|
Œ Hello Ian, You might want to move this discussion to the security mailing list. It is always easier to set security up tightly from the start and possibly relax it a little than it is to have 'open house' and start removing authority from people. They come up with the most interesting reasons for why they need the access. Some ideas to start things off: Secure things at the library level rather than the object level to simplify management. Create one or more group profiles for your production users Add your production users to the appropriate group Grant the group profile access to the production libraries Revoke *PUBLIC access to the production libraries. Create a group profile for your deveoplers Add the developers to the group Create test and development versions of the production libraries (A subset of the data is usually sufficient if it is well designed. You should also design an automated refresh mechanism -- either save the initial state of the test environment or create a program that adopts authority to rebuild it from production data.) Grant your developers access to the development and test libraries. (Developers should be able to copy data from the test environment into their development libraries but not the reverse.) Grant your development and test groups *EXCLUDE rights to the production libraries (belt and braces). Done. You could also use authorization lists instead of group profiles but I prefer groups. You could segment further by having separate development and test groups. The main thing is that no developer needs access to production data regardless of how they bleat for it. Even in a small one man shop, access to production libraries should be via a separate profile. There is NO need for a development ID to have access to production data. No developer needs *ALLOBJ or most other special authoritites. No developer needs read rights to production data or objects. DId I say that no developer needs access to production data? Good! Regards, Simon Coulter. «»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«» «» FlyByNight Software AS/400 Technical Specialists «» «» Eclipse the competition - run your business on an IBM AS/400. «» «» «» «» Phone: +61 3 9419 0175 Mobile: +61 0411 091 400 /"\ «» «» Fax: +61 3 9419 0175 mailto: shc@flybynight.com.au \ / «» «» X «» «» ASCII Ribbon campaign against HTML E-Mail / \ «» «»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»«»
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.