Re: Primary Group Profile object attribute

Kenneth,

>I have always been a little confused with how to utilize the primary group
>profile (PGP) object attribute in a general application security scheme.
>
>I have used carefully thought out object ownership schemes along with
>authority lists and program adoption to control access to our production
>application objects and this has work very well. However, I've never taken
>into account primary group profiles.
>
>Is this an attribute that might be useful in setting up a simple yet
>effective security scheme for controlling access to IFS objects?

Yes, primary group authority can be used for IFS objects. The Change
Primary Group (CHGPGP) command is used to change the primary group of an
IFS object and to set their primary group authorities.

The reason that primary group authority exists is to allow you to provide
better performance than you may get by using private authorities on a group
profile. The primary group authority is stored in the header of the object
so checking that authority will be faster than looking up private
authorities in a group profile. Its performance should be comparable to the
performance of using public authority.

Ed Fishel,
edfishel@US.IBM.COM