225 lines
14 KiB
HTML
225 lines
14 KiB
HTML
|
<?xml version="1.0" encoding="UTF-8"?>
|
|||
|
|
<!DOCTYPE html
|
|||
|
|
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|||
|
|
<html lang="en-us" xml:lang="en-us">
|
|||
|
|
<head>
|
|||
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
|||
|
|
<meta name="security" content="public" />
|
|||
|
|
<meta name="Robots" content="index,follow" />
|
|||
|
|
<meta http-equiv="PICS-Label" content='(PICS-1.1 "http://www.icra.org/ratingsv02.html" l gen true r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l gen true r (n 0 s 0 v 0 l 0) "http://www.classify.org/safesurf/" l gen true r (SS~~000 1))' />
|
|||
|
|
<meta name="DC.Type" content="concept" />
|
|||
|
|
<meta name="DC.Title" content="Plan group profiles" />
|
|||
|
|
<meta name="abstract" content="This topic describes the purpose of group profiles and how to design them. Use group profiles to define authorities for a group of users, rather than giving authority to each user individually." />
|
|||
|
|
<meta name="description" content="This topic describes the purpose of group profiles and how to design them. Use group profiles to define authorities for a group of users, rather than giving authority to each user individually." />
|
|||
|
|
<meta name="DC.Relation" scheme="URI" content="rzamvplanusergrp.htm" />
|
|||
|
|
<meta name="DC.Relation" scheme="URI" content="rzamvgroupprof.htm" />
|
|||
|
|
<meta name="copyright" content="(C) Copyright IBM Corporation 2006" />
|
|||
|
|
<meta name="DC.Rights.Owner" content="(C) Copyright IBM Corporation 2006" />
|
|||
|
|
<meta name="DC.Format" content="XHTML" />
|
|||
|
|
<meta name="DC.Identifier" content="plangrpprof" />
|
|||
|
|
<meta name="DC.Language" content="en-us" />
|
|||
|
|
<!-- All rights reserved. Licensed Materials Property of IBM -->
|
|||
|
|
<!-- US Government Users Restricted Rights -->
|
|||
|
|
<!-- Use, duplication or disclosure restricted by -->
|
|||
|
|
<!-- GSA ADP Schedule Contract with IBM Corp. -->
|
|||
|
|
<link rel="stylesheet" type="text/css" href="./ibmdita.css" />
|
|||
|
|
<link rel="stylesheet" type="text/css" href="./ic.css" />
|
|||
|
|
<title>Plan group profiles</title>
|
|||
|
|
</head>
|
|||
|
|
<body id="plangrpprof"><a name="plangrpprof"><!-- --></a>
|
|||
|
|
<!-- Java sync-link --><script language="Javascript" src="../rzahg/synch.js" type="text/javascript"></script>
|
|||
|
|
<h1 class="topictitle1">Plan group profiles</h1>
|
|||
|
|
<div><p>This topic describes the purpose of group profiles and how to design
|
|||
|
|
them. Use group profiles to define authorities for a group of users, rather
|
|||
|
|
than giving authority to each user individually.</p>
|
|||
|
|
<p>A user can be a member of up to 16 group profiles. You can use a group
|
|||
|
|
profile as a pattern for creating individual user profiles.</p>
|
|||
|
|
<p>Once you identify your user groups, you are ready to plan a profile for
|
|||
|
|
each group. Many of the decisions you make affect both security and customizing.
|
|||
|
|
For example, when you specify an initial menu, you might be restricting a
|
|||
|
|
user to only that menu. But you are also ensuring that the user sees the correct
|
|||
|
|
menu after signing on.</p>
|
|||
|
|
<div class="p">A group profile is a special type of user profile. It serves two purposes
|
|||
|
|
on the system: <dl><dt class="dlterm">Security tool</dt>
|
|||
|
|
<dd>A group profile provides a method for organizing authorities on your system
|
|||
|
|
and sharing them among users. You can define object authorities or special
|
|||
|
|
authorities for group profiles rather than for each individual user profile.
|
|||
|
|
A user may be a member of up to 16 group profiles.</dd>
|
|||
|
|
<dt class="dlterm">Customizing tool</dt>
|
|||
|
|
<dd>A group profile can be used as a pattern for creating individual user
|
|||
|
|
profiles. Most people who are part of the same group have the same customizing
|
|||
|
|
needs, such as the initial menu and the default printer. You can define these
|
|||
|
|
things in the group profile and then copy the group profile to create individual
|
|||
|
|
user profiles.</dd>
|
|||
|
|
</dl>
|
|||
|
|
</div>
|
|||
|
|
<div class="p">A group profile is a useful tool when several users have similar security
|
|||
|
|
requirements. They are particularly useful when job requirements and group
|
|||
|
|
membership change. For example, if members of a department have responsibility
|
|||
|
|
for an application, a group profile can be set up for the department. As users
|
|||
|
|
join or leave the department, the group profile field in their user profiles
|
|||
|
|
can be changed. This is easier to manage than removing individual authorities
|
|||
|
|
from user profiles. You can create profiles specifically to be group profiles,
|
|||
|
|
or you can make an existing profile into a group profile. A group profile
|
|||
|
|
is simply a special type of user profile. It becomes a group profile when
|
|||
|
|
one of the following occurs: <ul><li>Another profile designates it as a group profile.</li>
|
|||
|
|
<li>You assign a group identification number (<var class="varname">gid</var>) to it.</li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
<div class="p">For example: <ol><li>Create a profile called GRPIC: <kbd class="userinput">CRTUSRPRF GRPIC</kbd></li>
|
|||
|
|
<li>When the profile is created, it is an ordinary profile, not a group profile.</li>
|
|||
|
|
<li>Designate GRPIC as the group profile for another group profile: <kbd class="userinput">CHGUSRPRF
|
|||
|
|
USERA GRPPRF(GRPIC)</kbd></li>
|
|||
|
|
<li>The system now treats GRPIC as a group profile and assigns a <var class="varname">gid</var> to
|
|||
|
|
it.</li>
|
|||
|
|
</ol>
|
|||
|
|
</div>
|
|||
|
|
<div class="section"><h4 class="sectiontitle">Create a group profile plan</h4><p>You create group profiles
|
|||
|
|
in the same way that you create individual profiles. The system recognizes
|
|||
|
|
a group profile when you add the first member to it. At that point, the system
|
|||
|
|
sets information in the profile indicating that it is a group profile. The
|
|||
|
|
system also generates a group identification number (<var class="varname">gid</var>)
|
|||
|
|
for the profile. You can also designate a profile as a group profile at the
|
|||
|
|
time that you create it by specifying a value in the GID parameter.</p>
|
|||
|
|
<div class="p">Perform
|
|||
|
|
the following steps to plan group profiles: <ol><li>Prepare a <a href="rzamvusergrpdescworksheet.htm#usergrpdescworksheet">user
|
|||
|
|
group description worksheet</a> for each identified group.</li>
|
|||
|
|
<li>Name groups consistently.</li>
|
|||
|
|
<li>Use the <a href="rzamvnamingworksheet.htm#namingworksheet">naming
|
|||
|
|
conventions worksheet</a> to document your group naming conventions.</li>
|
|||
|
|
<li>Determine the application and library needs of each user group. Use the <a href="rzamvappdescworksheet.htm#appdescworksheet">application descriptions</a> and <a href="rzamvlibdescworksheet.htm#libdescworksheet">library description worksheets</a>. </li>
|
|||
|
|
<li>Define the job description for user groups.</li>
|
|||
|
|
</ol>
|
|||
|
|
</div>
|
|||
|
|
<p><span class="uicontrol">Planning Primary Groups for Objects</span></p>
|
|||
|
|
<p>Any
|
|||
|
|
object on the system can have a primary group. Primary group authority can
|
|||
|
|
provide a performance advantage if the primary group is the first group for
|
|||
|
|
most users of an object. Often, one group of users is responsible for some
|
|||
|
|
information on the system, such as customer information. That group needs
|
|||
|
|
more authority to the information than other system users. By using primary
|
|||
|
|
group authority, you can set up this type of authority scheme without affecting
|
|||
|
|
the performance of authority checking.</p>
|
|||
|
|
<p><span class="uicontrol">Planning Multiple
|
|||
|
|
Group Profiles</span></p>
|
|||
|
|
<p>A user can be a member of up to 16 groups:
|
|||
|
|
the first group (GRPPRF parameter in the user profile) and 15 supplemental
|
|||
|
|
groups (SUPGRPPRF parameter in the user profile). By using group profiles,
|
|||
|
|
you can manage authority more efficiently and reduce the number of individual
|
|||
|
|
private authorities for objects. However, the misuse of group profiles can
|
|||
|
|
have a negative impact on the performance of authority checking.</p>
|
|||
|
|
<div class="p">Follow
|
|||
|
|
these suggestions when using multiple group profiles: <ul><li>Try to use multiple groups in combination with primary group authority
|
|||
|
|
and eliminate private authority to objects.</li>
|
|||
|
|
<li>Carefully plan the sequence in which group profiles are assigned to a
|
|||
|
|
user. The user’s first group should relate to the user’s primary assignment
|
|||
|
|
and the objects used most often. For example, assume a user called WAGNERB
|
|||
|
|
does inventory work regularly and does order entry work occasionally. The
|
|||
|
|
profile needed for inventory authority (DPTIC) should be WAGNERB’s first group.
|
|||
|
|
The profile needed for order entry work (DPTOE) should be WAGNERB’s first
|
|||
|
|
supplemental group. The sequence in which private authorities are specified
|
|||
|
|
for an object has no effect on authority checking performance.</li>
|
|||
|
|
<li>If you plan to use multiple groups, be sure you understand how using multiple
|
|||
|
|
groups in combination with other authority techniques, such as authorization
|
|||
|
|
lists, may affect your system performance.</li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="section"><h4 class="sectiontitle">Prepare a user description worksheet</h4><p>In
|
|||
|
|
this example, the <a href="rzamvusergrpdescworksheet.htm#usergrpdescworksheet">User group description worksheet</a> includes
|
|||
|
|
the group profile name, the applications and libraries that the group uses.</p>
|
|||
|
|
|
|||
|
|
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" width="100%" frame="border" border="1" rules="all"><caption>Table 1. Example: User Group Description Worksheet</caption><thead align="left"><tr><th colspan="2" valign="top" id="d0e131">User Group Description Worksheet</th>
|
|||
|
|
</tr>
|
|||
|
|
</thead>
|
|||
|
|
<tbody><tr><td colspan="2" valign="top" headers="d0e131 ">Group profile name: <kbd class="userinput">DPTWH</kbd><p>Description
|
|||
|
|
of the group: <kbd class="userinput">Warehouse department</kbd></p>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
<tr><td colspan="2" valign="top" headers="d0e131 ">Primary application for the group: <kbd class="userinput">Inventory
|
|||
|
|
control</kbd><p>List other applications needed by the group: <kbd class="userinput">None</kbd></p>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
<tr><td colspan="2" valign="top" headers="d0e131 ">List each library that the group needs.
|
|||
|
|
Place an <kbd class="userinput">X</kbd> in front of each library that should be
|
|||
|
|
in the initial library list for each group. <ul><li><strong><kbd class="userinput">X</kbd></strong> <kbd class="userinput">ITEMLIB</kbd></li>
|
|||
|
|
<li><strong><kbd class="userinput">X</kbd></strong> <kbd class="userinput">ICPGMLIB</kbd></li>
|
|||
|
|
</ul>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
</tbody>
|
|||
|
|
</table>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="section"><h4 class="sectiontitle">Name group profiles</h4><div class="p">Because a group profile acts
|
|||
|
|
as a special type of user profile, you may want to identify group profiles
|
|||
|
|
on lists and displays. You need to assign them special names. To appear together
|
|||
|
|
on lists, your group profiles should begin with the same characters, such
|
|||
|
|
as GRP (for group) or DPT (for department). Use these guidelines when naming
|
|||
|
|
user groups: <ul><li>User group names can be up to 10 characters long.</li>
|
|||
|
|
<li>The name may include letters, numbers, and the special characters: pound
|
|||
|
|
(#), dollar ($), underline (_), and the at sign (@).</li>
|
|||
|
|
<li>The name cannot begin with a number.</li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
<div class="note"><span class="notetitle">Note:</span> For each group profile, the system assigns a group identification
|
|||
|
|
number (<var class="varname">gid</var>). Normally, you can let the system generate
|
|||
|
|
a <var class="varname">gid</var>. If you use your system in a network, you may need
|
|||
|
|
to assign specific <var class="varname">gid</var>s to group profiles. Check with your
|
|||
|
|
network administrator to verify whether you need to assign IDs.</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="section"><h4 class="sectiontitle">Determine the application and libraries a user group needs</h4><p>If
|
|||
|
|
you have not already done so, add your user groups to the application diagram
|
|||
|
|
and libraries you drew earlier. This visual image will help you decide the
|
|||
|
|
resource and application needs of each group.</p>
|
|||
|
|
<p>On Part 1 of
|
|||
|
|
the <a href="rzamvusergrpdescworksheet.htm#usergrpdescworksheet">User group description worksheet</a>,
|
|||
|
|
indicate the group’s primary application, which is the application they use
|
|||
|
|
most often. List the other applications the group needs.</p>
|
|||
|
|
<div class="p">Look at your <a href="rzamvappdescworksheet.htm#appdescworksheet">application description
|
|||
|
|
worksheet</a> to see the libraries each group needs. Check
|
|||
|
|
with your programmer or application provider to find out the best method for
|
|||
|
|
providing access to these libraries. Most applications use one of these techniques: <ul><li>The application includes the libraries on a user’s initial library list.</li>
|
|||
|
|
<li>The application runs a setup program which places the libraries in the
|
|||
|
|
user’s library list.</li>
|
|||
|
|
<li>Libraries do not need to be in the library list. The application programs
|
|||
|
|
always specify the library.</li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
<div class="p">The system uses a library list to find the files and programs
|
|||
|
|
you need when you run applications. The library list is a list of libraries
|
|||
|
|
the system searches for objects needed by the user. It has two parts: <ol><li>System portion: Specified in the QSYSLIBL system value, the system portion
|
|||
|
|
is used for i5/OS™ libraries.
|
|||
|
|
The default for this system value does not need to be changed.</li>
|
|||
|
|
<li>User portion: The QUSRLIBL system value provides the user portion of the
|
|||
|
|
library list. The user’s job description specifies the initial library list,
|
|||
|
|
or commands after the user is signed on. If you have an initial library list,
|
|||
|
|
it overrides the QUSRLIBL system value. Application libraries should be included
|
|||
|
|
in the user portion of the library list.</li>
|
|||
|
|
</ol>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="section"><h4 class="sectiontitle">Define the job description</h4><p>When
|
|||
|
|
a user signs on the system, the user’s job description defines many characteristics
|
|||
|
|
of the job, including how the job prints, how batch jobs are run, and the
|
|||
|
|
initial library list. Your system comes with a job description, called QDFTJOBD,
|
|||
|
|
which you can use when creating group profiles. However, QDFTJOBD specifies
|
|||
|
|
the QUSRLIBL system value as the initial library list. If you want different
|
|||
|
|
groups of users to have access to different libraries when signing on, you
|
|||
|
|
should create unique job descriptions for each group.</p>
|
|||
|
|
<p>List each library
|
|||
|
|
needed by the group on the User Group Description Form. If the library should
|
|||
|
|
be included on the initial library list in the group’s job description, mark
|
|||
|
|
each library name on the form.</p>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div>
|
|||
|
|
<div class="familylinks">
|
|||
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="rzamvplanusergrp.htm" title="This topic describes what to do to prepare for planning user groups.">Plan user groups</a></div>
|
|||
|
|
</div>
|
|||
|
|
<div class="relconcepts"><strong>Related concepts</strong><br />
|
|||
|
|
<div><a href="rzamvgroupprof.htm" title="Group profiles define authority for a group of users.">Group profiles</a></div>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
</body>
|
|||
|
|
</html>
|