|
In OS/400 there's the concept of special authorities that gives the user (or group) the ability to perform some function, such as *JOBCTL which gives the user authority to manage other users' jobs. However, the special authorities are predefined and you cannot create your own or customize the existing ones.
There is also the concept of a group profile. Make users members of the group profile and give the group authority to access objects (files or libraries) and assign the group capabilities, and all of the members "inherit" the authority and capabilities from the group. This is how role-based access is implemented in OS/400. Define the roles, create a group for each role and based on the tasks the role must perform, grant the group the appropriate authorities and capabilities required for the tasks.
Finally there is the concept of an authorization list that allows you to quickly and easily manage a set of objects that all need the same authority.
For more details on these concepts you can check the iSeries Security Reference manual available as a .PDF from the IBM Information Center. The concepts are also explained and practical examples given in my book, Experts' Guide to OS/400 and i5/OS Security. ==================================
MORE INFORMATION ON THIS TOPIC
==================================
The Best Web Links: tips, tutorials and more.
Search400's targeted search engine: Get relevant information on security.
Ask your systems management questions--or help out your peers by answering them--in our live discussion forums.
Check out this Search400.com Featured Topic: Top ten security tips
Visit the ITKnowledge Exchange and get answers to your security questions fast.
|
