Writing Rules › Cross-Reference Role Group (X-ROL) Records › How X-ROL Record Works › X-ROL Record Fields › X-ROL Field Descriptions

X-ROL Field Descriptions

rolename

Specifies a one- to eight character name of the role.

ROLE|GROUP

Specifies the function of the record.

• ROLE indicates that the record defines a group of users. The default value is ROLE.
• GROUP indicates that the record defines a group of roles. Specify GROUP only when you want to define an X ROL record that includes other X ROL records.
• DESCRIPT(description)

Specifies any text string up to 100 characters. May be used to describe the role or group and its intent.

INCLUDE(entry1,...,entryn)

Specifies the users, group of users, roles or groups of roles that you want to include in the record.

Each entry (whether it is a logonid or a record ID) can consist of a maximum of eight characters. Separate the entries with commas or blanks. Entries can be masked using the asterisk or dash characters. This field is limited only by the size of the record and the size of the other fields in the record. The combined length cannot be larger than 16K.

• If you specify ROLE, INCLUDE specifies the individual logonids that belong to this role group.
• If you specify the GROUP keyword, INCLUDE specifies the record IDs of the X ROL records that are included by this X ROL record.

You can specify user IDs. You cannot specify both in the same X ROL record. That is, if you want to use both the ROLE and the GROUP functions, you must define a separate X ROL record for each and define a unique record ID for each record.

EXCLUDE(entry1,...,entryn)

Specifies the users, group of users, roles or groups of roles that you do not want to include in the record. Specify EXCLUDE entries only when you mask the INCLUDE field. For example, suppose you have 20 users whose logonids all begin with LV1 and you want to include all but two of these logonids in your role. Specify LV1- in the INCLUDE field and specify the full logonids of the two users you want to exclude, LV105 and LV106, in the EXCLUDE field.

Each entry (whether it is a logonid or a record ID) can consist of a maximum of eight characters. Separate the entries with commas or blanks. Entries can be masked. For details on how to use masking characters, see Masking Logonid Records in the chapter "Maintaining Logonid Records." This field is limited only by the size of the record and the size of the other fields in the record. The combined length cannot be larger than 16K.

• If you specify ROLE, EXCLUDE specifies the logonids that are excluded from the group defined by the INCLUDE field.
• If you specify GROUP, EXCLUDE specifies the record IDs to be excluded from the set of X ROL records that this X ROL record cross references.

You can specify logonids or record IDs; you cannot specify both in the same X ROL record. That is, if you want to use both the ROLE and the GROUP functions, you must define a separate X ROL record for each and define a unique record ID for each record.

EXCLUDE statements only apply to the group specified; they do not apply to any groups of groups. If an EXCLUDE is done for a group that includes another group, a security exposure might result.