/* REXX */
/* ================================================================ */
/*                                                                  */
/* COPYRIGHT =                                                      */
/* Licensed Material - Property of IBM                              */
/*                                                                  */
/* 5724-I63, 5724-H88, 5655-N01, 5733-W61                           */
/* (C) Copyright IBM Corp. 1999, 2008                               */
/* All Rights Reserved                                              */
/* US Government Users Restricted Rights - Use, duplication or      */
/* disclosure restricted by GSA ADP Schedule Contract with IBM Corp.*/
/*                                                                  */
/* ================================================================ */
<!-- import documents/buildInfo -->
/* ================================================================ */
<!--                                                               -->
<!--  Change History:                                              -->
<!--                                                               -->
<!--  492063 H28W700 20080114   DMB: Remove rexx code step         -->
<!--  512969 V7.0  20080421 PXT: Delete comments in generated jobs -->
<!-- 516348.1 V7.0 20080507 PDOP: Use cell short name of BBOTEMP   -->
<!--511429.1 V7.0   20080519   DMB: Create SR id in bbosbrac       -->
<!--  534716 V7.0   20080708   DMB: Fix asynch admin id issue      -->
<!--  534888 V7.0   20080708  PDOP: Common timestamp and build info-->
<!-- 529307  V7.0  20080722    DMB: Change BBOTEMP to BBOCELL      -->
<!--  540011   V7.0   20080724 DMB: Add adjunct                    -->
<!-- 540011.2  V7.0   20080807 DMB: Fix for adjunct STARTED task   -->
<!--  546577 V7.0  20080903    DMB: Add daemon id                  -->
<!-- PK72390 V7.0  20080918    DMB: Remove unneeded RDEFINE stmts  -->
<!--  556488 V7.0   20081009   DMB: Additional userids not         -->
<!--                                generated properly with AUTOUID-->
<!-- PK83437 V7.0   20090326  DMB:  Reinstate LOGSTRM statement    -->
<!-- PK84830 V7.0	20080422  DMB:  Update keyring-related items   -->
<!--                                to account for long names      -->
<!-- ============================================================= -->

say 'WebSphere Application Server RACF Setup'
say '-- Managed node'
say '-- Config group:' ${zConfigurationGroup}
say '-- Generated on ${ZDATE} at ${ZTIMEL}'
trace commands

/* ---------------------------------------------------------------- */
/* Activates all RACF classes which are needed regardless of        */
/* which WebSphere security scheme is chosen.                       */
/* ---------------------------------------------------------------- */
say 'Activating RACF classes which are needed regardless of security scheme.'
"SETROPTS CLASSACT(SERVER)"
say

"SETROPTS CLASSACT(CBIND)"
say

"SETROPTS RACLIST(SERVER) GENERIC(SERVER)"
say

"SETROPTS CLASSACT(STARTED)"
say

"SETROPTS RACLIST(STARTED) GENERIC(STARTED)"
say

"SETROPTS CLASSACT(FACILITY)"
say

"SETROPTS RACLIST(FACILITY) GENERIC(FACILITY)"
say

"SETROPTS GRPLIST"
say

say 'Allow 10000 concurrently open files.'
"ALU ${zServantUserid} OMVS(FILEPROC(10000))"
say

/* ---------------------------------------------------------------- */
/* Define the userid for the asynch admin task                      */
/* ---------------------------------------------------------------- */
say 'Adding default asynch admin task userid'
<!-- if (${zAdminAsynchTaskUid}token != *token) -->
"ADDUSER ${zAdminAsynchTaskUserid} DFLTGRP(${zConfigurationGroup}) OMVS(UID(${zAdminAsynchTaskUid}) " || ,
"HOME(${zUserIDHomeDirectory}/${zConfigurationGroup}) PROGRAM(/bin/sh)) NAME('WAS Asynch Admin Task') " || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
<!-- if (${zAdminAsynchTaskUid}token == *token) -->
"ADDUSER ${zAdminAsynchTaskUserid} DFLTGRP(${zConfigurationGroup}) OMVS(AUTOUID " || ,
"HOME(${zUserIDHomeDirectory}/${zConfigurationGroup}) PROGRAM(/bin/sh)) NAME('WAS Asynch Admin Task') " || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
say

<!-- if (${zAdjunctUserid}token != token) -->
/* ---------------------------------------------------------------- */
/* (Optional) Define the Adjunct userid                             */
/* ---------------------------------------------------------------- */
say 'Adding WebSphere adjunct user ID'
<!-- if (${zAdjunctUid}token != *token) -->
"ADDUSER ${zAdjunctUserid} DFLTGRP(${zServantGroup}) OMVS(UID(${zAdjunctUid})" || ,
" HOME(${zUserIDHomeDirectory}/${zServantGroup}) PROGRAM(/bin/sh)) NAME('WAS APPSVR ADJUNCT')"  || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
<!-- if (${zAdjunctUid}token == *token) -->
"ADDUSER ${zAdjunctUserid} DFLTGRP(${zServantGroup}) OMVS(AUTOUID" || ,
" HOME(${zUserIDHomeDirectory}/${zServantGroup}) PROGRAM(/bin/sh)) NAME('WAS APPSVR ADJUNCT')"  || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
say
say 'Connecting adjunct to the WebSphere configuration group. '
"CONNECT ${zAdjunctUserid} GROUP(${zConfigurationGroup})"
say

say 'Allow 10000 concurrently open files.'
"ALU ${zAdjunctUserid} OMVS(FILEPROC(10000))"
say
<!-- endif -->

<!-- if (${zDaemonUserid}token != token) -->
/* ---------------------------------------------------------------- */
/* (Optional) Define the Daemon userid                              */
/* ---------------------------------------------------------------- */
say 'Adding WebSphere daemon user ID'
<!-- if (${zDaemonUid}token != *token) -->
"ADDUSER ${zDaemonUserid} DFLTGRP(${zConfigurationGroup}) OMVS(UID(${zDaemonUid})" || ,
" HOME(${zUserIDHomeDirectory}/${zConfigurationGroup}) PROGRAM(/bin/sh)) NAME('WAS DAEMON CR')"  || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
<!-- if (${zDaemonUid}token == *token) -->
"ADDUSER ${zDaemonUserid} DFLTGRP(${zConfigurationGroup}) OMVS(AUTOUID" || ,
" HOME(${zUserIDHomeDirectory}/${zConfigurationGroup}) PROGRAM(/bin/sh)) NAME('WAS DAEMON CR')"  || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
<!-- endif -->

<!-- if (${zErrorLogstreamName}token != token) -->
/* ---------------------------------------------------------------- */
/* LOGSTREAM Set-Up                                                 */
/*                                                                  */
/* ---------------------------------------------------------------- */
/*                                                                  */
/* Set up access authorizations for the log stream:                 */
/*                                                                  */
/* For each server identity (or client identity, if you allow       */
/* clients to write to the error log stream), assign UPDATE         */
/* access to the log stream:                                        */
/*                                                                  */
/* Note: in a production environment, you would likely want the     */
/*       UACC to be NONE.                                           */
/* ---------------------------------------------------------------- */
say 'Defining access authorizations for the log stream.'
"RDEFINE LOGSTRM ${zErrorLogstreamName} UACC(READ)"
say

say 'Permitting WAS configuration group to update log stream.'
"PERMIT ${zErrorLogstreamName} CLASS(LOGSTRM) ID(${zConfigurationGroup}) ACCESS(UPDATE)"
say

"SETROPTS CLASSACT(LOGSTRM)"
/*------------------------------------------------------------------*/
/* For each user who browses the error log stream, assign READ      */
/* access:                                                          */
/*                                                                  */
/*  PERMIT log_stream_name CLASS(LOGSTRM) ID(user_ID) ACCESS(READ)  */
/*                                                                  */
/* ---------------------------------------------------------------- */
<!-- endif -->

/* ---------------------------------------------------------------- */
/* CLASS = SERVER                                                   */
/* PROFILE = CB.<cluster>.<generic server>                          */
/* Used for: determining if a servant region can initialize         */
/* ---------------------------------------------------------------- */
say 'Defining SERVER CB.* '
say 'Used for determining if a servant region can initialize.'

"RDEFINE SERVER CB.*   UACC(NONE)"
say

"SETROPTS RACLIST(SERVER) GENERIC(SERVER) REFRESH"
say

/* ---------------------------------------------------------------- */
/*  AsynchBeans for z/OS, require servants to have access to WLM    */
/*  services.                                                       */
/* ---------------------------------------------------------------- */
say 'Authorize servants to use WLM Services'
"RDEFINE FACILITY (BPX.WLMSERVER) UACC(NONE)"
say

"PERMIT BPX.WLMSERVER ACCESS(READ) ID(${zServantGroup}) CL(FACILITY)"
say

"SETROPTS RACLIST(FACILITY) REFRESH"
say

/* ---------------------------------------------------------------- */
/* Create STARTED task profiles for each runtime server identity    */
/* Define User Identities for the runtime addresses/tasks           */
/* ---------------------------------------------------------------- */
say 'Assigning userids to started tasks. '
say 'Assign async admin ID to started task'
"RDEFINE STARTED ${zAdminAsynchProcName}.* STDATA(USER(${zAdminAsynchTaskUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say

say 'Assign daemon controller ID to started task'
<!-- if (${zDaemonUserid}token == token) -->
"RDEFINE STARTED ${zDaemonProcName}.* STDATA(USER(${zControlUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->
<!-- if (${zDaemonUserid}token != token) -->
"RDEFINE STARTED ${zDaemonProcName}.* STDATA(USER(${zDaemonUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->

say 'Assign AppServer controller ID to started task'
"RDEFINE STARTED ${zControlProcName}.* STDATA(USER(${zControlUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say

"SETROPTS RACLIST(STARTED) GENERIC(STARTED) REFRESH"
say

/* ---------------------------------------------------------------- */
/*       SSL SET-UP                                                 */
/*                                                                  */
/*       This sets up a WAS Test Certificate Authority for use for  */
/*          creating all certificates needed on both client and     */
/*          servers, for test purposes.                              */
/*       See "RACF Security Administrator's Guide" for more         */
/*       information on Digital Certicates.                         */
/* ---------------------------------------------------------------- */

say 'Define permissions to work with certificates'
"RDEFINE FACILITY IRR.DIGTCERT.LIST UACC(NONE)"
say

"RDEFINE FACILITY IRR.DIGTCERT.LISTRING UACC(NONE)"
say

"PERMIT IRR.DIGTCERT.LIST CLASS(FACILITY) ID(${zConfigurationGroup}) ACC(READ)"
say

"PERMIT IRR.DIGTCERT.LISTRING CLASS(FACILITY) ID(${zConfigurationGroup}) ACC(READ)"
say
<!-- if (${zGenerateCaCertificate} == true) -->
say 'Create SSL Certificate Authority certificate'
say 'This will be used to sign client and server certs'

"RACDCERT CERTAUTH GENCERT SUBJECTSDN(CN('WAS CertAuth for Security Domain') " ,
" OU('BBOCELL'))" ,
" WITHLABEL('${zSSLCaKeylabel}')  TRUST " ,
"NOTAFTER(DATE(${zCaAuthorityExpirationDate}))"
say

say 'Facility class refresh '
"SETROPTS RACLIST(FACILITY) REFRESH"
say
<!-- endif -->

/* ---------------------------------------------------------------- */
/*    SSL BASIC SERVER SET-UP                                       */
/* ---------------------------------------------------------------- */
/* RACF set-up for SSL for Servers                                  */
/*  The SSL set-up uses the RACF RACDCERT command to generate and   */
/*  maintain digital certificates in RACF, using the WebSphere Test */
/*  Certificate Authority cert created in BBOSBRAC.                 */
/*  There must be a unique RACF keyring and digital certificate     */
/*  public/private key pair for the identity of each server enabled */
/*  for SSL.                                                        */
/*  The certificate must be unique and owned by the server's id.    */
/*                                                                  */
/*  NOTES: 1. This step is required for ALL SSL based mechanisms,   */
/*            including SSL Basic Auth, Kerberos over SSL,          */
/*            SSL Client Certificates, and Asserted Identity        */
/*        2.  The keyring name here must match the one set in the   */
/*            EUI.                                                  */
/* ---------------------------------------------------------------- */
<!-- if (${zEnableWritableKeyring} == true) -->
say 'Define permissions required for writable keyring support'
  
"SETR CLASSACT(RDATALIB)"
say

"SETR RACLIST(RDATALIB) GENERIC(RDATALIB)"
say
  
"RDEFINE RDATALIB ${zControlUserid}.**.LST UACC(NONE)"
say

"RDEFINE RDATALIB ${zServantUserid}.**.LST UACC(NONE)"
say

"PERMIT ${zControlUserid}.**.LST CLASS(RDATALIB) ID(${zConfigurationGroup}) ACC(READ)"
say

"PERMIT ${zControlUserid}.**.LST CLASS(RDATALIB) ID(${zControlUserid}) ACC(CONTROL)"
say

"PERMIT ${zServantUserid}.**.LST CLASS(RDATALIB) ID(${zControlUserid}) ACC(CONTROL)"
say

"PERMIT ${zServantUserid}.**.LST CLASS(RDATALIB) ID(${zServantUserid}) ACC(CONTROL)"
say 

"RDEFINE RDATALIB ${zControlUserid}.**.UPD UACC(NONE)"
say

"RDEFINE RDATALIB ${zServantUserid}.**.UPD UACC(NONE)"
say

"PERMIT ${zControlUserid}.**.UPD CLASS(RDATALIB) ID(${zControlUserid}) ACC(CONTROL)"
say

"PERMIT ${zServantUserid}.**.UPD CLASS(RDATALIB) ID(${zControlUserid}) ACC(CONTROL)"
say

"RDEFINE RDATALIB ${zAdminUserid}.**.LST UACC(NONE)"
say

"PERMIT ${zAdminUserid}.**.LST CLASS(RDATALIB) ID(${zConfigurationGroup}) ACC(READ)"
say

"PERMIT ${zAdminUserid}.**.LST CLASS(RDATALIB) ID(${zAdminUserid}) ACC(CONTROL)"
say

"RDEFINE RDATALIB ${zAdminUserid}.**.UPD UACC(NONE)"
say

"PERMIT ${zAdminUserid}.**.UPD CLASS(RDATALIB) ID(${zAdminUserid}) ACC(CONTROL)"
say

"SETR RACLIST(RDATALIB) REFRESH"
say
<!-- endif -->

say 'Creating SSL keyrings for WebSphere servers '
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
"ID(${zControlUserid})"
say

"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zServantUserid})"
say

"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName}.Root)" || ,
" ID(${zControlUserid})"
say

"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName}.Signers)" || ,
" ID(${zControlUserid})"
say

say 'Generating certificates for WebSphere servers '
"RACDCERT ID (${zControlUserid}) GENCERT SUBJECTSDN(CN('${hostName}') " || ,
" O('IBM') OU('BBOCELL'))"  ||      ,
" WITHLABEL('DefaultWASCert.BBOCELL')"  || ,
" SIGNWITH(CERTAUTH LABEL('${zSSLCaKeylabel}'))" || ,
" NOTAFTER(DATE(${zCaAuthorityExpirationDate}))"
say

say 'Connecting Server Certificates to their keyrings '
"RACDCERT ID(${zControlUserid}) CONNECT (LABEL('DefaultWASCert.BBOCELL') " || ,
"RING(${zDefaultSAFKeyringName})" || ,
" DEFAULT)"
say

say 'Connect WAS CA Certificates to Servers keyring'
"RACDCERT ID(${zControlUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

"RACDCERT ID(${zServantUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Connect root CA certificates to the root keyrings '
<!-- if (${zEnableWritableKeyring} == true) -->
"RACDCERT ID(${zControlUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName}.Root)" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH USAGE(PERSONAL))"
say

"RACDCERT ID(${zControlUserid}) CONNECT (LABEL('DefaultWASCert.BBOCELL') " || ,
"RING(${zDefaultSAFKeyringName}.Root)" || ,
" DEFAULT)"
say
<!-- endif -->

<!-- if (${zEnableWritableKeyring} == false) -->
"RACDCERT ID(${zControlUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName}.Root)" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say
<!-- endif -->

say 'Connect Commercial CAs to Servers keyring'
"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say

<!-- if (${zAdjunctUserid}token != token) -->
say 'Create WebSphere adjunct keyring'
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zAdjunctUserid})"
say

say 'Connect WAS CA Certificate to adjunct keyring'
"RACDCERT ID(${zAdjunctUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Connect Commercial CAs to adjunct keyring'
"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say
<!-- endif -->

say 'Creating SSL keyring for WebSphere asynch administrator '
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zAdminAsynchTaskUserid})"
say

say 'Connect WAS CA Certificates to Servers keyring'
"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say
 
say 'Connect Commercial CAs to Servers keyring'
"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say


say 'Connect default signers to the default signers keyring '

"RACDCERT ID(${zControlUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName}.Signers)" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Facility class refresh '
"SETROPTS RACLIST(FACILITY) REFRESH"
say