Customization › Implementing Security with SAF › Internal SAF

Internal SAF

This is an internal SAF interface example of how to define users to CA Spool:

SAFUID SUPER,LABEL=SUPER                                    
SAFUID OPER,LABEL=(SUPER,OPER)                              
SAFUID JUNIOR,LABEL=JUNIOR                                  
SAFUID ORDINA,LABEL=ORDINA,DGROUP=1                         
SAFUID TINY,LABEL=TINY                                      
SAFAT SUPER,DATASET=ESFSECU.**,ACCESS=UPDT                  
SAFAT OPER,DATASET=ESFSECU.CMND.REINIT,ACCESS=NONE          
SAFAT OPER,DATASET=ESFSECU.CMND.SHUTDOWN,ACCESS=NONE        
SAFAT JUNIOR,DATASET=ESFSECU.AUTH.GLACC,ACCESS=READ         
SAFAT JUNIOR,DATASET=ESFSECU.AUTH.ALLGR,ACCESS=READ         
SAFAT JUNIOR,DATASET=ESFSECU.NOGR%%.G0000001,ACCESS=UPDT    
SAFAT JUNIOR,DATASET=ESFSECU.NOGR%%.G0000002,ACCESS=UPDT    
SAFAT JUNIOR,DATASET=ESFSECU.FIGR%%.G0000001.&.*,ACCESS=UPDT
SAFAT JUNIOR,DATASET=ESFSECU.FIGR%%.G0000002.&.*,ACCESS=UPDT
SAFAT JUNIOR,DATASET=ESFSECU.CMND.*,ACCESS=READ             
SAFAT ORDINA,DATASET=ESFSECU.NOGR%%.G0000001,ACCESS=UPDT    
SAFAT ORDINA,DATASET=ESFSECU.FIGR%%.G0000001.&.*,ACCESS=UPDT
SAFAT ORDINA,DATASET=ESFSECU.FIGR%%.G0000001.**,ACCESS=READ 
SAFAT ORDINA,DATASET=ESFSECU.CMND.*,ACCESS=READ             
SAFAT TINY,DATASET=ESFSECU.NONO%%.PRT1A,ACCESS=UPDT         
SAFAT TINY,DATASET=ESFSECU.FINO%%.PRT1A.&.*,ACCESS=UPDT     
SAFAT TINY,DATASET=ESFSECU.CMND.*,ACCESS=READ               

Authorizations Established

In the previously mentioned examples:

• The user named SUPER has access to do everything possible in CA Spool.
• The user named OPER has one restriction, not allowed to issue the REINIT and SHUTDOWN commands.
• The user named JUNIOR is allowed to display all resources in CA Spool, update all printers in the groups 1 and 2, and update all files in groups 1 and 2 with that user ID.
• The user named ORDINA is allowed to display and update all printers in group 1. Can browse all files in group 1, but can only update the files with that user ID.
• The user named TINY is allowed to display and update the printer named PRT1A. Allowed to browse and update the files with a destination of PRT1A with that user ID.