Re: Job Submission exit
From:Roberto Halais roberto.hal...@gmail.com Sorry for the mental check. The exit I wrote is an IEFUJI not a IEFUSI. You can still have qa copy. :-) Tom Russell Internet: tom_russ...@ca.ibm.com Stay calm. Be brave. Wait for the signs. ─ Jasper FriendlyBear ... and remember to leave good news alone. ─ Gracie HeavyHand
Re: Job Submission exit
Using Mark's idea. I have a question. Once the job gets authorized by the exit to proceed what would happen if the operator decides to change the job class. Will the exit reenter again or is there another exit we have to code? Thank you for you replies. On Tue, Aug 24, 2010 at 5:29 PM, Mark Zelden mzel...@flash.net wrote: On Tue, 24 Aug 2010 15:22:20 -0500, Ward, Mike S mw...@ssfcu.org wrote: Hello all, I'm asking for a little help. I would like to keep TSO users from submitting jobs using class P. I am looking through the Jes2 exits, but I'm not sure which one to choose. If someone could point me in the right direction I would appreciate it. Also if anyone has a sample or knows where I can get one it would save reinventing the wheel. I've done it in EXIT 6, but it could be done in EXIT 2 / 52 also. My exit made calls to an installation defined RACF class ($EXIT or some such) to see if the user was authorized to submit in that class. FACILITY could be used also. Not that TSO SUBMIT exit is not a good solution for this as it is very easy to code a sysout to INTRDR, write to it and bypass the submit exit (or allocate INTRDR to your TSO session). Mark -- Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS mailto:mzel...@flash.net Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html Systems Programming expert at http://expertanswercenter.techtarget.com/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- It is no measure of health to be well adjusted to a profoundly sick society. -Krishnamurti I am as you, in you, for you. One as you in all, as all, forever. My call is your call. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
-Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Roberto Halais Sent: Wednesday, August 25, 2010 7:29 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Job Submission exit Using Mark's idea. I have a question. Once the job gets authorized by the exit to proceed what would happen if the operator decides to change the job class. Will the exit reenter again or is there another exit we have to code? Thank you for you replies. No, the exit is not executed again. You will need some other exit to validate the job class change. An interesting question to which I don't know the answer is: What exit is that? If it were me, I'd likely use CA-OPS/MVS to trap the operator command and not allow the operator to change to the restricted job class at all. Or authorized it by RACF id of the operator issuing the command. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
No, the exit will not get called again after conversion of the JCL.But you can protect the ability to change the class via operator commands or products like SDSF with external security (RACF/ACF2/Top Secret). For example, in the OPERCMDS class you would protect JES2.MODIFY.BAT See the JES2 Init and Tuning for more details. Regards, Mark -- Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS mailto:mzel...@flash.net Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html Systems Programming expert at http://expertanswercenter.techtarget.com/ On Wed, 25 Aug 2010 08:28:32 -0400, Roberto Halais roberto.hal...@gmail.com wrote: Using Mark's idea. I have a question. Once the job gets authorized by the exit to proceed what would happen if the operator decides to change the job class. Will the exit reenter again or is there another exit we have to code? Thank you for you replies. On Tue, Aug 24, 2010 at 5:29 PM, Mark Zelden mzel...@flash.net wrote: On Tue, 24 Aug 2010 15:22:20 -0500, Ward, Mike S mw...@ssfcu.org wrote: Hello all, I'm asking for a little help. I would like to keep TSO users from submitting jobs using class P. I am looking through the Jes2 exits, but I'm not sure which one to choose. If someone could point me in the right direction I would appreciate it. Also if anyone has a sample or knows where I can get one it would save reinventing the wheel. I've done it in EXIT 6, but it could be done in EXIT 2 / 52 also. My exit made calls to an installation defined RACF class ($EXIT or some such) to see if the user was authorized to submit in that class. FACILITY could be used also. Not that TSO SUBMIT exit is not a good solution for this as it is very easy to code a sysout to INTRDR, write to it and bypass the submit exit (or allocate INTRDR to your TSO session). Mark -- Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS mailto:mzel...@flash.net Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html Systems Programming expert at http://expertanswercenter.techtarget.com/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
John and Mark: Thank you for your comments. On Wed, Aug 25, 2010 at 9:55 AM, Mark Zelden mzel...@flash.net wrote: No, the exit will not get called again after conversion of the JCL.But you can protect the ability to change the class via operator commands or products like SDSF with external security (RACF/ACF2/Top Secret). For example, in the OPERCMDS class you would protect JES2.MODIFY.BAT See the JES2 Init and Tuning for more details. Regards, Mark -- Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS mailto:mzel...@flash.net Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html Systems Programming expert at http://expertanswercenter.techtarget.com/ On Wed, 25 Aug 2010 08:28:32 -0400, Roberto Halais roberto.hal...@gmail.com wrote: Using Mark's idea. I have a question. Once the job gets authorized by the exit to proceed what would happen if the operator decides to change the job class. Will the exit reenter again or is there another exit we have to code? Thank you for you replies. On Tue, Aug 24, 2010 at 5:29 PM, Mark Zelden mzel...@flash.net wrote: On Tue, 24 Aug 2010 15:22:20 -0500, Ward, Mike S mw...@ssfcu.org wrote: Hello all, I'm asking for a little help. I would like to keep TSO users from submitting jobs using class P. I am looking through the Jes2 exits, but I'm not sure which one to choose. If someone could point me in the right direction I would appreciate it. Also if anyone has a sample or knows where I can get one it would save reinventing the wheel. I've done it in EXIT 6, but it could be done in EXIT 2 / 52 also. My exit made calls to an installation defined RACF class ($EXIT or some such) to see if the user was authorized to submit in that class. FACILITY could be used also. Not that TSO SUBMIT exit is not a good solution for this as it is very easy to code a sysout to INTRDR, write to it and bypass the submit exit (or allocate INTRDR to your TSO session). Mark -- Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS mailto:mzel...@flash.net Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html Systems Programming expert at http://expertanswercenter.techtarget.com/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- It is no measure of health to be well adjusted to a profoundly sick society. -Krishnamurti I am as you, in you, for you. One as you in all, as all, forever. My call is your call. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
In c55ebb8de31be74bb4340979cfea615a05e43...@emo-exmb-m-404.main.ads.uscg.mil, on 08/24/2010 at 03:31 PM, Williamson, James R james.r.william...@uscg.mil said: I believe the TSO submit exit is IKJEFF10, it's not a JES exit. And therefore won't catch TSO applications that write directly to the internal reader instead of going through SUBMIT. -- Shmuel (Seymour J.) Metz, SysProg and JOAT ISO position; see http://patriot.net/~shmuel/resume/brief.html We don't care. We don't have to care, we're Congress. (S877: The Shut up and Eat Your spam act of 2003) -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
-Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Ward, Mike S Sent: Tuesday, August 24, 2010 3:22 PM To: IBM-MAIN@bama.ua.edu Subject: Job Submission exit Hello all, I'm asking for a little help. I would like to keep TSO users from submitting jobs using class P. I am looking through the Jes2 exits, but I'm not sure which one to choose. If someone could point me in the right direction I would appreciate it. Also if anyone has a sample or knows where I can get one it would save reinventing the wheel. Thanks == I believe the TSO submit exit is IKJEFF10, it's not a JES exit. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
James, You can used JES2 exit 2 (I use JES3 but I suspect you'll find an example in HASPSAMP or HASPSRC). You can also use SMF exit IEFUJV (examples in SAMPLIB members IEEUJV and SMFEXITS). Cheers, Alan -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Williamson, James R Sent: Tuesday, August 24, 2010 13:32 To: IBM-MAIN@bama.ua.edu Subject: Re: Job Submission exit -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Ward, Mike S Sent: Tuesday, August 24, 2010 3:22 PM To: IBM-MAIN@bama.ua.edu Subject: Job Submission exit Hello all, I'm asking for a little help. I would like to keep TSO users from submitting jobs using class P. I am looking through the Jes2 exits, but I'm not sure which one to choose. If someone could point me in the right direction I would appreciate it. Also if anyone has a sample or knows where I can get one it would save reinventing the wheel. Thanks == I believe the TSO submit exit is IKJEFF10, it's not a JES exit. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
Sorry Mike. The exit that James mentioned will work fine too, as long as you're only concerned with jobs entering via the TSO SUBmit CP. There are other ways to submit jobs into the system from TSO (e.g. executing a foreground IEBGENER to INTRDR or FTPing to JES). Cheers... -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Ward, Mike S Sent: Tuesday, August 24, 2010 13:22 To: IBM-MAIN@bama.ua.edu Subject: Job Submission exit Hello all, I'm asking for a little help. I would like to keep TSO users from submitting jobs using class P. I am looking through the Jes2 exits, but I'm not sure which one to choose. If someone could point me in the right direction I would appreciate it. Also if anyone has a sample or knows where I can get one it would save reinventing the wheel. Thanks == This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
We use JES2 exit 6 to restrict job classes to selected RACF groups, but is should be pretty easy to just check the origin for TSUn instead. The problem with using the TSO submit exit is that it is easy to bypass by just using any old program to send card images to the INTRDR. /jack - Original Message - From: Ward, Mike S mw...@ssfcu.org Newsgroups: bit.listserv.ibm-main To: IBM-MAIN@bama.ua.edu Sent: Tuesday, August 24, 2010 4:22 PM Subject: Job Submission exit Hello all, I'm asking for a little help. I would like to keep TSO users from submitting jobs using class P. I am looking through the Jes2 exits, but I'm not sure which one to choose. If someone could point me in the right direction I would appreciate it. Also if anyone has a sample or knows where I can get one it would save reinventing the wheel. Thanks == This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
On Tue, 24 Aug 2010 15:22:20 -0500, Ward, Mike S mw...@ssfcu.org wrote: Hello all, I'm asking for a little help. I would like to keep TSO users from submitting jobs using class P. I am looking through the Jes2 exits, but I'm not sure which one to choose. If someone could point me in the right direction I would appreciate it. Also if anyone has a sample or knows where I can get one it would save reinventing the wheel. I've done it in EXIT 6, but it could be done in EXIT 2 / 52 also. My exit made calls to an installation defined RACF class ($EXIT or some such) to see if the user was authorized to submit in that class. FACILITY could be used also. Not that TSO SUBMIT exit is not a good solution for this as it is very easy to code a sysout to INTRDR, write to it and bypass the submit exit (or allocate INTRDR to your TSO session). Mark -- Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS mailto:mzel...@flash.net Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html Systems Programming expert at http://expertanswercenter.techtarget.com/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
I've sent you, via private E-Mail, a copy of the IKJEFF10 exit we used at Board of Trade Clearing Corp. It does job-class enforcement based on userid. Enjoy. :-) Rick --- Ward, Mike S wrote: Hello all, I'm asking for a little help. I would like to keep TSO users from submitting jobs using class P. I am looking through the Jes2 exits, but I'm not sure which one to choose. If someone could point me in the right direction I would appreciate it. Also if anyone has a sample or knows where I can get one it would save reinventing the wheel. Thanks == This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html . -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Job Submission exit
Got it. Right now I'm only interested in the TSO users. All of you thanks for all the feedback and help. -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Starr, Alan Sent: Tuesday, August 24, 2010 4:12 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Job Submission exit Sorry Mike. The exit that James mentioned will work fine too, as long as you're only concerned with jobs entering via the TSO SUBmit CP. There are other ways to submit jobs into the system from TSO (e.g. executing a foreground IEBGENER to INTRDR or FTPing to JES). Cheers... -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Ward, Mike S Sent: Tuesday, August 24, 2010 13:22 To: IBM-MAIN@bama.ua.edu Subject: Job Submission exit Hello all, I'm asking for a little help. I would like to keep TSO users from submitting jobs using class P. I am looking through the Jes2 exits, but I'm not sure which one to choose. If someone could point me in the right direction I would appreciate it. Also if anyone has a sample or knows where I can get one it would save reinventing the wheel. Thanks == This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html == This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
