Getting Started with Job Management Manager › Controlling Job Access › Identifier-Based Access to Jobs

Identifier-Based Access to Jobs

In addition to the UIC privilege-based security scheme, you can control job access through Job Management Manager using rights identifiers. Each job may have the following identifiers:

• READ
• WRITE
• EXECUTE

If the requesting process also holds that identifier, then access is granted. This feature allows access control to individual jobs on a user-by-user basis, and eliminates the need for privileges for operations personnel. It also removes the need for privileged proxy accounts for remote control of privileged jobs.

The identifiers that are supported in the manager are "general identifiers," or identifiers that can be created with the OpenVMS AUTHORIZE utility and stored in the file RIGHTSLIST.DAT:

• ADD/IDENTIFIER: OpenVMS AUTHORIZE command to create an identifier
• GRANT/IDENTIFIER: OpenVMS AUTHORIZE command to grant an identifier to a user

Identifier qualifiers do not appear in the DCL user interface as prompts to the CREATE, MODIFY, or COPY commands; they must be explicitly specified on the command line. In the DCL interface, the following qualifiers control the identifiers:

• /RDID, for READ access
• /EXID, for EXECUTE access
• /WRID, for WRITE access

Identifier qualifiers appear in the DECwindows user interface.

The following privileges are required to set job identifiers:

• WRITE access to the job is required to set the READ identifier.
• SYSPRV privilege is required to set the EXECUTE identifier.
• CMKRNL privilege is required to set the WRITE identifier.

Only one identifier value is supported for each of the identifier access qualifiers.