RACF — Resource Access Control Facility Guide

In this tutorial, you'll learn about RACF. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

RACF (Resource Access Control Facility) is IBM's Mainframe security system for z/OS — the gatekeeper that controls who can access what on the Mainframe, protecting datasets, transactions, and system resources for millions of users across the world's largest enterprises.

What You'll Learn

RACF user and group administration, dataset security, resource profiles, class descriptors, and best practices for Mainframe security auditing and Compliance.

Why It Matters

RACF is the foundation of Mainframe security. Every Mainframe user, every dataset, and every Transaction is under RACF's control. Banks, insurers, and government agencies rely on RACF to pass SOX, PCI-DSS, and HIPAA audits. A misconfigured RACF is a Compliance disaster waiting to happen.

Durga Antivirus Pro uses RACF-inspired access control lists for file quarantine permissions. Doda Browser applies RACF-style role-based security for enterprise extension management.

Real-World Use

A bank auditor reviews RACF logs to verify that only authorized operations staff can access the production CICS region. RACF records every access attempt — successful or denied — with user ID, resource, time, and terminal information, providing an unbreakable audit trail.

Learning Path

flowchart LR
  A["Mainframe Basics"] --> B["z/OS Overview"]
  B --> C["RACF Security
You are here"]
  C --> D["SMP/E Software Mgmt"]
  D --> E["Parallel Sysplex"]
  style C fill:#f90,color:#fff

What Is RACF?

RACF is a security subsystem that runs within z/OS. It authenticates users, authorizes access to resources, and logs all security-relevant events. Think of RACF as a combination of Active Directory + file permissions + audit logging — but hardened for mainframe use over 40+ years.

RACF Architecture

flowchart LR
  subgraph "Users & Groups"
    A[User ID]
    B[Group]
  end
  subgraph "RACF Database"
    C[User Profile]
    D[Group Profile]
    E[Resource Profile]
    F[Class Descriptor]
  end
  subgraph "Protected Resources"
    G[Datasets]
    H[CICS Transactions]
    I[TSO Commands]
    J[IMS Programs]
  end
  A --> C
  B --> D
  C --> E
  D --> E
  E --> G
  E --> H
  E --> I
  E --> J
  style C fill:#f90,color:#fff

User Administration

RACF users are managed via TSO commands:

ADDUSER USER01 NAME('JOHN SMITH') OWNER(SYS1) +
  DFLTGRP(PAYROLL) PASSWORD(****) NOPASSWORD(****) +
  UACC(READ) TSO(ACCTNUM(ACCT#) PROC(TSOPROC))

Common user commands:

ALTUSER USER01 NAME('JOHN A. SMITH')
DELUSER USER01
CONNECT USER01 GROUP(PAYROLL) UACC(READ)
PASSWORD USER01 NEWPW(****)
LISTUSER USER01

Dataset Security

RACF protects datasets through profiles:

ADDSD 'PAYROLL.**' UACC(NONE) OWNER(PAYROLL) +
  NOTIFY(PAYROLL.ADMIN) DATA('Payroll datasets')

PERMIT 'PAYROLL.PROD.**' ID(PAYPROG) ACCESS(READ)
PERMIT 'PAYROLL.PROD.**' ID(PAYADMIN) ACCESS(UPDATE)
PERMIT 'PAYROLL.PROD.**' ID(PAYMGR) ACCESS(CONTROL)

LISTDSD DATASET('PAYROLL.PROD.SALARIES') ALL

Access Levels

Group-based Authorization

Groups simplify permission management:

ADDGROUP PAYROLL SUPGROUP(SYS1) OWNER(SYS1) DATA('Payroll Department')
CONNECT USER01 GROUP(PAYROLL) UACC(READ)
PERMIT 'PAYROLL.PROD.**' ID(PAYROLL) ACCESS(UPDATE)

RACF Classes

RACF uses class descriptors to control non-dataset resources:

Common Errors

1. Using UACC too broadly

UACC(READ) on sensitive datasets allows read access to everyone on the system.

2. Not using WARNING mode during testing

Use WARNING on new profiles to log violations without denying access during testing.

3. Forgetting to SETROPTS REFRESH

Profile changes are not active until SETROPTS REFRESH is issued.

4. Weak password policies

Use SETROPTS to enforce minimum password length, mixed case, and expiration intervals.

5. Overusing ID(*) permissions

Granting ID(*) access is the RACF equivalent of chmod 777 — avoid it.

Practice Questions

1. What does RACF stand for? Resource Access Control Facility — IBM's Mainframe security system.

2. How do you protect a dataset with RACF? Use ADDSD to create a profile and PERMIT to grant access to users or groups.

3. What is the purpose of UACC? Universal Access Authority — the default access level for users not explicitly permitted.

4. How do you activate RACF profile changes? Issue SETROPTS REFRESH to make profile changes effective immediately.

5. What is the difference between UPDATE and CONTROL access? UPDATE allows read/write but not delete. CONTROL adds delete authority over datasets.

Challenge: Design a RACF security structure for a bank with three departments (PAYROLL, ACCOUNTING, HR), each with production and test datasets, and appropriate access levels for managers, analysts, and auditors.

FAQ

What's Next

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro. Updated 2026-06-24.