EJBROLES are not being validated with z/OS Connect using ACF2

Document ID : KB000107853
Last Modified Date : 25/07/2018
Show Technical Document Details
Introduction:
We are configuring security for Z/OS Connect with SAF registries. Included in that are EJBROLES
Question:
EJBROLES not being validated.  The rules have been written that don't seem to work.  The z/OS Connect trace shows errors. 

3:00] 00000053 id=dc0f1dbc ibm.ws.security.authorization.saf.internal.SAFRoleMapperImpl < getProfileFromRole Exit 
BAQDEV01.zos.connect.access.roles.zosConnectAccess 
[7/19/18 19:16:59:796 GMT-03:00] 00000053 id=0a2b8be7 urity.authorization.saf.internal.SAFAuthorizationServiceImpl > checkAccess Entry 
SAFCredentialImpl@b828c87e:LXXL18:ASSERTED:LXXL18 
[B@fb68dad5,len=8 
|0000| C5D1C2D9 D6D3C500 

03:00] 00000053 id=c399b451 .ibm.ws.webcontainer.security.WebAppSecurityCollaboratorImpl < isUserInRole Exit 
false 
[7/19/18 19:16:59:868 GMT-03:00] 00000053 id=c399b451 .ibm.ws.webcontainer.security.WebAppSecurityCollaboratorImpl < isUserInRole Exit 
Answer:
EJBROLES use the RACROUTE FASTAUTH call.  In ACF2, rules for FASTAUTH calls must be in a globally resident directory.
 
SET CONTROL(GSO) 
CHANGE INFODIR TYPES(R-REJB)
F ACF2,REFRESH(INFODIR)
F ACF2,REBUILD(EJB)
 
This will load the rules into resident storage, as will any IPL.