Greetings. I have some questions concerning the use of the "UID" field. We are running CA-7 11.3 and using RACF for external security. We have always defined jobs to CA-7 with the default UID=0 and do not use the "OWNER" field. For the sake of simplicity, lets say we have three groups of users: Operations staff and two, large Application staff groups. The Operations staff has full access to CA-7. The two Application staff groups can view most panels and commands but they cannot effect any changes in CA-7 directly (demand, run, post, add, del, etc.)
- Both Application staff groups can see all jobs in CA-7 even though they have no need to look at the jobs owned by the other group.
- "Group 1" runs only production jobs in CA-7.
- "Group 2" runs production jobs and a model-office ("MO") series of jobs. These pretty much mirror the production batch cycles but run essentially as a staging environment. Still, both PROD and "MO" reside in the same CA-7.
We would like to do the following:
- Allow the Operations staff to view only production jobs under one profile resource name while restricting each Application group to viewing their own production jobs.
- Allow the Operations staff to view all "MO" jobs under a second profile resource name.
- Allow Group 1 to see only their production workload under a single profile resource name.
- Allow Group 2 to see only their production workload under a single profile resource name.
- Allow Group 2 to see their "MO" jobs under a second profile resource name. We would also like to allow them the ability to post job dependencies, add dependencies and user requirements.
My understanding of how this is supposed to work is as follows:
- A profile resource is defined and associated with a UID. An example would be:
- resource = CA70001 and the UID = 001 (Application Group 1 prod jobs)
- resource = CA70002 and the UID = 002 (Application Group 2 prod jobs)
- resource = CA70003 and the UID = 003 (Application Group 2 MO jobs)
- A RACF group is then provided access to one or more of the resource profiles.
- To view the production jobs of either Group 1 or 2, or the "MO" jobs, the operations staff would need to logon to CA-7 and designate the corresponding resource profile. Given that my example is simplified, meaning there are a few other groups, having to bounce back and forth between resource profiles is inconvenient.
Question 1: Is there any way to have a resource profile given access to more than one UID? (I know resource profiles must be uniquely named and that different resource profiles may be associated with the same UID).
Question 2: Is there a way for our Operations staff to view UIDs "1" and "2" together in the same XQJ display?
After reading the manual and talking with our system's programmer about this I figure I'm going to be disappointed. To paraphrase the little boy pleading with Shoeless Joe Jackson, "Say it aint't so CA! Say it ain't so!"