Contents

Note: Unless otherwise instructed, read all references in this section to CA VM:Secure as CA VM:Secure or CA VM:Director.

The CA VM:Account/CA VM:Secure interface provides three functions. These functions enable you to:

  • Change and validate account numbers dynamically
  • Enforce budget limits
  • Use CA VM:Secure to facilitate CA VM:Account installation

Details on how each function works, any restrictions or requirements that apply, and instructions about how to implement each function are presented in the sections that follow.

Changing and Validating Account Numbers

The first of the CA VM:Account/CA VM:Secure interface functions enables you to change the account number of a virtual machine dynamically and verifies those changes. Account number changes specified by a user take effect immediately and remain in effect until changed again. Changes made by a directory manager take effect at next logon time and remain in effect until changed again. A directory manager can change an account number for another user only when the user is not logged on.

This interface function prevents managers from creating user IDs with account numbers that have not been validated by CA VM:Account.

How the Interface Works

This section describes how account number changes are validated by CA VM:Secure under two scenarios with and without CA VM:Account defined to CA VM:Secure.

CA VM Account Not Defined in the CA VM Secure PRODUCT CONFIG File

CA VM:Secure determines if a user can use a given account number. This is done by checking the *AC= (account number) special comments in the user's directory entry or through the CA VM:Secure ACCOUNT user exit. If the new account number satisfies an account comment or criteria set up in the ACCOUNT exit, the new account number is considered valid by CA VM:Secure and the new account number is updated as requested (next logon, temporary, or immediate). If a *AC= special comment is not found and the ACCOUNT exit is not installed or does not accept the new account number, the new account number is rejected.

CA VM Account Defined in the CA VM Secure PRODUCT CONFIG File

CA VM:Secure passes the new account number to CA VM:Account after determining that the user can use the account number. (This determination is done with the logic described in CA VM:Account Not Defined in the CA VM:Secure PRODUCT CONFIG File, above.) CA VM:Account validates account numbers by checking the project account list on the customer account list. If the account number is found to be invalid, the account number is rejected. CA VM:Account also updates its internal tables by closing the user's accounting information with the old account number and initializing it with the new account number.

The existence of a PRODUCT VMACCOUNT record in the CA VM:Secure PRODUCT CONFIG file causes account number change procedures to be more precise. If someone other than the user is changing the account number, CA VM:Secure checks to see if the user is logged on and prevents the change from being made if the user is.

The process for changing account numbers is summarized below:

  • The user's directory entry file is scanned for any *AC= special comments that indicate which account numbers the user is allowed to use. If a match is found, the new account number is considered valid and the ACCOUNT user exit routine is not called.
  • If the new account number is not found on a *AC= special comment, the ACCOUNT user exit is called to verify the change. If the exit is not installed, or if the exit rejects the change, the new account number is considered invalid and an error condition is generated.
  • If the account number is validated by either a *AC= special comment or the ACCOUNT user exit, then the CA VM:Account interface is processed. If the interface has been implemented, CA VM:Account is called to verify that the new account number is valid and to change the account number in the user's VMDBK with DIAGNOSE X'84'. Subsequent processing of the account number change is determined by the return code received from CA VM:Account as follows:
    • 0
      The change is accepted. The directory entry file is updated and processing is complete.
    • 4
      CA VM:Account is suspended. An error condition is generated and the account number is not updated.
    • 8
      The new account number is invalid because it cannot be mapped back to a customer. The directory is not updated and an error condition is generated.
    • -1
      CA VM:Account is not running but is installed (according to the CA VM:Secure PRODUCT CONFIG file). To prevent invalid account numbers from getting into the directory, CA VM:Secure does not allow account numbers to be set or changed when CA VM:Account is not running.
  • If the CA VM:Account/CA VM:Secure interface has not been implemented, the new account number is updated in the CP directory according to the schedule specified: at the next logon change, immediately, or temporarily.

A user requests an account number change using the CA VM:Secure USER or MAINT ACCOUNT command. A directory manager requests an account number change using the CA VM:Secure MANAGE or MAINT MANAGE command.

Restrictions and Requirements

You must use the CA VM:Secure *AC= special comment, the ACCOUNT user exit, or both to allow account numbers to be assigned or changed.

Implementation

  1. Log on to VMANAGER.
  2. Add a *AC= special comment to the appropriate directory entries or enable the ACCOUNT user exit.
    • The *AC= special comment contains a list of valid account numbers for a user ID. A directory entry can contain one or more *AC= special comments. Add a *AC= special comment to user IDs that need to change their account numbers.
    • The ACCOUNT user exit is used to accept or reject account number changes. VMXEXIT4 is the filename of the prototype ACCOUNT user exit downloaded during installation.
    Note: You do not need both the *AC= special comment and the ACCOUNT user exit. Account number changes are validated by the *AC= special comment or the ACCOUNT user exit. If both exist, the *AC= special comment takes precedence.
  3. Enter the CA VM:Secure CONFIG PRODUCT command.
  4. Make sure that there is a PRODUCT VMACCOUNT VMACCT record in the CA VM:Secure PRODUCT CONFIG file. This configuration file record provides CA VM:Secure with the CA VM:Account service virtual machine user ID. This record activates the CA VM:Secure side of the interface.
  5. Log on to VMACCT.
  6. Enter the END command to shut down VMACCT.
  7. Verify the contents of the VMACCT CONFIG file.
    • If you are interfacing CA VM:Account with CA VM:Secure, make sure there is a PRODUCT VMSECURE vmsecure record present.
    • If you are interfacing CA VM:Account with CA VM:Director, make sure there is a PRODUCT VMDIRECTOR VMDIRECT record present.
    The PRODUCT configuration file record provides CA VM:Account with the CA VM:Secure or CA VM:Director service virtual machine user ID. This record activates the CA VM:Account side of the interface.
  8. Enter the PROFILE command to restart VMACCT.
  9. Enter the #CP DISCONN command to leave VMACCT running disconnected.
  10. If charging by account, make sure the CUSTOMER ACCTLIST file contains a customer-id for all valid account numbers. If charging by project, make sure the PROJECT ACCTLIST file contains a project name for all valid account numbers.

Enforcing Budget Limits

This CA VM:Account/CA VM:Secure interface function uses the CA VM:Account BUDGET user exit to enforce budget limits. The BUDGET user exit can be set up to send a warning message to a user ID that exceeds its budget, log the user ID off, change the user ID's budget limit, or change the user ID's logon password to NOLOG.

How the Interface Works

If the CA VM:Account BUDGET user exit changes the password to NOLOG, the user cannot log on to the user ID. The NOLOG password remains in effect until an authorized user changes it.

With the interface, CA VM:Account calls CA VM:Secure to issue the NOLOG command. When CA VM:Secure executes this command, both the source directory and object directory are updated. Updating the source directory ensures that the NOLOG password remains in effect until an authorized user changes it. If only the object directory is updated, the change is overridden when the source directory is recompiled.

Without the interface, if the option of changing the user's logon password is implemented through the CA VM:Account BUDGET user exit, CA VM:Account changes the user's password to NOLOG only in the object directory.

Restrictions and Requirements

The CA VM:Account BUDGET user exit must be enabled.

Implementation

  1. Log on to VMANAGER.
  2. Enter the CA VM:Secure CONFIG PRODUCT command.
  3. Make sure that there is a PRODUCT VMACCOUNT VMACCT record in the CA VM:Secure PRODUCT CONFIG file. This configuration file record provides CA VM:Secure with the CA VM:Account service virtual machine user ID. This record activates the CA VM:Secure side of the interface.
  4. Log on to VMACCT.
  5. Enter the END command to shut down VMACCT.
  6. Create a BUDGET user exit that meets the requirements of your site and put it on the CA VM:Account 191 minidisk. Sample user exits reside on the product materials VMSES/E sample disk. These samples have filetypes of XASSEMBL and XEXEC.
  7. Make sure there is a USEREXIT BUDGET record in the VMACCT CONFIG file. This configuration file record identifies the user exit to CA VM:Account.
  8. Verify the contents of the VMACCT CONFIG file.
  9. If you are interfacing CA VM:Account with CA VM:Secure: Make sure there is a PRODUCT VMSECURE VMSECURE record present.
  10. If you are interfacing CA VM:Account with CA VM:Director: Make sure there is a PRODUCT VMDIRECTOR VMDIRECT record present.
  11. The PRODUCT configuration file record provides CA VM:Account with the CA VM:Director or CA VM:Secure service virtual machine user ID. This record activates the CA VM:Account side of the interface.
  12. Enter the PROFILE command to restart VMACCT.
  13. Enter the #CP DISCONN command to leave VMACCT running disconnected.

Using CA VM Secure to Facilitate CA VM Account Installation

When installing CA VM:Account, the system administrator user ID (VMANAGER) may run the VMJSCD utility to verify that no user ID contains invalid characters and to create the CUSTOMER ACCTLIST and PROJECTS ACCTLIST files. These files facilitate the mapping between customers (user IDs or groups of user IDs), account numbers, and project names.

Normally, the input to the VMJSCD utility is the CP source directory file. Allowing the system administrator access to this file may cause concern about security. However, if you are using CA VM:Secure, it is not necessary for the system administrator to have a link to the minidisk containing your VM user directory. The CA VM:Secure EXTRACT command creates a condensed source directory file that contains USER, ACCOUNT, ACIGROUP, DEDICATE, and MDISK statements for every user ID with logon passwords masked and minidisk passwords deleted. The resulting condensed source directory can be used as input to the CA VM:Account VMJSCD utility.

Restrictions and Requirements

None.

Implementation

  1. Log on to VMANAGER.
  2. Make sure you have access to the VMJSCD MODULE on the VMACCT 170 minidisk. This minidisk must be accessed to execute Steps 5 and 6 below.
  3. Enter the CA VM:Secure CONFIG AUTHORIZ command.
  4. Make sure there is a GRANT EXTRACT TO VMANAGER record in the CA VM:Secure AUTHORIZ CONFIG file. This configuration file record authorizes VMANAGER to issue the CA VM:Secure EXTRACT command.
  5. Enter the CA VM:Secure EXTRACT command. The resulting file is named EXTRACT DIRECT A. (A nonzero return code indicates that CA VM:Secure is not available.)
  6. Enter this command to run the VMJSCD utility:
    VMJSCD EXTRACT DIRECT A (CUSTOMER
    
  7. A file named CUSTOMER ACCTLIST is written to the VMANAGER A-disk.
  8. If you are setting up project accounting, run the VMJSCD utility by entering this command:
    VMJSCD EXTRACT DIRECT A (PROJECTS
    
  9. A file named PROJECTS ACCTLIST is written to the VMANAGER A-disk.