# Step 1: Run job IZUNUSEC to create the z/OSMF security authorizations

Last Updated: 2025-01-29

The security job IZUNUSEC contains a minimal set of RACF® commands for creating security profiles for the z/OSMF nucleus. The profiles are used to protect the resources that are used by the z/OSMF server, and to grant users access to the z/OSMF core functions. IZUNUSEC is a simplified version of the sample job IZUSEC, which is intended for a full installation of z/OSMF (the nucleus and core services).

## Before you begin

It is strongly recommended that your security administrator review the contents of the job before running it, and make any changes that are needed to be consistent with your installation's security policies.

In a z/OS ServerPac order, the z/OSMF security profiles are created by the RACFTGT job. Thus, if you received z/OSMF as part of a ServerPac order, and you already ran RACFTGT (or its equivalent), you can skip this step.

If your installation uses an external security manager other than RACF, you must provide equivalent commands for your environment. For more information, see the following Broadcom product documentation:

- [Configure z/OS Management Facility for Top Secret for z/OS](/content/links?url=https%3A%2F%2Fdocops.ca.com%2Fca-top-secret-for-z-os%2F16-0%2Fen%2Finstalling%2Fconfigure-z-os-management-facility-for-ca-top-secret "(Opens in a new tab or window/index.html)").
- [Configure z/OS Management Facility for ACF2](/content/links?url=https%3A%2F%2Ftechdocs.broadcom.com%2Fus%2Fen%2Fca-mainframe-software%2Fsecurity%2Fca-acf2-for-z-os%2F16-0%2Finstalling%2Fconfigure-z-os-management-facility-for-ca-acf2.html "(Opens in a new tab or window/index.html)").

## About this step

The security job IZUNUSEC assigns the user ID IZUSVR to the z/OSMF started tasks, IZUANG1 and IZUSVR1. You can assign different user IDs by using profiles in the RACF STARTED class or by using the RACF Started Procedures Table. For more information about assigning user IDs to started tasks, see [z/OS Security Server RACF Security Administrator's Guide](/content/docs/en/SSLTBW_3.1.0/com.ibm.zos.v3r1.icha700/abstract.htm).

The security job IZUNUSEC also contains sample RACF commands for defining the z/OSMF started procedures to the STARTED class. Figure 1 shows the commands that are provided in the job.

```plaintext-ibm
//* Define the STARTED profiles for the z/OSMF server *
RDEFINE STARTED IZUSVR1.* UACC(NONE) STDATA(USER(IZUSVR) +
GROUP(IZUADMIN) PRIVILEGED(NO) TRUSTED(NO) TRACE(YES))
RDEFINE STARTED IZUANG1.* UACC(NONE) STDATA(USER(IZUSVR) +
GROUP(IZUADMIN) PRIVILEGED(NO) TRUSTED(NO) TRACE(YES))
```

**Notes:**

1. When you use the STARTED class, you can modify the security definitions for started procedures dynamically. For more information, see the topic on using started procedures in [z/OS Security Server RACF Security Administrator's Guide](/content/docs/en/SSLTBW_3.1.0/com.ibm.zos.v3r1.icha700/abstract.htm).
2. If your installation uses hardware cryptography with z/OS® Integrated Cryptographic Service Facility (ICSF), the z/OSMF server uses a number of ICSF callable services, such as CSFRNGL, CSFDSV, CSFOWH, CSFIQF, and others. These services might be protected through profiles that are established in your external security manager. Because z/OSMF uses these services, you must permit the z/OSMF started task user ID to these profiles. For more information, see [Considerations for using ICSF services](/content/docs/en/SSLTBW_3.1.0/com.ibm.zos.v3r1.izua300/izuconfig_CryptoConsiderations.htm#CryptoConsiderations "If your installation uses hardware cryptography with z/OS Integrated Cryptographic Service Facility (ICSF/index.html), the z/OSMF server uses a number of ICSF callable services, such as CSFRNGL, CSFDSV, CSFOWH, CSFIQF, and others. These services might be protected through profiles that are established in your external security manager, such as RACF. Because z/OSMF uses these services, you must permit the z/OSMF started task user ID to these profiles.").
3. Before you submit the job, review the certificate expiration date in the RACDCERT/GENCERT command to ensure that the certificate is not approaching expiration. If the expiration date is less than a year from the current date, set this value to a date that is at least one year after the current date.

## Before running the job

In most cases, you can run the IZUNUSEC security job without modification. To verify that the job is okay to run as is, ask your security administrator to review the job and modify it as necessary for your security environment. If security is not a concern for the host system, you can run the job without modification.

## Running the job

1. Make a copy of job IZUNUSEC from SYS1.SAMPLIB.
2. Review and edit the job, if necessary.
3. Submit IZUNUSEC as a batch job on your z/OS system.
4. Connect your user ID to IZUADMIN group. For a system with RACF as the external security manager, you can use the following command:

```plaintext-ibm
CONNECT userid GROUP(IZUADMIN)
```

Where userid is your user ID.

**Tip:** Job IZUAUTH in SYS1.SAMPLIB includes sample RACF commands for connecting users to the various groups that you might use for z/OSMF: Capacity Provisioning groups (CPOCTRL and CPOQUERY), Workload Management group (WLMGRP), and the z/OSMF user group (IZUUSER) and administrator group (IZUADMIN). To use this job, make a copy of it, then uncomment the commands that you want to use and submit the job.

## Results

Ensure that the IZUNUSEC job completes with return code `0000`.

If the job is run more than once, message IKJ56702I INVALID data is issued for any user IDs or groups that were defined previously. You can ignore this message.

## Common errors

Table 1 shows the most common errors for this step and suggests resolutions.

| Symptom | Cause | Resolution |
| --- | --- | --- |
| Job does not run. | The job issues the following TSO RACF commands: <br>- RACDCERT<br>- RACMAP<br>- RACPRIV<br>- RACLINK<br>However, these commands are not defined to the TSO/E parmlib member IKJTSOxx on your system. | The TSO/E parmlib member IKJTSOxx is used to identify the TSO/E commands and programs the<br>system is to use. Ask the system programmer to check the active IKJTSOxx member for your system to<br>ensure that it includes these RACF command names. <br>To list the values in the active IKJTSOxx<br>parmlib member, you can enter either of the following commands: `DISPLAY IKJTSO` or<br>`PARMLIB LIST`. |
| Message IKJ56702I: INVALID data is issued | The job is submitted more than once. | You can ignore this message. |
| Job fails with an authorization error. | Your user ID lacks superuser authority. | Contact your security admin to run IZUNUSEC. If you are using RACF®, select a user ID with<br>SPECIAL attribute, which can issue all RACF® commands. |
| Job fails with an authorization error. | Your installation uses the RACF PROTECT-ALL option. | If your installation uses PROTECT-ALL, you must define a CEA.* data set profile to RACF and<br>permit CEA and the z/OSMF installer user ID. For example:<br>```plaintext-ibm<br>ADDSD ’CEA.*’ UACC(NONE)<br>PERMIT ’CEA.*’ ID(CEA) ACCESS(ALTER)<br>PERMIT ’CEA.*’ ID(USER-ID) ACCESS(ALTER)<br>```<br>|
| ADDGROUP and ADDUSER commands fail. | The automatic GID and UID assignment is required. | Define SHARED.IDS and BPX.NEXT.USER profiles to enable the use of AUTOUID and<br>AUTOGID. |

Table 1. Common errors when you run job IZUNUSEC to create security.