GDDR: Use RACF Authority for Submitting Started Tasks and Batch Jobs for PROPCNTL and SURROGAT Needs
Summary: Understand the Resource Access Control Facility (RACF) authority requirements for Geographically Dispersed Disaster Restart (GDDR) to submit started tasks and batch jobs, including the use of PROPCNTL and SURROGAT classes for job submission and authorization control. ...
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Instructions
When PROPCNTL is enabled, per the IBM RACF manual all jobs submitted from that address space require a user id and password. Use this for all server type tasks to prevent a user from getting resource authorizations that they were not entitled to.
If a user id is controlled using the PROPCNTL class, and that user wants to submit a batch job to run from that user id, the JOB statement must contain both the user id and the proper password.
For example, if user A submits a job with USER=A, PASSWORD=password must also be specified.
However, if a different user wants to submit a job using the controlled user id, that user can either specify the user id and password as above, or use the facilities provided by the SURROGAT class and specify the user id.
For example, if you controlled user A using the PROPCNTL class, user B could submit a job, specifying only USER=A with the appropriate SURROGAT authorization.
GDDR PRODUCT Functionality:
The intention of the SURROGAT feature in the GDDR context is so that human operators can submit scripts and have those run with a higher authority. This means the operators personal user id does not have to be authorized to issue all the dangerous commands a GDDR script must do. This works with the enforcement of the job name, so that the surrogate user id can only submit jobs with the enforced job name.
When going through the Select script to run panel, an attempt is made to insert the defined surrogate user id on the job card, if ENFORCE is yes.
This automatic insertion is not done when Event Monitor (EVM) submits a batch job. This is a subtask of GDDR and there is no user that asks GDDR to submit the job. There is no requirement to use PROPCNTL in this situation.
Summary:
If a user id is controlled using the PROPCNTL class, and that user wants to submit a batch job to run from that user id, the JOB statement must contain both the user id and the proper password.
For example, if user A submits a job with USER=A, PASSWORD=password must also be specified.
However, if a different user wants to submit a job using the controlled user id, that user can either specify the user id and password as above, or use the facilities provided by the SURROGAT class and specify the user id.
For example, if you controlled user A using the PROPCNTL class, user B could submit a job, specifying only USER=A with the appropriate SURROGAT authorization.
GDDR PRODUCT Functionality:
The intention of the SURROGAT feature in the GDDR context is so that human operators can submit scripts and have those run with a higher authority. This means the operators personal user id does not have to be authorized to issue all the dangerous commands a GDDR script must do. This works with the enforcement of the job name, so that the surrogate user id can only submit jobs with the enforced job name.
When going through the Select script to run panel, an attempt is made to insert the defined surrogate user id on the job card, if ENFORCE is yes.
This automatic insertion is not done when Event Monitor (EVM) submits a batch job. This is a subtask of GDDR and there is no user that asks GDDR to submit the job. There is no requirement to use PROPCNTL in this situation.
Summary:
If your security requires that you control the submission of jobs that can effect your GDDR environment, then use PRODCNTL and SURROGAT. For the EVM address space, all jobs submitted are strictly controlled by GDDR and do not need the addition of PROPCNTL. EVM submits jobs for its own requirements and there is no user control or modification of what is submitted.
Affected Products
Geographically Dispersed Disaster Restart (GDDR)Products
Geographically Dispersed Disaster Restart (GDDR)Article Properties
Article Number: 000011878
Article Type: How To
Last Modified: 25 Jul 2025
Version: 6
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.