Job owner

akrzy · Post by **akrzy** » Tue Mar 08, 2005 4:52 am

Hi,

Can I create a user who will be responsible just for a few jobs.I would like to give him restricted access to the project.

Anka

Sainath.Srinivasan · Post by **Sainath.Srinivasan** » Tue Mar 08, 2005 5:46 am

What level of access? You can manage users by DataStage clients and by OS level.

T42 · Post by **T42** » Tue Mar 08, 2005 10:33 am

Unfortunately, if you wish for the user to develop, run, and manage several jobs -- this would be very difficult to manage.

That user will require general access to the DataStage engine (by default: dstage), and general access to the project folder in question.

I am sure that it is possible somehow, but it would be an administrative nightmare to handle.

The easiest solution I could think of is a virtual machine with its own disk system.

akrzy · Post by **akrzy** » Wed Mar 09, 2005 3:37 am

I want to create project that would include two users. The former could manage just two jobs and the latter the others.
Thay couldn't open jobs not belongs to them.

Is it possible?

Sainath.Srinivasan · Post by **Sainath.Srinivasan** » Wed Mar 09, 2005 5:15 am

You can provide the corresponding umask and put them in different groups.

Otherwise, you can put the jobs in different projects altogether and grant permissions accordingly.

T42 · Post by **T42** » Wed Mar 09, 2005 5:46 pm

No. You shouldn't separate groups. In fact, you can not really separate groups on a Project-wide level. However, you CAN force an umask to 755, requring the user sole access to that file to run/edit/whatever, but strange things can happen when you attempts that.

Why can't you set different groups on a project-wide level? VOC file needs to be accessed by all. No access to VOC = No access to project, period.

Sainath.Srinivasan · Post by **Sainath.Srinivasan** » Thu Mar 10, 2005 4:53 am

T42,

I am not able to see whether you agree or disagree with my view. You appear to refuse the plan but then propose the same again.

In Unix, you can always have dstage as your secondary group but still use your default group in building objects and hence can control permission through that.

T42 · Post by **T42** » Thu Mar 10, 2005 11:48 am

On UNIX, there are three type of priviledge:

User - Group - Everyone.

You can only have ONE specific type of access right for each file - although there might be some UNIX flavors out there that provided an extension of that. If anyone knows of any, let us know.

You can restrict specific jobs to each user, BUT... You can't allow other users to view the same job, even if it was to just run it.

You can restrict an user to a specific set of group, BUT... The universe engine requires full access for anyone who need to have access privs.

It is possible to manage it, but you are better off creating specific projects for each user.

kcbland · Post by **kcbland** » Thu Mar 10, 2005 12:00 pm

Forget about any effort to manage permissions within a project. Forget it. Do not mess with umask, do not mess with unix file level permissions.

Use the tool as it is intended - users get access to a project or not. If you need to separate jobs by user within a project, your solution is to separate your jobs into different projects.

roy · Post by **roy** » Sun Mar 13, 2005 12:40 am

Hi,
I second Ken's Opinion.
You could try having 3 projects.
1. complete and read only
2. for developer #1
3. for developer #2

then you need a privilaged person to manage transfer of all the things in between plus permitions.

in short not worth the trouble, unless you automate it some how.

I'v heard of people who binded their development process via a version control that has checkin checkout mechanism (implementing import/export between projects).

the bottom line IMHO is you have to make up your mind if you want them to be on the same project forget the access limitations, otherwise put them on seperate ones.

IHTH,