Gad:
"That depends" is the only answer to your question as posted. That said
some thoughts:
First *PGMR user class does not grant special authorities all on it's own.
If you copy QPGMR then you will get *JOBCTL and *SAVSYS. (*JOBCTL includes
*SPLCTL by definition) Unless they are managing other users jobs and
running save/restore operations they don't "need" either of them.
The real solution is to build authorization lists on the production and
test/dev objects and grant the appropriate authorities in the authorization
lists as needed. Also if the ownership of objects is set up so a production
owner owns all those objects and a test/dev owner owns all the objects there
it makes the authorization list easier.
Now whoever promotes to production will need to adjust the owner and
authorization list on the object.
In reality, no user on the system should have direct authority to any of the
production application objects, they should get that via adopted authority
(or LDAP but then the application needs to be written for it) and
appropriate menu usage. That's true of 5250 or web access. Developers
can have access to the development objects.
--
Jim Oberholtzer
Agile Technology Architects
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Gad
Miron
Sent: Monday, June 29, 2020 5:50 AM
To: midrange-l@xxxxxxxxxxxxxxxxxx
Subject: Developers' Authorities
Hello all
I know that Programmers' Authorities is an old issue but I have not found a
satisfactory solution yet
*PGMR for USRCLS granted,
But what SPCAUT should programmers have?
How to avoid granting the (in)famous *ALLOBJ ?
TIA
Gad
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com
midrange.com
