XUA: How do I test Safeguard PRIV-LOGON functionality in EXPLAIN mode?

XUA: How do I test Safeguard PRIV-LOGON functionality in EXPLAIN mode?

PRIV-LOGON "what-if" testing may be used if one or more of the following requestors are involved
  • The XYGATEAC object
  • $SYSTEM.SYSTEM.NETBATCH
  • $SYSTEM.ZSSH.SSH2
  • $SYSTEM.ZSSH.STN
  • $SYSTEM.ZSSH.SFTPSERV
  • $SYSTEM.ZSSH.ELP
Any other program requiring PRIV-LOGON to be set to ON can be included on this list. .

Safeguard diskfile ACLs must exist for the above objects, with the PRIV-LOGON bit set to ON.

A UAGROUP containing a REQUESTOR entry will all of the above programs and the keyword SAFEGUARD_PRIVLOGON ON must exist near the top of whatever UAACL file to be used in the testing.

    Example:

     UAGROUP SAFEGUARD-PRIVLOGON
    ! To allow SAFEGUARD-PRIVLOGON in XAC
        DESCRIPTION "Safeguard Privlogon feature"
        FROM_USER $EVERYONE-NET
        TO_USER   $EVERYONE
        REQUESTOR $*.XYGATEAC.XYGATEAC
                                $SYSTEM.SYSTEM.NETBATCH
                                $SYSTEM.ZSSH.SSH2
                                $SYSTEM.ZSSH.STN
                                $SYSTEM.ZSSH.SFTPSERV
                                $SYSTEM.ZSSH.ELP
        SAFEGUARD_PRIVLOGON ON
        AUDIT_ACCESS_PASS   ON
        AUDIT_ACCESS_FAIL   ON

    
4. To do "what-if" testing for PRIV-LOGON in EXPLAIN mode:

     a. Volume to the XYGATEUA installation subvolume

          Example:

          VOLUME $SYSTEM.XYGATEUA


       b. RUN XYGATEUA EXPLAIN <UAACL file name>  <UACONF file name>

           Where <UAACL file name> is the fully-qualified file name of the UAACL file to be used in the testing, e.g. $VTDW1.TERRELLW.UAACL
                       <UACONF file name> is the fully-qualified file name of tHe UACONF file to be used in the testing, e.g. $VTDW1.TERRELLW.UACONF.

      The UAACL and UACONF files used in testing do not have to be the live ones from the XYGATEUA installation.


      c. At the "Access Check" prompt, enter "OPTIONS" (minus the quotes).   A list of testing options will appear.

       d. When the Access Check prompt re-appears, enter "OPTION 02" (without the quotes).  This corresponds to Option 2 on the list, Safeguard Privlogon

       e.  At the Access Check prompt, enter the logon test for PRIV-LOGON that you want to run.  For example, if you wanted to test to see if the correct UAGROUP would be
            selected by requestor Netbatch during a logon by SUPPORT.TERRELLW:

            Example:

            Access check:  LOGON SUPPORT.TERRELLW * * $SYSTEM.SYSTEM.NETBATCH *

Please review Chapter 20: What-if Testing in the XYGATE User Authentication (XUA) manual for more information on how do perform "what-if" testing with XUA.

 If this article did not provide a solution, please open a case with our support team by sending an email message to support@xypro.com.