Data Stage User roles

pavan.nadiger · Post by **pavan.nadiger** » Wed Mar 07, 2007 4:48 am

We are trying to implement access control policy on our production environment. We have been exploring two options as of now:
1. Releaseing jobs and thus creating read only jobs.
2. Protecing a project.

However both these options does not allow us to have a staged access policy. What we are aiming at is to create one user who has complete access to the system and can modify jobs and another user who only has read only access and the user can only analyze the server jobs.

Need pointers on possibilties of creating such user roles.

kumar_s · Post by **kumar_s** » Wed Mar 07, 2007 4:52 am

Hi Pavan,

Welcome to Dsxchange :D !!!

Both option works. If you have dsadm you have the full access.
If you have Operator role assigned to a user, it will have only the access to change the runtime informations.

pavan.nadiger · Post by **pavan.nadiger** » Wed Mar 07, 2007 6:34 am

Thanks for the welcome Kumar. :D

Well you could consider it as my naivity in Datastage, but i am unable to understand the use of dsadm.

At present the datastage server is hosted on a Windows 2003 server and we have assigned the three roles available in datastage to the various windows user groups.
However even if the user role is Datastage Production Manager, he is not allowed to modify jobs in a protected project. We had initially considered to have a user as Datastage Production Manager to have complete rights and a user with Datastage Developer role to have restricted/ read only rights.

Thanks for all the help in advance.

gbusson · Post by **gbusson** » Wed Mar 07, 2007 6:44 am

Hi,

i do not understand why you need to have full access on a production project.

This is quite dangerous!

I'm not sure that dsadm has full access to a protected project. I triad with a 7.0 version, it does not work.

My opinion :

Protecte projects are a good solution.

If you want to have fulle acces to production, create a copy of the production project, unprotected.

kumar_s · Post by **kumar_s** » Wed Mar 07, 2007 6:45 am

Thats true, Production Manager will have full access including Protected project. Operator will have only runtime access. May I know, where are you stuck now?

gbusson · Post by **gbusson** » Wed Mar 07, 2007 6:47 am

production manager can import in protected projects.

Operator can only see released jobs, useless if you are using protected projects.

pavan.nadiger · Post by **pavan.nadiger** » Wed Mar 07, 2007 7:32 am

Thanks for all the responses.

The problem we are stuck up right now is that we have single user access to all, and thus there are accidenental amendements which take place on server jobs during issues investigation.
Right now we are looking at two different roles on the environment:
1. Production Support Manager - who takes care of schedule runs and can make amendments in the job in case of any schedule failures. As we are looking at a daily overnight runs, the manager should be able to make quick changes then and there.
2. Developer/ support Engineer - This user role will be basically used to investigate issues with data and if he finds any issues in any of the datastage jobs, he can report it back to the production manager. This user will have read only access on jobs.

chulett · Post by **chulett** » Wed Mar 07, 2007 7:42 am

You'll find most people here will heartily disagree with #1. Changes outside of the development environment should be strictly forbidden and you enforce this either by using Protected projects or a tool like Version Control which can ensure that jobs in those environments are Read Only.

kumar_s · Post by **kumar_s** » Wed Mar 07, 2007 5:07 pm

So you need to create many users and assign the roles accordingly.