Re: Authorization list - or equivalent

On Thu, Sep 24, 2009 at 15:09, Jeff Crosby <jlcrosby@xxxxxxxxxxxxxxxx>
wrote:

1) Is it a good practice to assign an account to multiple global groups?
Does that cause issues? We're a small company and people wear many hats.
For example, the office manager handles overflow calls to inside sales.
Should the office manager be placed in the Global Inside Sales group as

well

as the Global Office group? How is the effective permission determined

if

an account is in multiple groups with differing permissions? My guess is
that if ANY group has enough permission, the account gets in.

If you're running a company with less than 100 users, you will not
need to concern yourself with the performance of the permissions etc.
you implement, because it simply doesn't matter. In most cases, even
with 500 users you can't do anything that will impact performance - if
you're running current hardware.

Permissions are generally additive, with the exception of deny
permissions. Deny always comes before allow.

If you have a file with an two groups, one with an allow permissions
and the other with a deny permissions, and a user is member of both
these groups, deny will take precendence.

This is also not as bad and as important as it sounds - you will
usually not need deny permissions. They're great for the occasional
"special circumstance", but you shouldn't make them part of your
standard security concept.

3) From #2, "Joe" is also a member of upper corporate management, which
could/should be another global group. It seems to me accounts ought to

be

in multiple global groups.

Usually, accounts are members of multiple global groups, yes. Unless
their job really just consists of doing one thing.

If you assign all the permissions with domain local groups, you'll be
able to mix and match the global groups until you have a scenario that
you like. In the end, do what is easy for you to grasp, understand,
document and implement.

4) How does "Administrator" apply here? I'm certain that Administrator

is

not put into every global group.

No, my approach is to give the Administrators group permissions on all
the files - directly on the ACL level, circumventing Active Directory.
Though this is not directly necessary - Administrators are able to
take ownership and reset permissions as needed.

I guess this issue (an account in multiple groups - yes or no) is an

early

fork in the road for me. It will have great effect on how I proceed.

Yeah, definitively.

--
Read my blog at http://projectdream.org
--
This is the PC Technical Discussion for iSeries Users (PcTech) mailing list
To post a message email: PcTech@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/pctech.