Limiting access to a user in Autosys

[Richard Pearson]

Hi all. 

I am currently trying to work out user access rights in Autosys. I have created a user in EEM and have created policies so that this user can only access JSC and can only view jobs. This user can not create,edit etc.

However where I am stuck is in trying to allow this user viewing rights on only certain jobs or boxes. I have been trying all sorts for days now but am no closer to a solution.

Any ideas?

Thanks in advance.

Richard

[Ramon.F...@bbh.com]

1) You basically need  to use MonitorView Control and as_job.  Assuming you already have views and Jobflows, if not create them first.
 2) MonitorView - create the policy here for the views you need.
3) go to as_job and then create a policy for this user.,   I  might use the ACL policy - if you are goint to specify certain jobs and the access.
4) go to the Resources (ACL Configuration) and type the server.job names (you can use ? for global characters.

This is more or less  the process.


Thanks
Ramon

--
You received this message because you are subscribed to the Google Groups "AutoSys" group.
To unsubscribe from this group and stop receiving emails from it, send an email to autosys+u...@googlegroups.com.
To post to this group, send email to aut...@googlegroups.com.
Visit this group at http://groups.google.com/group/autosys.
For more options, visit https://groups.google.com/d/optout.

*************************** IMPORTANT NOTE*****************************-- The opinions expressed in this message and/or any attachments are those of the author and not necessarily those of Brown Brothers Harriman & Co., its subsidiaries and affiliates ("BBH"). There is no guarantee that this message is either private or confidential, and it may have been altered by unauthorized sources without your or our knowledge. Nothing in the message is capable or intended to create any legally binding obligations on either party and it is not intended to provide legal advice. BBH accepts no responsibility for loss or damage from its use, including damage from virus. ********************************************************************************

[Richard Pearson]

Thanks Ramon

In the monitorview policy I am battling to add any resources. EEM keeps giving me a EE_POZERROR Repository Error, ISE_NOSUCHOBJECT no such object exists.

I guess I am formatting it wrong but I cant find any documentation on the correct formatting.

How would this work regarding other views though?

Other users would need to be able to run / view certain jobs only. Other users again would have permissions to create new jobs but only in certain boxes.

I am totally lost here about how you limit a user/group to being able to work on specific jobs only.

Thanks

Richard

On Friday, March 14, 2014 11:56:27 AM UTC, RF wrote:

1) You basically need  to use MonitorView Control and as_job.  Assuming you already have views and Jobflows, if not create them first.
 2) MonitorView - create the policy here for the views you need.
3) go to as_job and then create a policy for this user.,   I  might use the ACL policy - if you are goint to specify certain jobs and the access.
4) go to the Resources (ACL Configuration) and type the server.job names (you can use ? for global characters.

This is more or less  the process.


Thanks
Ramon




From:        Richard Pearson <rdpear...@gmail.com>
To:        aut...@googlegroups.com
Date:        03/14/2014 05:20 AM
Subject:        Limiting access to a user in Autosys
Sent by:        aut...@googlegroups.com

---

Hi all.

I am currently trying to work out user access rights in Autosys. I have created a user in EEM and have created policies so that this user can only access JSC and can only view jobs. This user can not create,edit etc.

However where I am stuck is in trying to allow this user viewing rights on only certain jobs or boxes. I have been trying all sorts for days now but am no closer to a solution.

Any ideas?

Thanks in advance.
Richard

--
You received this message because you are subscribed to the Google Groups "AutoSys" group.

To unsubscribe from this group and stop receiving emails from it, send an email to autosys+unsubscribe@googlegroups.com.

To post to this group, send email to

aut...@googlegroups.com.
Visit this group at http://groups.google.com/group/autosys.
For more options, visit https://groups.google.com/d/optout.

[Ramon.F...@bbh.com]

Hi:

1) It can be done, but it takes time to plot this out.

2) You need the WA_Security Docs, the WCC Implementation Book.

Last, you can post some of the questions here, but at this time your scope is too big to be done via the Group.

I suggest that you plot first what you want. I do it on a piece of paper,   left side if what (the jobs and views) on the right the users and or groups
then start writing in between, by adding the access rights, and other policies.

But so far I have found that the Monitoring and the as_job are the 2 basic policies you need.

It can be done, I have what we call emergency id's that have all the access to specific jobs and no one else including the admins have no access other than to view the failures or alarms reported.

To unsubscribe from this group and stop receiving emails from it, send an email to autosys+u...@googlegroups.com.

To post to this group, send email to

aut...@googlegroups.com.
Visit this group at http://groups.google.com/group/autosys.
For more options, visit https://groups.google.com/d/optout.

*************************** IMPORTANT NOTE*****************************-- The opinions expressed in this message and/or any attachments are those of the author and not necessarily those of Brown Brothers Harriman & Co., its subsidiaries and affiliates ("BBH"). There is no guarantee that this message is either private or confidential, and it may have been altered by unauthorized sources without your or our knowledge. Nothing in the message is capable or intended to create any legally binding obligations on either party and it is not intended to provide legal advice. BBH accepts no responsibility for loss or damage from its use, including damage from virus. ********************************************************************************

--

You received this message because you are subscribed to the Google Groups "AutoSys" group.

To unsubscribe from this group and stop receiving emails from it, send an email to autosys+u...@googlegroups.com.

To post to this group, send email to

aut...@googlegroups.com.
Visit this group at http://groups.google.com/group/autosys.
For more options, visit https://groups.google.com/d/optout.

[Richard Pearson]

Thanks again for your help Ramon.

We run four almost identical environments. 2 testing, a pre production and our live jobs. They all use the same instance of WCC to control them.

I was hoping that it might be easy to group the jobs/boxes into categories by possibly having an "ID" in the group field. EG, UAT, BAT, PP, Live. It would not be feasible to do it via job names as new jobs get added/removed regularly and I wouldnt want to have to  update policies for every change, hence the hope that I could use some form of ID as above.

I would then have a group for view access, job start/stop etc, and full access for each for a total of 12 groups.  Any users could then just be added to their appropriate group(s). For obvious reasons I dont want anybody working in the test environment to have any possibility of doing anything to the live systems while they are testing.

I assumed (wrongly it seems :(  ) that this would be a rather straightforward procedure.

I will dig those manuals out and have another read to try work out how to do this. Thanks again for you input.

Cheers

Richard

To unsubscribe from this group and stop receiving emails from it, send an email to autosys+unsubscribe@googlegroups.com.

To post to this group, send email to

aut...@googlegroups.com.
Visit this group at http://groups.google.com/group/autosys.
For more options, visit https://groups.google.com/d/optout.

*************************** IMPORTANT NOTE*****************************-- The opinions expressed in this message and/or any attachments are those of the author and not necessarily those of Brown Brothers Harriman & Co., its subsidiaries and affiliates ("BBH"). There is no guarantee that this message is either private or confidential, and it may have been altered by unauthorized sources without your or our knowledge. Nothing in the message is capable or intended to create any legally binding obligations on either party and it is not intended to provide legal advice. BBH accepts no responsibility for loss or damage from its use, including damage from virus. ********************************************************************************

--
You received this message because you are subscribed to the Google Groups "AutoSys" group.

To unsubscribe from this group and stop receiving emails from it, send an email to autosys+unsubscribe@googlegroups.com.

To post to this group, send email to

aut...@googlegroups.com.
Visit this group at http://groups.google.com/group/autosys.
For more options, visit https://groups.google.com/d/optout.