Previous Topic: Product SecurityNext Topic: Passkey and Row Level Security


User Security

The ADD USER statement of DDDL syntax documents users in the data dictionary by assigning users the authority to access secured products and to perform secured operations, among many other functions.

The INCLUDE AUTHORITY FOR UPDATE IS Culprit clause specifies that only users with CA Culprit authority can authorize other users to access files and subschemas to run CA Culprit reports. In the example shown below, user ABC can authorize other users access to files and subschemas to run CA Culprit reports, while user DEF is not:

ADD USER NAME IS ABC
    INCLUDE AUTHORITY FOR UPDATE IS Culprit.
ADD USER NAME IS DEF
    EXCLUDE AUTHORITY FOR UPDATE IS Culprit.

The following clauses give a user access to subschemas, conventional files defined to the data dictionary, and tables:

To remove authority, specify EXCLUDE in place of INCLUDE in the clauses above.

Users can also make changes to record layouts and file definitions if the user is assigned the OVERRIDES option:

ADD USER NAME IS ABC
    Culprit OVERRIDES ARE NOT ALLOWED.

This clause applies to input files or keyfiles that are defined to the data dictionary. As described in Auto Attribute Security, CA Culprit automatically supplies the information necessary to characterize files and fields that are used in a CA Culprit run and defined to the data dictionary. This clause prevents a user from overriding these automatically supplied characteristics, as follows: