At 08:24 AM 11/21/97 -0500, you wrote:
>Pete,
>
>>>Do you have users that have less than *PUBLIC access to objects? I'm
>>>told that is a big cycle hog.
>
>Yep - Our problem is that the developers are part of a group (QPGMR) and have
>less than *PUBLIC. My suggestion to the is top add all production users to a
>seperate group and make that group the Primary Group for all the objects. But
>without the tool and/or knowledge to prove my theory, they are reluctant to do
>so.
>
>They also have other problems with performance but I want to only fix one at a
>time and re-review their performance data.
Here's the skinny, straight from the Security-Reference v3r7 manual, on the order in which authority checking is done:
>>>>
1. User’s *ALLOBJ special authority
2. User’s specific authority to the object
3. User’s authority on the authorization list securing the object
4. Groups’ *ALLOBJ special authority
5. Groups’ authority to the object
6. Groups’ authority on the authorization list securing the object
7. Public authority specified for the object or for the authorization list securing the object
8. Program owner’s authority, if adopted authority is used
<<<<
As you can see, public authority results in very inefficient processing, as it is delayed until the end, almost. The only thing worse, it seems, is adopted *OWNER. Ouch!!
There's a lot more in the manual—flowcharts for all stages, and multiple examples. Too much to put in a posting here. Get the PDF version or get it off your Softcopy CD. The above was in chapter 5. Should be plenty to prove your case.
HTH
Vernon Hamberg
Systems Software Programmer
Old Republic National Title Insurance Company
400 Second Avenue South
Minneapolis, MN 55401
(612) 371-1111 x480
+--- | This is the Midrange System Mailing List! | To submit a new message, send your mail to "MIDRANGE-L@midrange.com". | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com. | Questions should be directed to the list owner/operator: david@midrange.com +---
midrange.com
