Re: Best Practices

[Joe Pluta <joepluta@xxxxxxxxxxxxxxxxx>]

Cyndi, I don't know if its "best practice" but I use both authorization 
lists and group profiles.  With the advent of "supplemental group 
profiles" you can actually assign a user to multiple groups, and then 
assign each of those groups the appropriate authority to objects by 
adding them to authorization lists.

I also use group profiles for access to specific objects.  For example, 
I have a specific group profile just for debugging that gives users 
authority to debugging (things like STRSRVJOB).  If a user needs 
debugging rights, I assign them to the debugging group.  You can even do 
this temporarily, adding and removing rights as needed.

I also assign an authorization list to each library and set the CRTAUT 
parameter on the library to the authorization list.   That way, any 
object in that library defaults to the appropriate authorization list.  
It's fairly simple scheme, but it works for me.

I think there may be some issues with adopting authority and group 
profiles, but I can't recall any specifics.

Joe


> Which is best, Authorization lists or Group Profiles ?
>
>
>
> Years ago, we setup Group Profiles, assigned everyone to a group, and
> assigned authority to the group. Of course, with people trading jobs,
> they are all snafu'd.
>
>
>
> I would like to know which way is the best way to restructure our
> security.
>
>
>
> Cyndi B.
>
> Boise, ID