the SRTT or issue these commands:
DCMT VARY NUCLEUS MODULE RHDCSRTT NEW COPY
DCMT VARY NUCLEUS RELOAD