Does TSS REFRESH command refresh user security environment in all cases?

Document ID : KB000046422
Last Modified Date : 14/02/2018
Show Technical Document Details

 

Question:

 

-Do Both Regular Cache and Seccache Need To Be Cleared To Reset User Security Environment Or TSS REFRESH command Is Good Enough?
 

 

Answer: 

 

 

-Most of the time, REFRESH is the only process necessary to rebuild a current version of the user's security environment.
 When a rebuild is required, both the SECCACHE and CACHE have checks to see if the user records they hold are current.
 When they are not current due to some user administration of permissions, the stale records are discarded and new ones are read in and the user security
 environment is rebuilt to reflect the latest changes. 


-With the CA TOP SECRET REFRESH command there are instances where a user record may not be refreshed across all address space / jobs when requested. One, if  the address space is multi-user (like CICS for example) and the MAXUSER is not set large enough you can have users that are not registered to the ACID cross  reference table (message TSS0962E message is displayed on console).

 -The REFRESH process uses this table to find the user, if they are not in the table then they cannot be refreshed remotely (they would need to do the TSS REFRESH  command locally themselves). And two, if the address space is unavailable for any reason (if swapped out or storage not available due to system conditions) then  status messages are sent to the issuer of the REFRESH command and the address space is skipped. Again the user can typically REFRESH themselves locally in an  address space by entering their own CA TOP SECRET REFRESH command. 

 

-If you encounter cases where the CA Top Secret REFRESH command seems not working, call you local support center.

 

Additional Information:

 

-For CA Top Secret r15.0, refer to CA Top Secret for z/OS User Guide, chapter #9 Modifying Your Security Environment --> Control Options -->
 Security Environment Refresh about the CA Top Secret REFRESH Command.
-For CA Top Secret r16.0, go to docops.ca.com site.