The daily edition.

MLDAP Username Substitution: Per-User Dataset Security Without Per-User Rules

Scope: Rocket Enterprise Developer / Enterprise Server 12.0 for Linux/UNIX, using the MLDAP External Security Manager (ESM) Module.

Enterprise Server’s MLDAP module can build the effective resource-rule name from the identity of the user making the request. This is particularly useful for resource classes such as DATASET and JESSPOOL, where each user commonly needs strong access to a namespace containing that user’s ID. Instead of maintaining a separate LDAP rule for every account, one substitution rule can express the relationship generically. Rocket documents ${user} for the normal user ID and ${user_long} when the long username is required. See Username Substitution.

Enable the behavior in the MLDAP Security Manager configuration:

[Operation]
Rule substitutions=yes

A hardened dataset design can then pair a broad denial with a more specific substituted rule:

USERS.**              deny:*:all
USERS.${user}.**      allow:*:alter

For a request from ALICE, the second rule behaves as though its name were USERS.ALICE.**. Consequently, it can authorize ALICE’s own dataset namespace while the first rule denies other content under USERS. The actor in the substituted rule may be * because the rule name itself can match only when the requesting user’s ID occupies that resource-name position. This is a property of the documented substitution pattern—not a general reason to use wildcard grants. Rocket’s Hardening access-control rules gives this exact deny-plus-substitution structure and separately recommends assigning ordinary access through meaningful groups rather than individual-user ACEs.

The important operational detail is precedence. A substitution token is ranked as if the requesting username appeared literally in the rule name. Thus, a rule such as USER.${user}.** is more specific than USER.*.** for the matching user qualifier. This lets the personal-namespace rule win without creating a literal rule for every username.

The same mechanism applies to spool protection. Rocket documents a JESSPOOL rule named *.${user}.** with allow:*:control. It aligns with the documented JESSPOOL resource format, whose second component is the user ID, so control is tied to the requester’s own jobs and spool resources. The capability described here is specifically documented for the MLDAP ESM Module; it should not be assumed to be a VSAM ESM substitution feature.

Takeaway: Combine a broad deny rule with a more-specific ${user} rule to enforce per-user dataset or spool ownership without maintaining per-user LDAP rules.