/* REXX */
/* ================================================================ */
/*                                                                  */
/* COPYRIGHT =                                                      */
/* Licensed Material - Property of IBM                              */
/*                                                                  */
/* 5724-I63, 5724-H88, 5655-N01, 5733-W61                           */
/* (C) Copyright IBM Corp. 1999, 2008                               */
/* All Rights Reserved                                              */
/* US Government Users Restricted Rights - Use, duplication or      */
/* disclosure restricted by GSA ADP Schedule Contract with IBM Corp.*/
/*                                                                  */
/* ================================================================ */
<!-- import documents/buildInfo -->
/* ================================================================ */
<!--                                                               -->
<!--  Change History:                                              -->
<!--                                                               -->
<!--  492063 H28W700 20080114   DMB: Remove rexx code step         -->
<!--  504748 H28W700 20080321   DMB: Add auditor role              -->
<!--  512969 V7.0  20080421 PXT: Delete comments in generated jobs -->
<!--  511429 V7.0   20080519    DMB: Create admin id in bbosbrac   -->
<!--  528190 V7.0  20080610 DMB: Change security domain property   -->
<!--511429.1 V7.0   20080519   DMB: Create SR id in bbosbrac       -->
<!--  534716 V7.0   20080708   DMB: Fix asynch admin id issue      -->
<!--  510892 V7.0   20080714   DMB: Remove redundant RACF SSL setup-->
<!--  534888 V7.0   20080708  PDOP: Common tstamps and build info  -->
<!--  540011   V7.0   20080724 DMB: Add adjunct and daemon id      -->
<!-- 540011.2  V7.0   20080807 DMB: Fix for adjunct STARTED task   -->
<!--  556488 V7.0   20081009   DMB: Additional userids not         -->
<!--                                generated properly with AUTOUID-->
<!--  560971.1 V7.0 20081029   DMB: Issue RACLIST for EJBROLE      -->
<!-- PK83437 V7.0   20090326  DMB:  Reinstate LOGSTRM statement    -->
<!-- PK84830 V7.0	20080422  DMB:  Update keyring-related items   -->
<!--                                to account for long names      -->
<!-- PK87449 V7.0   20090701  DMB:  Issue CLASSACT for CBIND       -->
<!--                                regardless of security type    -->
<!-- F908-14696 V8.0 20090831 DMB: Generic RACF profiles support   -->
<!-- F908-28453 V8.0 20100915 PDOP: Update default certificate size-->
<!-- 680833     V8.0 20101203 PDOP: Reinstate missing RACF stmts   -->
<!-- 685273     V8.0 20110121 PDOP: Del universal APPL read access -->
<!-- 688286     V8.0 20110129 PDOP: Add SCA EJBROLE                -->
<!-- PM28401    V7.0 20110203 PDOP: Only create 1 cert for control -->
<!--                                region user ID                 -->
<!-- PM61388    V7.0 20120629 PDOP: CBIND for WebSphere security   -->  
<!-- PM76682    V7.0 20130109 PDOP: Add iscadmins EJBROLE          -->  
<!-- ==============================================================-->

say 'WebSphere Application Server RACF Setup'
say '-- Stand-alone AppServer'
<!-- if (${zCellIdentifier}token != token) -->
say '-- Cell identifier:' ${zCellIdentifier}
<!-- endif -->
say '-- Cell name:' ${zCellShortName}
say '-- Server name:' ${zServerShortName}
say '-- Config group:' ${zConfigurationGroup}
say '-- Generated on ${ZDATE} at ${ZTIMEL}'

/* ---------------------------------------------------------------- */
/* Determines RACF certificate size.                                */
/* ---------------------------------------------------------------- */
certsize = "2048"
if syscalls('ON')<4 then
   do
   address syscall 'uname uts.'
   say '-- Machine: ' uts.U_MACHINE
   if uts.U_MACHINE < "2084" then certsize = "1024"
   call syscalls('OFF')
   end
else say 'Unable to establish the SYSCALL environment'
say '-- Certificate size: ' certsize
trace commands

/* ---------------------------------------------------------------- */
/* Activates all RACF classes which are needed regardless of        */
/* which WebSphere security scheme is chosen.                       */
/* ---------------------------------------------------------------- */
say 'Activating RACF classes which are needed regardless of security scheme.'
"SETROPTS CLASSACT(SERVER)"
say

"SETROPTS RACLIST(SERVER) GENERIC(SERVER)"
say

"SETROPTS CLASSACT(STARTED)"
say

"SETROPTS RACLIST(STARTED) GENERIC(STARTED)"
say

"SETROPTS CLASSACT(FACILITY)"
say

"SETROPTS RACLIST(FACILITY) GENERIC(FACILITY)"
say

"SETROPTS GRPLIST"
say

/* ---------------------------------------------------------------- */
/* Define the userid for the asynch admin task                      */
/* ---------------------------------------------------------------- */
say 'Adding default asynch admin task userid'
<!-- if (${zAdminAsynchTaskUid}token != *token) -->
"ADDUSER ${zAdminAsynchTaskUserid} DFLTGRP(${zConfigurationGroup}) OMVS(UID(${zAdminAsynchTaskUid}) " || ,
"HOME(${zUserIDHomeDirectory}/${zConfigurationGroup}) PROGRAM(/bin/sh)) NAME('WAS Asynch Admin Task') " || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
<!-- if (${zAdminAsynchTaskUid}token == *token) -->
"ADDUSER ${zAdminAsynchTaskUserid} DFLTGRP(${zConfigurationGroup}) OMVS(AUTOUID " || ,
"HOME(${zUserIDHomeDirectory}/${zConfigurationGroup}) PROGRAM(/bin/sh)) NAME('WAS Asynch Admin Task') " || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
say


<!-- if (${zAdjunctUserid}token != token) -->
/* ---------------------------------------------------------------- */
/* (Optional) Define the Adjunct userid                             */
/* ---------------------------------------------------------------- */
say 'Adding WebSphere adjunct user ID'
<!-- if (${zAdjunctUid}token != *token) -->
"ADDUSER ${zAdjunctUserid} DFLTGRP(${zServantGroup}) OMVS(UID(${zAdjunctUid})" || ,
" HOME(${zUserIDHomeDirectory}/${zServantGroup}) PROGRAM(/bin/sh)) NAME('WAS APPSVR ADJUNCT')"  || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
<!-- if (${zAdjunctUid}token == *token) -->
"ADDUSER ${zAdjunctUserid} DFLTGRP(${zServantGroup}) OMVS(AUTOUID" || ,
" HOME(${zUserIDHomeDirectory}/${zServantGroup}) PROGRAM(/bin/sh)) NAME('WAS APPSVR ADJUNCT')"  || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
say
say 'Connecting adjunct to the WebSphere configuration group. '
"CONNECT ${zAdjunctUserid} GROUP(${zConfigurationGroup})"
say

say 'Allow 10000 concurrently open files.'
"ALU ${zAdjunctUserid} OMVS(FILEPROC(10000))"
say
<!-- endif -->

<!-- if (${zDaemonUserid}token != token) -->
/* ---------------------------------------------------------------- */
/* (Optional) Define the Daemon userid                              */
/* ---------------------------------------------------------------- */
say 'Adding WebSphere daemon user ID'
<!-- if (${zDaemonUid}token != *token) -->
"ADDUSER ${zDaemonUserid} DFLTGRP(${zConfigurationGroup}) OMVS(UID(${zDaemonUid})" || ,
" HOME(${zUserIDHomeDirectory}/${zConfigurationGroup}) PROGRAM(/bin/sh)) NAME('WAS DAEMON CR')"  || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
<!-- if (${zDaemonUid}token == *token) -->
"ADDUSER ${zDaemonUserid} DFLTGRP(${zConfigurationGroup}) OMVS(AUTOUID" || ,
" HOME(${zUserIDHomeDirectory}/${zConfigurationGroup}) PROGRAM(/bin/sh)) NAME('WAS DAEMON CR')"  || ,
" NOPASSWORD NOOIDCARD"
<!-- endif -->
<!-- endif -->

<!-- if (${zErrorLogstreamName}token != token) -->
/* ---------------------------------------------------------------- */
/* LOGSTREAM Set-Up                                                 */
/*                                                                  */
/* ---------------------------------------------------------------- */
/*                                                                  */
/* Set up access authorizations for the log stream:                 */
/*                                                                  */
/* For each server identity (or client identity, if you allow       */
/* clients to write to the error log stream), assign UPDATE         */
/* access to the log stream:                                        */
/*                                                                  */
/* Note: in a production environment, you would likely want the     */
/*       UACC to be NONE.                                           */
/* ---------------------------------------------------------------- */
say 'Defining access authorizations for the log stream.'
"RDEFINE LOGSTRM ${zErrorLogstreamName} UACC(READ)"
say

say 'Permitting WAS configuration group to update log stream.'
"PERMIT ${zErrorLogstreamName} CLASS(LOGSTRM) ID(${zConfigurationGroup}) ACCESS(UPDATE)"
say

"SETROPTS CLASSACT(LOGSTRM)"
/*------------------------------------------------------------------*/
/* For each user who browses the error log stream, assign READ      */
/* access:                                                          */
/*                                                                  */
/*  PERMIT log_stream_name CLASS(LOGSTRM) ID(user_ID) ACCESS(READ)  */
/*                                                                  */
/* ---------------------------------------------------------------- */
<!-- endif -->

<!-- if (${zCellIdentifier}token != token) --> 
/* ---------------------------------------------------------------- */
/* CLASS = SERVER                                                   */
/* PROFILE = CB.*.<cell_identifier>*.*                              */
/* Used for: Determining if a servant region can initialize         */
/* ---------------------------------------------------------------- */
say 'Defining SERVER CB.*.cell_identifier*.* '
say 'Used for determining if a servant region can initialize.'
"RDEFINE SERVER CB.*.${zCellIdentifier}*.* UACC(NONE)"
say
"PERMIT CB.*.${zCellIdentifier}*.* CLASS(SERVER) ID(${zConfigurationGroup}) ACC(READ)"
say
<!-- endif -->

<!-- if (${zCellIdentifier}token == token) -->
/* ---------------------------------------------------------------- */
/* CLASS = SERVER                                                   */
/* PROFILE = CB.<cluster>.<generic server>                          */
/* Used for: determining if a servant region can initialize         */
/* ---------------------------------------------------------------- */
say 'Defining SERVER CB.cluster.generic_server. '
say 'Used for determining if a servant region can initialize.'

"RDEFINE SERVER CB.*   UACC(NONE)"
say

"RDEFINE SERVER CB.*.${zClusterTransitionName}ADJUNCT.* UACC(NONE)"
say

"RDEFINE SERVER CB.*.${zClusterTransitionName}.* UACC(NONE)"
say

say 'Permitting SERVER class access. '
"PERMIT CB.*.${zClusterTransitionName}.* CLASS(SERVER) ID(${zServantGroup}) ACC(READ)"
say

<!-- if (${zAdjunctUserid}token == token) -->
"PERMIT CB.*.${zClusterTransitionName}ADJUNCT.* CLASS(SERVER) ID(${zControlUserid}) ACC(READ)" 
say

"PERMIT CB.*.${zClusterTransitionName}.* CLASS(SERVER) ID(${zControlUserid}) ACC(READ)"
say
<!-- endif -->
<!-- if (${zAdjunctUserid}token != token) -->
"PERMIT CB.*.${zClusterTransitionName}ADJUNCT.* CLASS(SERVER) ID(${zAdjunctUserid}) ACC(READ)" 
say

"PERMIT CB.*.${zClusterTransitionName}.* CLASS(SERVER) ID(${zAdjunctUserid}) ACC(READ)"
say
<!-- endif -->
<!-- endif -->

"SETROPTS RACLIST(SERVER) GENERIC(SERVER) REFRESH"
say

/* ---------------------------------------------------------------- */
/*  AsynchBeans for z/OS, require servants to have access to WLM    */
/*  services.                                                       */
/* ---------------------------------------------------------------- */
say 'Authorize servants to use WLM Services'
"RDEFINE FACILITY (BPX.WLMSERVER) UACC(NONE)"
say

"PERMIT BPX.WLMSERVER ACCESS(READ) ID(${zServantGroup}) CL(FACILITY)"
say

"SETROPTS RACLIST(FACILITY) REFRESH"
say

/* ---------------------------------------------------------------- */
/* Create STARTED task profiles for each runtime server identity    */
/* Define User Identities for the runtime addresses/tasks           */
/* ---------------------------------------------------------------- */
say 'Assigning userids to started tasks. '
say 'Assign async admin ID to started task'
<!-- if (${zCellIdentifier}token != token) -->
"RDEFINE STARTED ${zCellIdentifier}ADMSH.* STDATA(USER(${zAdminAsynchTaskUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->
<!-- if (${zCellIdentifier}token == token) -->
"RDEFINE STARTED ${zAdminAsynchProcName}.* STDATA(USER(${zAdminAsynchTaskUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->

<!-- if (${zCellIdentifier}token != token) -->
say 'Defining and Permitting STARTED profiles...'
say ' '
say 'Assign daemon controller ID to started task'
<!-- if (${zDaemonUserid}token == token) -->
"RDEFINE STARTED ${zCellIdentifier}DEMN*.* STDATA(USER(${zControlUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->
<!-- if (${zDaemonUserid}token != token) -->
"RDEFINE STARTED ${zCellIdentifier}DEMN*.* STDATA(USER(${zDaemonUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->

say 'Assign controller ID to started task'
"RDEFINE STARTED ${zCellIdentifier}ACR*.* STDATA(USER(${zControlUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
say 'Assign servant ID to started task'
"RDEFINE STARTED ${zCellIdentifier}*.* STDATA(USER(${zServantUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->

<!-- if (${zCellIdentifier}token == token) -->
say 'Assign daemon controller ID to started task'
<!-- if (${zDaemonUserid}token == token) -->
"RDEFINE STARTED ${zDaemonProcName}.* STDATA(USER(${zControlUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->
<!-- if (${zDaemonUserid}token != token) -->
"RDEFINE STARTED ${zDaemonProcName}.* STDATA(USER(${zDaemonUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->

say 'Assign AppServer controller ID to started task'
"RDEFINE STARTED ${zControlProcName}.* STDATA(USER(${zControlUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say

say 'Assign AppServer adjunct ID to started task'
<!-- if (${zAdjunctUserid}token == token) -->
"RDEFINE STARTED ${zServerShortName}A.* STDATA(USER(${zControlUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->
<!-- if (${zAdjunctUserid}token != token) -->
"RDEFINE STARTED ${zServerShortName}A.* STDATA(USER(${zAdjunctUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->

say 'Assign AppServer servant ID to started task'
"RDEFINE STARTED ${zServerShortName}S.* STDATA(USER(${zServantUserid}) " || ,
"GROUP(${zConfigurationGroup}) TRACE(YES))"
say
<!-- endif -->

"SETROPTS RACLIST(STARTED) GENERIC(STARTED) REFRESH"
say

/* ---------------------------------------------------------------- */
/*       SSL SET-UP                                                 */
/*       This sets up a WAS Test Certificate Authority for use for  */
/*          creating all certificates needed on both client and     */
/*          servers, for test purposes.                             */
/*       See "RACF Security Administrator's Guide" for more         */
/*       information on Digital Certicates.                         */
/* ---------------------------------------------------------------- */

say 'Define permissions to work with certificates'
"RDEFINE FACILITY IRR.DIGTCERT.LIST UACC(NONE)"
say

"RDEFINE FACILITY IRR.DIGTCERT.LISTRING UACC(NONE)"
say

"PERMIT IRR.DIGTCERT.LIST CLASS(FACILITY) ID(${zConfigurationGroup}) ACC(READ)"
say

"PERMIT IRR.DIGTCERT.LISTRING CLASS(FACILITY) ID(${zConfigurationGroup}) ACC(READ)"
say

"SETROPTS CLASSACT(CBIND)"
say

<!-- import documents/data/cbind -->

<!-- if (${zAdminSecurityType} == websphereForZos) -->
/* ---------------------------------------------------------------- */
/* Activates additional RACF classes used by WebSphere for z/OS     */
/* security.                                                        */
/* ---------------------------------------------------------------- */
say 'Activating classes needed only for z/OS security. '
"SETROPTS RACLIST(CBIND) GENERIC(CBIND)"
say

"SETROPTS CLASSACT(SURROGAT) GENERIC(SURROGAT)"
say

/* ---------------------------------------------------------------- */
/* Define a user ID to be used for unauthenticated requests.        */
/* ---------------------------------------------------------------- */
say 'Adding WAS unauthenticated user ID'
<!-- if (${zAdminUnauthenticatedUid}token != *token) -->
"ADDUSER ${zAdminUnauthenticatedUserid} RESTRICTED DFLTGRP(${zLocalUserGroup}) " || , 
"OMVS(UID(${zAdminUnauthenticatedUid}) HOME(${zUserIDHomeDirectory}/${zLocalUserGroup})  " || ,
"PROGRAM(/bin/sh)) NAME('WAS DEFAULT USER') NOPASSWORD NOOIDCARD"
<!-- endif -->
<!-- if (${zAdminUnauthenticatedUid}token == *token) -->
"ADDUSER ${zAdminUnauthenticatedUserid} RESTRICTED DFLTGRP(${zLocalUserGroup}) " || , 
"OMVS(AUTOUID HOME(${zUserIDHomeDirectory}/${zLocalUserGroup})  " || ,
"PROGRAM(/bin/sh)) NAME('WAS DEFAULT USER') NOPASSWORD NOOIDCARD"
<!-- endif -->

/* ---------------------------------------------------------------- */
/* PermitAPPLclass function                                         */
/* ---------------------------------------------------------------- */
/* Sets permissions for CLASS(APPL)                                 */
/* PERMIT CBS390 CLASS(APPL) ID(all userids) ACCESS(READ)           */
/* ---------------------------------------------------------------- */
say 'APPL class setup.'
say 'Used to control client access to a WebSphere Application Server for z/OS cell or group of cells.'
<!-- if (${zSAFProfilePrefix}token != token) --> 
"RDEFINE APPL ${zSAFProfilePrefix} UACC(NONE)"
<!-- endif -->
<!-- if (${zSAFProfilePrefix}token == token) -->
"RDEFINE APPL CBS390 UACC(NONE)" 
<!-- endif -->
say

<!-- if (${zSAFProfilePrefix}token != token) --> 
"PERMIT ${zSAFProfilePrefix} CLASS(APPL) ID(${zConfigurationGroup}) ACCESS(READ)"
say

"PERMIT ${zSAFProfilePrefix} CLASS(APPL) ID(${zAdminUnauthenticatedUserid}) ACCESS(READ)"
say
<!-- endif -->
<!-- if (${zSAFProfilePrefix}token == token) --> 
"PERMIT CBS390 CLASS(APPL) ID(${zConfigurationGroup}) ACCESS(READ)"
say

"PERMIT CBS390 CLASS(APPL) ID(${zAdminUnauthenticatedUserid}) ACCESS(READ)"
say
<!-- endif -->
"SETROPTS RACLIST(APPL) REFRESH"
say

<!-- if (${zCellIdentifier}token != token) -->
/* --------------------------------------------------------------------- */
/*  CLASS  = CBIND                                                       */
/*  PROFILE = CB.BIND.${zCellIdentifier}**                               */
/*  (CB.BIND.cell_identifier**                                           */
/* Used for: determining if a client can "BIND" (access) a controller    */
/*           region.                                                     */
/* Notes:                                                                */
/* 1. Any userid can gain access to the controller region if it has READ */
/*    access to the CB.BIND.two_char_cell_prefix profile.                */
/* 2. A userid can still gain access to the Controller Region if the     */
/*    session owner has control access.                                  */
/* 3. Within a local session (or SSL client certificate session)         */
/*    the session owner is the userid of the client or controller        */
/*    region (if server-as-client) that issued the message.              */
/*    Otherwise, ownership is assigned to the first userid which         */
/*    has successfully accessed the controller region.                   */
/* --------------------------------------------------------------------- */
say 'Define and permit CB.BIND.<cell_identifier>** profile to CBIND class'
say 'Used for determining if a client can access a controller region'
say 'Any userid can gain access to the controller region if it has READ access to the CB.BIND.<cell_identifier>** profile'
"RDEFINE CBIND CB.BIND.${zCellIdentifier}* UACC(READ)"
say
"PERMIT CB.BIND.${zCellIdentifier}* CLASS(CBIND) ID(${zConfigurationGroup}) ACCESS(CONTROL)"
say

/* ---------------------------------------------------------------- */
/* CLASS  = CBIND                                                   */
/* PROFILE = CB.<cell_identifier>*                                */
/* Used for: Determining if a client can use J2EE applications in a */
/*           server.                                                */
/* ---------------------------------------------------------------- */
say 'Define and permit CB.<cell_identifier>* profile to CBIND class'
say 'Used for determining if a client can use J2EE applications in a server'
"RDEFINE CBIND CB.${zCellIdentifier}* UACC(READ)"
say
"PERMIT CB.${zCellIdentifier}* CLASS(CBIND) ID(${zConfigurationGroup}) ACCESS(READ)"
say
<!-- endif -->
<!-- if (${zCellIdentifier}token == token) -->
/* --------------------------------------------------------------------- */
/* CLASS=CBIND                                                           */
/* OS/390 WebSphere PROFILES                                             */
/* --------------------------------------------------------------------- */
/*  CLASS  = CBIND                                                       */
/* PROFILE = CB.BIND.<cluster name>                                      */
/*  (CB.BIND.CLUSTER)                                                    */
/* Used for: determining if a client can "BIND" (access) a controller    */
/*           region.                                                     */
/* Notes:                                                                */
/* 1. Any userid can gain access to the controller region if it has READ */
/*    access to the CB.BIND.cluster_name profile.                        */
/* 2. A userid can still gain access to the Controller Region if the     */
/*    session owner has control access.                                  */
/* 3. Within a local session (or SSL client certificate session)         */
/*    the session owner is the userid of the client or controller        */
/*    region (if server-as-client) that issued the message.              */
/*    Otherwise, ownership is assigned to the first userid which         */
/*    has successfully accessed the controller region.                   */
/* --------------------------------------------------------------------- */
say 'Define and permit CB.BIND.<cluster name> profile to CBIND class'
say 'Used for determining if a client can access a controller region'
say 'Any userid can gain access to the controller region if it has READ access to the CB.BIND.cluster_name profile'
<!-- if (${zSAFProfilePrefix}token != token) --> 
"RDEFINE CBIND CB.BIND.${zSAFProfilePrefix}.** UACC(READ)"
"PERMIT CB.BIND.${zSAFProfilePrefix}.** CLASS(CBIND) ID(${zConfigurationGroup}) ACCESS(CONTROL)"
say
<!-- endif -->
<!-- if (${zSAFProfilePrefix}token == token) -->
"RDEFINE CBIND CB.BIND.** UACC(READ)"
"PERMIT CB.BIND.** CLASS(CBIND) ID(${zConfigurationGroup}) ACCESS(CONTROL)"
say
<!-- endif -->

/* ---------------------------------------------------------------- */
/* ACCESS TO J2EE Applications                                      */
/* ---------------------------------------------------------------- */
/* CLASS  = CBIND                                                   */
/* PROFILE = CB.<CLUSTER NAME>                                      */
/* Used for: Determining if a client can use J2EE applications in a */
/*           server.                                                */
/* ---------------------------------------------------------------- */
say 'Define and permit CB.<cluster name> profile to CBIND class'
say 'Used for determining if a client can use J2EE applications in a server'
<!-- if (${zSAFProfilePrefix}token != token) --> 
"RDEFINE CBIND CB.${zSAFProfilePrefix}.** UACC(READ)"
say
<!-- endif -->
<!-- if (${zSAFProfilePrefix}token == token) -->
"RDEFINE CBIND CB.** UACC(READ)" 
say
<!-- endif -->
"SETROPTS RACLIST(CBIND) REFRESH"
say
<!-- endif -->

/* ---------------------------------------------------------------- */
/* RACF CLASS  = EJBROLE                                            */
/* Used for:  EJB Role Access. Needed for SAF Authorization         */
/*                                                                  */
/* The EJBROLE class is used to control access to roles.            */
/* The Administrative roles are for access to functions in the      */
/* administrative console and the wsadmin scripting interface. The  */
/* Naming roles are for access to the JNDI namespace                */
/* ---------------------------------------------------------------- */
say 'Setting up EJBRoles Profiles for admin roles when using SAF authorization'
"SETROPTS CLASSACT(EJBROLE)"
say
"SETROPTS RACLIST(EJBROLE) GENERIC(EJBROLE)"
say

<!-- if (${zSAFProfilePrefix}token != token) --> 
say 'Defining and Permitting EJBROLE Administrative profiles...'
"RDEFINE EJBROLE ${zSAFProfilePrefix}.administrator UACC(NONE)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.iscadmins UACC(NONE)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.auditor UACC(NONE)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.monitor       UACC(NONE)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.configurator UACC(NONE)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.operator     UACC(NONE)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.deployer     UACC(NONE)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.adminsecuritymanager UACC(NONE)"
say

"PERMIT ${zSAFProfilePrefix}.adminsecuritymanager CLASS(EJBROLE) ID(${zAdminUserid}) ACCESS(READ)"
say

"PERMIT ${zSAFProfilePrefix}.auditor CLASS(EJBROLE) ID(${zConfigurationGroup}) ACCESS(READ)"
say

say 'Setting up EJBRoles access for administrator and CR'
"PERMIT ${zSAFProfilePrefix}.administrator  CLASS(EJBROLE)  ID(${zConfigurationGroup}) ACCESS(READ)"
say

"PERMIT ${zSAFProfilePrefix}.iscadmins  CLASS(EJBROLE)  ID(${zConfigurationGroup}) ACCESS(READ)"
say

say 'Setting up EJBRoles Profiles for Naming roles'
"RDEFINE EJBROLE ${zSAFProfilePrefix}.CosNamingRead   UACC(READ)"
say

"PERMIT ${zSAFProfilePrefix}.CosNamingRead  CLASS(EJBROLE)  ID(${zAdminUnauthenticatedUserid}) ACCESS(READ)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.CosNamingWrite  UACC(NONE)"
say

"PERMIT ${zSAFProfilePrefix}.CosNamingWrite  CLASS(EJBROLE)  ID(${zConfigurationGroup}) ACCESS(READ)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.CosNamingCreate UACC(NONE)"
say

"PERMIT ${zSAFProfilePrefix}.CosNamingCreate  CLASS(EJBROLE) ID(${zConfigurationGroup}) ACCESS(READ)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.CosNamingDelete UACC(NONE)"
say

"PERMIT ${zSAFProfilePrefix}.CosNamingDelete  CLASS(EJBROLE) ID(${zConfigurationGroup}) ACCESS(READ)"
say

"RDEFINE EJBROLE ${zSAFProfilePrefix}.scaAllAuthorizedUsers UACC(READ)"
say
<!-- endif -->
<!-- if (${zSAFProfilePrefix}token == token) -->
say 'Defining and Permitting EJBROLE Administrative profiles...'
"RDEFINE EJBROLE administrator UACC(NONE)"
say

"RDEFINE EJBROLE iscadmins UACC(NONE)"
say

"RDEFINE EJBROLE auditor UACC(NONE)"
say

"RDEFINE EJBROLE monitor       UACC(NONE)"
say

"RDEFINE EJBROLE configurator UACC(NONE)"
say

"RDEFINE EJBROLE operator     UACC(NONE)"
say

"RDEFINE EJBROLE deployer     UACC(NONE)"
say

"RDEFINE EJBROLE adminsecuritymanager UACC(NONE)"
say

"PERMIT adminsecuritymanager CLASS(EJBROLE) ID(${zAdminUserid}) ACCESS(READ)"
say

"PERMIT auditor CLASS(EJBROLE) ID(${zConfigurationGroup}) ACCESS(READ)"
say

say 'Setting up EJBRoles access for administrator and CR'
"PERMIT administrator  CLASS(EJBROLE)  ID(${zConfigurationGroup}) ACCESS(READ)"
say

"PERMIT iscadmins  CLASS(EJBROLE)  ID(${zConfigurationGroup}) ACCESS(READ)"
say

say 'Setting up EJBRoles Profiles for Naming roles'
"RDEFINE EJBROLE CosNamingRead   UACC(READ)"
say

"PERMIT CosNamingRead  CLASS(EJBROLE)  ID(${zAdminUnauthenticatedUserid}) ACCESS(READ)"
say

"RDEFINE EJBROLE CosNamingWrite  UACC(NONE)"
say

"PERMIT CosNamingWrite  CLASS(EJBROLE)  ID(${zConfigurationGroup}) ACCESS(READ)"
say

"RDEFINE EJBROLE CosNamingCreate UACC(NONE)"
say

"PERMIT CosNamingCreate  CLASS(EJBROLE) ID(${zConfigurationGroup}) ACCESS(READ)"
say

"RDEFINE EJBROLE CosNamingDelete UACC(NONE)"
say

"PERMIT CosNamingDelete  CLASS(EJBROLE) ID(${zConfigurationGroup}) ACCESS(READ)" 
say

"RDEFINE EJBROLE scaAllAuthorizedUsers UACC(READ)"
say
<!-- endif -->

"SETROPTS RACLIST(EJBROLE) REFRESH"
say

<!-- if (${zGenerateCaCertificate} == true) -->
say 'Create SSL Certificate Authority certificate'
say 'This will be used to sign client and server certs'

"RACDCERT CERTAUTH GENCERT SUBJECTSDN(CN('WAS CertAuth for Security Domain') " ,
" OU('${zCellShortName}'))" ,
" WITHLABEL('${zSSLCaKeylabel}')  TRUST" ,
" SIZE(" || certsize || ")" ,
" NOTAFTER(DATE(${zCaAuthorityExpirationDate}))"
say

"SETROPTS RACLIST(FACILITY) REFRESH"
say
<!-- endif -->

say 'Create WebSphere controller personal certificate'
"RACDCERT ID (${zControlUserid}) GENCERT SUBJECTSDN(CN('${zDaemonIPName}') " || ,
" O('IBM') OU('${zCellShortName}'))"  ||      ,
" WITHLABEL('DefaultWASCert.${zCellShortName}')"  || ,
" SIGNWITH(CERTAUTH LABEL('${zSSLCaKeylabel}'))" || ,
" SIZE(" || certsize || ")" ,
" NOTAFTER(DATE(${zCaAuthorityExpirationDate}))"
say

say 'Create WebSphere controller keyring'
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zControlUserid})"
say

say 'Connect controller certificate to controller keyring '
"RACDCERT ID(${zControlUserid}) CONNECT (LABEL('DefaultWASCert.${zCellShortName}') " || ,
"RING(${zDefaultSAFKeyringName})" || ,
" DEFAULT)"
say

say 'Connect WebSphere CA certificate to controller keyring '
"RACDCERT ID(${zControlUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Connect commercial CAs to controller keyring '
"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say

<!-- endif -->

<!-- if (${zEnableSslOnDaemon} == true) -->
<!-- if (${zAdminSecurityType} != websphereForZos) -->

<!-- if (${zGenerateCaCertificate} == true) -->
say 'Create SSL Certificate Authority certificate'
say 'This will be used to sign client and server certs'

"RACDCERT CERTAUTH GENCERT SUBJECTSDN(CN('WAS CertAuth for Security Domain') " ,
" OU('${zCellShortName}'))" ,
" WITHLABEL('${zSSLCaKeylabel}')  TRUST" ,
" SIZE(" || certsize || ")" ,
" NOTAFTER(DATE(${zCaAuthorityExpirationDate}))"
say

say 'Facility class refresh '
"SETROPTS RACLIST(FACILITY) REFRESH"
say
<!-- endif -->

say 'Create WebSphere controller keyring'
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zControlUserid})"
say

<!-- if (${zDaemonUserid}token != token) -->
say 'Create keyring for Location Service Daemon id'
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zDaemonUserid})"
say
<!-- endif -->

<!-- if (${zDaemonUserid}token != token) -->
say 'Generating certificate for Location Service Daemon'
"RACDCERT ID (${zDaemonUserid}) GENCERT SUBJECTSDN(CN('${zDaemonIPName}')" || ,
" O('IBM') OU('${zCellShortName}'))"                  || ,
" WITHLABEL('DefaultDaemonCert.${zCellShortName}') " || ,
" SIGNWITH(CERTAUTH LABEL('${zSSLCaKeylabel}'))"      || ,
" SIZE(" || certsize || ")" ,
" NOTAFTER(DATE(${zCaAuthorityExpirationDate}))"
say

say 'Connecting Daemon Certificate to the keyring'
"RACDCERT ID(${zDaemonUserid}) CONNECT (LABEL('DefaultDaemonCert.${zCellShortName}')" || ,
"RING(${zDefaultSAFKeyringName})" || ,
" DEFAULT)"
say

say 'Connect WAS CA Certificate to Daemon keyring'
"RACDCERT ID(${zDaemonUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Connect commercial CAs to Daemon keyring '
"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say
<!-- endif -->

say 'Generating certificate for WebSphere controller '
"RACDCERT ID (${zControlUserid}) GENCERT SUBJECTSDN(CN('${zDaemonIPName}') " || ,
" O('IBM') OU('${zCellShortName}'))"  ||      ,
" WITHLABEL('DefaultWASCert.${zCellShortName}')"  || ,
" SIGNWITH(CERTAUTH LABEL('${zSSLCaKeylabel}'))" || ,
" SIZE(" || certsize || ")" ,
" NOTAFTER(DATE(${zCaAuthorityExpirationDate}))"
say

say 'Connect controller certificate to controller keyring '
"RACDCERT ID(${zControlUserid}) CONNECT (LABEL('DefaultWASCert.${zCellShortName}') " || ,
"RING(${zDefaultSAFKeyringName})" || ,
" DEFAULT)"
say

say 'Connect WebSphere CA certificate to controller keyring '
"RACDCERT ID(${zControlUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Connect commercial CAs to controller keyring '
"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zControlUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say

<!-- endif -->
<!-- endif -->

<!-- if (${zAdminSecurityType} == websphereForZos) -->

<!-- if (${zEnableSslOnDaemon} == true) -->
<!-- if (${zDaemonUserid}token != token) -->
say 'Create keyring for Location Service Daemon id'
"RACDCERT ADDRING( " || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zDaemonUserid})"
say
<!-- endif -->

<!-- if (${zDaemonUserid}token != token) -->
say 'Generating certificate for Location Service Daemon'
"RACDCERT ID (${zDaemonUserid}) GENCERT SUBJECTSDN(CN('${zDaemonIPName}')" || ,
" O('IBM') OU('${zCellShortName}'))"                  || ,
" WITHLABEL('DefaultDaemonCert.${zCellShortName}') " || ,
" SIGNWITH(CERTAUTH LABEL('${zSSLCaKeylabel}'))"      || ,
" SIZE(" || certsize || ")" ,
" NOTAFTER(DATE(${zCaAuthorityExpirationDate}))"
say

say 'Connecting Daemon Certificate to the keyring'
"RACDCERT ID(${zDaemonUserid}) CONNECT (LABEL('DefaultDaemonCert.${zCellShortName}')" || ,
"RING(${zDefaultSAFKeyringName})" || ,
" DEFAULT)"
say

say 'Connect WAS CA Certificate to Daemon keyring'
"RACDCERT ID(${zDaemonUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Connect commercial CAs to Daemon keyring '
"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zDaemonUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say
<!-- endif -->
<!-- endif -->

say 'Create WebSphere servant keyring'
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zServantUserid})"
say

say 'Connect WAS CA Certificate to servant keyring'
"RACDCERT ID(${zServantUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Connect Commercial CAs to servant keyring'
"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zServantUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say

<!-- if (${zAdjunctUserid}token != token) -->
say 'Create WebSphere adjunct keyring'
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zAdjunctUserid})"
say

say 'Connect WAS CA Certificate to adjunct keyring'
"RACDCERT ID(${zAdjunctUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Connect Commercial CAs to adjunct keyring'
"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdjunctUserid})  CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say
<!-- endif -->

say 'Creating SSL keyring for WebSphere administrator user id'
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zAdminUserid})"
say

say 'Connect WAS CA Certificate to WebSphere administrator keyring'
"RACDCERT ID(${zAdminUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Connect Commercial CAs to WebSphere administrator keyring'
"RACDCERT ID(${zAdminUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say

say 'Creating SSL keyring for WebSphere asynch administrator '
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName})" || ,
" ID(${zAdminAsynchTaskUserid})"
say

say 'Connect WAS CA Certificates to WebSphere asynch administrator keyring'
"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say

say 'Connect Commercial CAs to WebSphere asynch administrator keyring'
"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 3 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign Class 1 Primary CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('RSA Secure Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Premium Server CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Basic CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Freemail CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Thawte Personal Premium CA') USAGE(CERTAUTH))"
say

"RACDCERT ID(${zAdminAsynchTaskUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName})" || ,
" CERTAUTH label('Verisign International Svr CA') USAGE(CERTAUTH))"
say

say 'Creating Root and Signers keyrings '
"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName}.Root)" || ,
" ID(${zControlUserid})"
say

"RACDCERT ADDRING(" || ,
"${zDefaultSAFKeyringName}.Signers)" || ,
" ID(${zControlUserid})"
say

say 'Connect root CA certificates to the root keyrings '
<!-- if (${zEnableWritableKeyring} == true) -->
"RACDCERT ID(${zControlUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName}.Root)" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH USAGE(PERSONAL))"
say
<!-- endif -->

<!-- if (${zEnableWritableKeyring} == false) -->
"RACDCERT ID(${zControlUserid}) CONNECT " || ,
"(RING(${zDefaultSAFKeyringName}.Root)" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
say
<!-- endif -->

say 'Connect default signers to the default signers keyring '

"RACDCERT ID(${zControlUserid}) CONNECT (RING(" ||,
"${zDefaultSAFKeyringName}.Signers)" || ,
" LABEL('${zSSLCaKeylabel}') CERTAUTH)"
<!-- endif -->
say

/* ---------------------------------------------------------------- */
/*                 Synch to OS Thread setup                         */
/* ---------------------------------------------------------------- */
say 'Creating Sync-to-thread profile '
say 'Used for: Enabling Sync-to-thread. '
say 'Controller region user ID needs READ or CONTROL access to enable Sync-to-thread. '
say 'With READ access, only security environments representing users in the SURROGATE class are allowed, while CONTROL allows for security environments to represent any user. '
<!-- if (${zCellIdentifier}token != token) -->
"RDEFINE FACILITY BBO.SYNC.${zCellIdentifier}*.** UACC(NONE)"
<!-- endif -->
<!-- if (${zCellIdentifier}token == token) -->
"RDEFINE FACILITY BBO.SYNC.${zCellShortName}.${zClusterTransitionName} UACC(NONE)"
<!-- endif -->
say

/* ---------------------------------------------------------------- */
/*                 Trusted applications setup                       */
/* ---------------------------------------------------------------- */
say 'Creating EnableTrustedApplications profile '
say 'Used for: Allowing applications to perform operations normally reserved for privileged users. '
<!-- if (${zCellIdentifier}token != token) -->
"RDEFINE FACILITY BBO.TRUSTEDAPPS.${zCellIdentifier}*.** UACC(NONE)"
<!-- endif -->
<!-- if (${zCellIdentifier}token == token) -->
"RDEFINE FACILITY BBO.TRUSTEDAPPS.${zCellShortName}.${zClusterTransitionName} UACC(NONE)"
<!-- endif -->
say
say 'Permit default WAS Configuration group to EnableTrustedApplications profile. '
<!-- if (${zCellIdentifier}token != token) -->
"PERMIT BBO.TRUSTEDAPPS.${zCellIdentifier}*.** " || ,
" CLASS(FACILITY) ID(${zConfigurationGroup}) ACCESS(READ)"
<!-- endif -->
<!-- if (${zCellIdentifier}token == token) -->
"PERMIT BBO.TRUSTEDAPPS.${zCellShortName}.${zClusterTransitionName} " || ,
" CLASS(FACILITY) ID(${zConfigurationGroup}) ACCESS(READ)"
<!-- endif -->
say

"SETROPTS RACLIST(FACILITY) REFRESH"
say

<!-- if (${zEnableWritableKeyring} == true) -->
say 'Define permissions required for writable keyring support'
  
"SETR CLASSACT(RDATALIB)"
say

"SETR RACLIST(RDATALIB) GENERIC(RDATALIB)"
say
  
"RDEFINE RDATALIB ${zControlUserid}.**.LST UACC(NONE)"
say

"RDEFINE RDATALIB ${zServantUserid}.**.LST UACC(NONE)"
say

"PERMIT ${zControlUserid}.**.LST CLASS(RDATALIB) ID(${zConfigurationGroup}) ACC(READ)"
say

"PERMIT ${zControlUserid}.**.LST CLASS(RDATALIB) ID(${zControlUserid}) ACC(CONTROL)"
say

"PERMIT ${zServantUserid}.**.LST CLASS(RDATALIB) ID(${zControlUserid}) ACC(CONTROL)"
say

"PERMIT ${zServantUserid}.**.LST CLASS(RDATALIB) ID(${zServantUserid}) ACC(CONTROL)"
say 

"RDEFINE RDATALIB ${zControlUserid}.**.UPD UACC(NONE)"
say

"RDEFINE RDATALIB ${zServantUserid}.**.UPD UACC(NONE)"
say

"PERMIT ${zControlUserid}.**.UPD CLASS(RDATALIB) ID(${zControlUserid}) ACC(CONTROL)"
say

"PERMIT ${zServantUserid}.**.UPD CLASS(RDATALIB) ID(${zControlUserid}) ACC(CONTROL)"
say

"RDEFINE RDATALIB ${zAdminUserid}.**.LST UACC(NONE)"
say

"PERMIT ${zAdminUserid}.**.LST CLASS(RDATALIB) ID(${zConfigurationGroup}) ACC(READ)"
say

"PERMIT ${zAdminUserid}.**.LST CLASS(RDATALIB) ID(${zAdminUserid}) ACC(CONTROL)"
say

"RDEFINE RDATALIB ${zAdminUserid}.**.UPD UACC(NONE)"
say

"PERMIT ${zAdminUserid}.**.UPD CLASS(RDATALIB) ID(${zAdminUserid}) ACC(CONTROL)"
say

"SETR RACLIST(RDATALIB) REFRESH"
say
<!-- endif -->