SirLib security - Revision history

JAL: more conversion cleanup

2015-10-22T00:07:39Z

more conversion cleanup

← Older revision		Revision as of 00:07, 22 October 2015
Line 27:		Line 27:
	<p class="figure">[[File:SlibSysSecurity.png\|450px]]</p>		<p class="figure">[[File:SlibSysSecurity.png\|450px]]</p>

	Protectable <var class="product">SirLib</var> functions are described in the following table. ~~Access~~ to administration functions ~~(main menu option 3)~~ and to procedure locks ~~(main menu option 7)~~ is open to users in the <var>ADMIN SCLASS</var> for the <var>SIRLIB</var> application subsystem~~, and through the main menu <b>Administration</b> option itself~~.		The <b>Secure</b> column is display only; the column values, described in the following table, may be changed in the <b>SIRLIB Administration</b> screen.
			<table>
			<tr class="head"><th>File's <b>Secure</b> column value</th><th>Meaning</th></tr>

			<tr><td>blank</td>
			<td>File defaults to the <b>System default</b> setting.</td></tr>

			<tr><td>Y</td>
			<td>File uses SirLib file-specific security settings.

			<tr><td>N</td>
			<td>File ignores security altogether.</td></tr>
			</table>

			Files cannot be added to <var class="product">SirLib</var> through the <b>Security</b> screen. Lines after the last registered file are protected. To add a new file, define a profile for it first using the <b>SIRLIB Administration</b> screen.

			Protectable <var class="product">SirLib</var> functions are described in the following table. Main menu access to administration functions and to procedure locks is open to users in the <var>ADMIN SCLASS</var> for the <var>SIRLIB</var> application subsystem.

	<table class="thJustBold">		<table class="thJustBold">
Line 85:		Line 101:
	If <b>System defaults</b> is <code>Y</code> to protect the function, the user must have file-specific privileges to perform the function on the file. This lets an administrator set only a single system default profile for security, and then have only user privileges to maintain. File-specific overrides of the system profile take effect immediately, and effect all users.		If <b>System defaults</b> is <code>Y</code> to protect the function, the user must have file-specific privileges to perform the function on the file. This lets an administrator set only a single system default profile for security, and then have only user privileges to maintain. File-specific overrides of the system profile take effect immediately, and effect all users.

			If <b>Secure</b> is <code>N</code> on the <b>Administration</b> screen, all security settings are ignored for the system (if <b>Secure</b> is off in the system profile) or for individual files (if <b>Secure</b> is off in a file profile). Security privileges may still be defined, but <var class="product">SirLib</var> will not pay attention to them.

	If <b>Secure</b> is <code>N</code> on the <b>Administration</b> screen, all security settings are ignored for the system (if <b>Secure</b> is off in the system profile) or for individual files (if <b>Secure</b> is off in a file profile). Security privileges may still be defined, but <var class="product">SirLib</var> will not pay attention to them.
	Security can be bypassed in emergencies by turning it off for a file or		Security can be bypassed in emergencies by turning it off for a file or
	for the system, and user privileges do not get lost. <b>Secure</b> set to <code>Y</code> on a file record secures a file even when the system default for <b>Secure</b> is <code>N</code>.		for the system, and user privileges do not get lost. <b>Secure</b> set to <code>Y</code> on a file record secures a file even when the system default for <b>Secure</b> is <code>N</code>.


	~~<i>The <b>Secure</b> column is display only</i>.~~
	~~The <b>Secure</b> setting is changed in the Administration menu.~~
	~~On this screen, the setting identifies which files will~~
	~~default to the system settings (the settings on the top line), which~~
	~~will use file security settings, and which will ignore security~~
	~~altogether (<var>SECURE</var> set to <code>N</code>).~~

	~~Files cannot be added to <var class="product">SirLib</var> through the <b>Security</b> screen.~~
	~~Lines after the last registered file are protected on the <b>Security</b> screen.~~
	~~To add a new file to <var class="product">SirLib</var>, define a profile for it first in the Administration Option.~~

	==User security for a file==		==User security for a file==
Line 110:		Line 114:

	New users may be added in the blank lines at the bottom of the screen		New users may be added in the blank lines at the bottom of the screen
	(PF8 allows scrolling below the last user until blank lines are displayed)~~. Though this screen looks similar to the <b>Security</b> screen for system settings, the settings on user lines <i>grant access</i> to resources that may be protected~~.		(PF8 allows scrolling below the last user until blank lines are displayed).

	A <code>Y</code> in the <b>File:</b> line means the resource is		<blockquote class="note">
	protected~~. A~~ <code>Y</code> in one of the user lines for the same resource grants that user access to the protected resource.		<p><b>Note:</b> Though this screen looks similar to the <b>Security</b> screen for system settings, the settings on user lines <i>grant access</i> to resources that may be protected. Although a <code>Y</code> in the <b>File:</b> line means the resource is protected, a <code>Y</code> in one of the user lines for the same resource grants that user access to the protected resource. </p>
			<p>
			Also, any character you enter for a user is converted to <code>Y</code> when you press the Enter key. You must leave blank the column for a feature the user is <i>not</i> permitted to use.</p>
			</blockquote>

			Users may be granted access to resources that are not specified as protected, but their privileges are not verified
			unless the resource is switched to protected in the future.

	(Any character entered is converted to <code>Y</code> when the user presses the Enter key). Users may be granted access to resources that are not specified as protected, but their privileges are not verified		Changes on this screen are not committed until the user presses PF12.
	~~unless the resource is switched to protected in the future.~~
	~~As with the System/File defaults screen, changes~~ on this screen are not
	committed until the user presses ~~PF10~~.

	==See also==		==See also==

JAL: more conversion cleanup

2015-10-21T20:58:09Z

more conversion cleanup

Show changes

JAL: minor cleanup

2015-10-21T17:03:07Z

minor cleanup

← Older revision		Revision as of 17:03, 21 October 2015
Line 20:		Line 20:
	<p class="figure">[[File:SlibSysSecurity.png\|450px]]</p>		<p class="figure">[[File:SlibSysSecurity.png\|450px]]</p>

	Protectable <var class="product">SirLib</var> functions are described in the following table. Access to administration functions (main menu option 3) and to procedure locks (main menu option 7) is open to users in the <var>ADMIN SCLASS</var> for the <var>SIRLIB</var> application subsystem, and through the <b>Administration</b> option itself.		Protectable <var class="product">SirLib</var> functions are described in the following table. Access to administration functions (main menu option 3) and to procedure locks (main menu option 7) is open to users in the <var>ADMIN SCLASS</var> for the <var>SIRLIB</var> application subsystem, and through the main menu <b>Administration</b> option itself.

	<table class="thJustBold">		<table class="thJustBold">

JAL: more conversion cleanup

2015-10-21T17:01:29Z

more conversion cleanup

← Older revision		Revision as of 17:01, 21 October 2015
Line 3:		Line 3:
	You've been warned. .. (Page built by JAL at the SIRIUS VM; file: FUNPGNEW SYSUT2) -->		You've been warned. .. (Page built by JAL at the SIRIUS VM; file: FUNPGNEW SYSUT2) -->
	<!-- Page name: SirLib security-->		<!-- Page name: SirLib security-->
	<var class="product">SirLib</var> security does not directly protect files.		<var class="product">SirLib</var> security does not directly protect files. Because programmers will be working most of the time in <var class="product">SirPro</var>, a simple way to ensure consistent use of the <var class="product">SirLib</var>/<var class="product">SirPro</var> system is:
	Because programmers will be working most of the time in <var class="product">SirPro</var>,		<ol>
	a simple way to ensure consistent use of the <var class="product">SirLib</var>/<var class="product">SirPro</var> system		<li>Make all managed procedure files <var>PUBLIC</var> with low (read-only) privileges. </li>
	~~is to make~~ all managed procedure files ~~PUBLIC with low (read-only)~~
	~~privileges, and then to allocate those procedure files to~~ <var ~~class="product"~~>~~SirPro~~</var>
	with read ~~privileges and to <var class="product">SirLib</var> with update~~ privileges.
	~~This allows programmers to make copies of the procedures they need but not~~
	~~to change anything in the managed files, forcing all updates to go through~~
	~~<var class="product">SirLib~~</~~var~~>.

	~~Details on this kind of conversion are given in [[SirLib~~ "~~getting started~~" ~~steps]]~~.		<li>Allocate those procedure files to <var class="product">SirPro</var> with read privileges and to <var class="product">SirLib</var> with update privileges. </li>
			</ol>

	This ~~does not <i>force</i> users~~ to ~~use the managed update features~~		This allows programmers to make copies of the procedures they need but not to change anything in the managed files, forcing all updates to go through <var class="product">SirLib</var>. Details on this kind of arrangement are given in [[SirLib "getting started" steps]].
	~~of <var class="product">SirPro</var> (that is, it doesn't prevent users taking "unmanaged"~~
	copies of ~~code~~ to ~~use in development work or for models~~ in ~~ad-hoc~~
	~~reports, etc.), but it does ensure that only changes done through~~ the
	~~<var class="product">SirPro</var> and <var class="product">SirLib</var>~~ managed ~~update features will get cycled into the production~~ files.
	~~Users with access~~ to <var class="product">SirLib</var> ~~can define projects and~~
	~~reconfigure and cutover files~~.
	~~And the <var class="product">~~SirLib~~</var> administrator has only~~
	~~to be concerned with protecting user access to the updating functions~~
	~~of <var class=~~"~~product~~"~~>SirLib</var>~~.

	~~Protectable functions in~~ <var class="product">~~SirLib~~</var> ~~are Changes~~, ~~Configuration~~, ~~Cutover~~, and ~~Reports~~.		This set up does not <i>force</i> users to use the managed update features of <var class="product">SirPro</var> (that is, it does not prevent users taking "unmanaged" copies of code to use in development work or for models in ad-hoc reports, etc.), but it does ensure that only changes done through the <var class="product">SirPro</var> and <var class="product">SirLib</var> managed update features will get cycled into the production files. Users with access to <var class="product">SirLib</var> can define projects and reconfigure and cutover files. And the <var class="product">SirLib</var> administrator has only to be concerned with protecting user access to the updating functions of <var class="product">SirLib</var>.
	~~In addition,~~ <var class="product">SirLib</var> ~~security allows administrators to protect~~
	the ~~Resequencing feature in~~ <var class="product">~~SirPro~~</var> ~~(the Z prefix command).~~		==SirLib system security==
	~~Access~~ to ~~Administration functions (Option 3) and~~ to ~~View/Clear Procedure Locks (Option 7) is via the ADMIN SCLASS for~~ the <var>~~SIRLIB~~</var> ~~application subsystem, and through~~ the ~~Administration~~ option ~~itself~~.		You access the SirLib security screens from option 4 of the [[SirLib change control\|SirLib main menu]]. This section discusses the system settings; the next section discusses the file settings. Access to the Security option is restricted to users defined as file or system Administrators in the [[SirLib_change_control#Administering_system_and_file_profiles\|Administration screen]].
	Access to the Security option is restricted to users defined as file or system Administrators in the Administration screen.

	<p class="caption" style="width:450px">SirLib System Security profile</p>		<p class="caption" style="width:450px">SirLib System Security profile</p>
	<p class="figure">[[File:.png\|450px]]</p>		<p class="figure">[[File:SlibSysSecurity.png\|450px]]</p>

			Protectable <var class="product">SirLib</var> functions are described in the following table. Access to administration functions (main menu option 3) and to procedure locks (main menu option 7) is open to users in the <var>ADMIN SCLASS</var> for the <var>SIRLIB</var> application subsystem, and through the <b>Administration</b> option itself.

	<table class="thJustBold">		<table class="thJustBold">
Line 48:		Line 35:

	<tr><th>ReSequencing</th>		<tr><th>ReSequencing</th>
	<td>~~This function is a prefix~~ command in <var class="product">SirPro</var> ~~which~~ builds an update procedure to ~~re-number~~ the internal sequence numbers used to keep track of changes to a procedure.		<td>Administrators can protect the [[SirLib programmer's reference#Z (RESEQUENCE) command\|Resequencing]] feature in <var class="product">SirPro</var> (the <var>Z</var> prefix command). This command builds an update procedure to renumber the internal sequence numbers used to keep track of changes to a procedure.
	<p>		<p>
	~~This function isused when~~ a great many changes have occurred against a single		If a great many changes have occurred against a single procedure, this function keeps the system from overflowing the sequence numbers; it is rarely needed. The consequence of resequencing a procedure when a programmer is in the midst of building changes is that the programmer's changes will not validate against the new line numbers. </p></td></tr>
	procedure, ~~to keep~~ the system from overflowing the sequence numbers~~. It~~ is rarely needed~~, and the consequences~~ of resequencing a procedure when a programmer is in the midst of building changes is that the programmer's changes will not validate against the new line numbers. </p></td></tr>

	<tr><th>Reports</th>		<tr><th>Reports</th>
Line 138:		Line 124:

	<p class="caption" style="width:450px">Maintaining the SirLib user security table</p>		<p class="caption" style="width:450px">Maintaining the SirLib user security table</p>
	<p class="figure">[[File:~~SlibSecurity~~.png\|450px]]</p>		<p class="figure">[[File:SlibFileSecurity.png\|450px]]</p>

	New users may be added in the blank lines at the bottom of the screen		New users may be added in the blank lines at the bottom of the screen

JAL: more conversion cleanup

2015-10-21T00:42:42Z

more conversion cleanup

← Older revision		Revision as of 00:42, 21 October 2015
Line 13:		Line 13:
	<var class="product">SirLib</var>.		<var class="product">SirLib</var>.

	Details on this ~~sort~~ of conversion are given in [[SirLib "getting started" steps]].		Details on this kind of conversion are given in [[SirLib "getting started" steps]].

	This does not <i>force</i> users to use the managed update features		This does not <i>force</i> users to use the managed update features
	of <var class="product">SirPro</var> (that is, it doesn't prevent users taking "unmanaged"		of <var class="product">SirPro</var> (that is, it doesn't prevent users taking "unmanaged"
	copies of code to use in development work or for models in ad-hoc		copies of code to use in development work or for models in ad-hoc
	reports, etc.) but it does ensure that only changes done through the		reports, etc.), but it does ensure that only changes done through the
	<var class="product">SirPro</var> and <var class="product">SirLib</var> managed update features will get cycled into the		<var class="product">SirPro</var> and <var class="product">SirLib</var> managed update features will get cycled into the production files.
	production files.
	Users with access to <var class="product">SirLib</var> can define projects and		Users with access to <var class="product">SirLib</var> can define projects and
	reconfigure and cutover files.		reconfigure and cutover files.
Line 27:		Line 26:
	of <var class="product">SirLib</var>.		of <var class="product">SirLib</var>.

	Protectable functions in <var class="product">SirLib</var> are Changes, Configuration, Cutover and		Protectable functions in <var class="product">SirLib</var> are Changes, Configuration, Cutover, and Reports.
	Reports.
	In addition, <var class="product">SirLib</var> security allows administrators to protect		In addition, <var class="product">SirLib</var> security allows administrators to protect
	the Resequencing feature in <var class="product">SirPro</var> (the Z prefix command).		the Resequencing feature in <var class="product">SirPro</var> (the Z prefix command).
	Access to		Access to Administration functions (Option 3) and to View/Clear Procedure Locks (Option 7) is via the ADMIN SCLASS for the <var>SIRLIB</var> application subsystem, and through the Administration option itself.
	Administration functions (Option 3) and to View/Clear Procedure Locks
	(Option 7) is via the ADMIN SCLASS for the <var>SIRLIB</var> application subsystem, and through the Administration option itself.
	Access to the Security option is restricted to users defined as file or system Administrators in the Administration screen.		Access to the Security option is restricted to users defined as file or system Administrators in the Administration screen.

	<p class="caption" style="width:450px">~~SIRLIB File~~ Security ~~Maintenance~~</p>		<p class="caption" style="width:450px">SirLib System Security profile</p>
	<p class="figure">[[File:~~SlibSecurity~~.png\|450px]]</p>		<p class="figure">[[File:.png\|450px]]</p>

	<table class="thJustBold">		<table class="thJustBold">
Line 44:		Line 40:

	<tr><th>Reconfigure</th>		<tr><th>Reconfigure</th>
	<td>Option 2 on the <var class="product">SirLib</var> main menu performs the		<td>Option 2 on the <var class="product">SirLib</var> main menu performs the actual application or backout of procedure updates. </td></tr>
	actual application or backout of procedure updates. </td></tr>

	<tr><th>Cutover</th>		<tr><th>Cutover</th>
Line 69:		Line 64:
	Sites that require more security than this should read further.		Sites that require more security than this should read further.

	<var class="product">SirLib</var> security works much as the Administration options described in the previous section. Users are granted access to <var class="product">SirLib</var>/<var class="product">SirPro</var>		<var class="product">SirLib</var> security works much as the Administration options described in the previous section. Users are granted access to <var class="product">SirLib</var>/<var class="product">SirPro</var>
	functions at the file level:		functions at the file level:
	<ul>		<ul>
	<li>If <var class="product">SirLib</var> finds the <~~var~~>~~SECURE~~</~~var~~> switch set to blank on the file record, it checks the system record setting for <var>SECURE</var>. </li>		<li>If <var class="product">SirLib</var> finds the <b>Secure</b> switch set to blank on the file record, it checks the system record setting for <var>SECURE</var>. </li>

	<li>If <var class="product">SirLib</var> finds <var>SECURE</var> is <code>N<code> for the file, no security is in effect, and the user is granted access. </li>		<li>If <var class="product">SirLib</var> finds <var>SECURE</var> is <code>N<code> for the file, no security is in effect, and the user is granted access. </li>
Line 86:		Line 81:
	accessed.		accessed.

	For instance, if a user attempts to enter Project ~~Definitions~~ (option		For instance, if a user attempts to enter <b>Project Definition List</b> (option 1) for the file <code>XMPLPROC</code>, <var class="product">SirLib</var> looks up the <code>XMPLPROC</code> file information:
	1) for the file <code>XMPLPROC</code>, <var class="product">SirLib</var> looks up the <code>XMPLPROC</code> file information:
	<ul>		<ul>
	<li>If <var>SECURE</var> is <code>n</code> for <code>XMPLPROC</code>, the user is given access because no <var class="product">SirLib</var> functions are protected for this file. </li>		<li>If <var>SECURE</var> is <code>n</code> for <code>XMPLPROC</code>, the user is given access because no <var class="product">SirLib</var> functions are protected for this file. </li>
Line 123:		Line 117:
	The filename is shown at the left of the screen, and you enter any character under each protectable resource to tell <var class="product">SirLib</var> to protect the resource.		The filename is shown at the left of the screen, and you enter any character under each protectable resource to tell <var class="product">SirLib</var> to protect the resource.

	Blanks on		Blanks on the top line define a system default of <i>not protected</i> for that function.
	the top line define a system default of <i>not protected</i> for
	that function.
	Changes are not committed unless you press PF12 before leaving the screen.		Changes are not committed unless you press PF12 before leaving the screen.

	<i>The <b>SECURE</b> column is display only</i>.		<i>The <b>SECURE</b> column is display only</i>.
	The <var>SECURE</var> setting is changed in the Administration menu.		The <var>SECURE</var> setting is changed in the Administration menu.
	On this screen ~~it tells~~ the ~~user~~ which files will		On this screen, the setting identifies which files will
	default to the system settings (the settings on the top line), which		default to the system settings (the settings on the top line), which
	will use file security settings, and which will ignore security		will use file security settings, and which will ignore security
Line 138:		Line 131:
	Lines after the last registered file are protected on the <b>Security</b> screen.		Lines after the last registered file are protected on the <b>Security</b> screen.
	To add a new file to <var class="product">SirLib</var>, define a profile for it first in the Administration Option.		To add a new file to <var class="product">SirLib</var>, define a profile for it first in the Administration Option.

			==User security for a file==
			If the Security option is entered with a file specified on the main
			menu, then the top line of the <b>Security</b> screen reflects the protected status for the resources for that file.
			Subsequent lines reflect access privileges for users defined to that file.

	<p class="caption" style="width:450px">Maintaining the SirLib user security table</p>		<p class="caption" style="width:450px">Maintaining the SirLib user security table</p>
	<p class="figure">[[File:SlibSecurity.png\|450px]]</p>		<p class="figure">[[File:SlibSecurity.png\|450px]]</p>

	~~If the Security option is entered with a file specified on the main~~
	~~menu, then the top line of the <b>Security</b> screen reflects the protected~~
	~~status for the resources for that file.~~
	~~Subsequent lines reflect access privileges for users defined to that file.~~
	New users may be added in the blank lines at the bottom of the screen		New users may be added in the blank lines at the bottom of the screen
	(PF8 allows scrolling below the last user until blank lines		(PF8 allows scrolling below the last user until blank lines

JAL: add graphic

2015-10-21T00:23:25Z

add graphic

← Older revision		Revision as of 00:23, 21 October 2015
Line 33:		Line 33:
	Access to		Access to
	Administration functions (Option 3) and to View/Clear Procedure Locks		Administration functions (Option 3) and to View/Clear Procedure Locks
	(Option 7) is via the ADMIN SCLASS for the <var ~~class="product"~~>~~SirLib~~</var> ~~apsy~~, and through the		(Option 7) is via the ADMIN SCLASS for the <var>SIRLIB</var> application subsystem, and through the Administration option itself.
	Administration option itself.		Access to the Security option is restricted to users defined as file or system Administrators in the Administration screen.
	Access to the Security option is
	restricted to users defined as file or system Administrators in the
	Administration screen.

	<b>~~:SCREEN ID=LIBR16.SirLib System~~ Security ~~profile display~~</b>		<p class="caption" style="width:450px">SIRLIB File Security Maintenance</p>
	:~~SD L=01 C=01~~. ~~------------- * * * SIRLIB Security Maintenance * * * ---------------------~~		<p class="figure">[[File:SlibSecurity.png\|450px]]</p>

	<table class="thJustBold">		<table class="thJustBold">
Line 124:		Line 121:
	System Default settings, and each subsequent line will show the		System Default settings, and each subsequent line will show the
	settings for a file registered to <var class="product">SirLib</var>.		settings for a file registered to <var class="product">SirLib</var>.
	The filename is shown at the		The filename is shown at the left of the screen, and you enter any character under each protectable resource to tell <var class="product">SirLib</var> to protect the resource.
	left of the screen, and ~~the user enters~~ any character under each
	protectable resource to tell <var class="product">SirLib</var> to protect the resource.
	Blanks on		Blanks on
	the top line define a system default of <i>not protected</i> for		the top line define a system default of <i>not protected</i> for
	that function.		that function.
	Changes are not committed unless ~~the user presses~~		Changes are not committed unless you press PF12 before leaving the screen.
	PF12 before leaving the screen.
	<i>The <b>SECURE</b> column is display only</i>.		<i>The <b>SECURE</b> column is display only</i>.
	The <var>SECURE</var> setting is changed in the Administration menu.		The <var>SECURE</var> setting is changed in the Administration menu.
Line 143:		Line 139:
	To add a new file to <var class="product">SirLib</var>, define a profile for it first in the Administration Option.		To add a new file to <var class="product">SirLib</var>, define a profile for it first in the Administration Option.

	<b>~~:SCREEN ID=LIB417.~~Maintaining ~~User Security Table~~</b>		<p class="caption" style="width:450px">Maintaining the SirLib user security table</p>
	:~~SD L=01 C=01~~. ~~----------- * * * SIRLIB File Security Maintenance * * * ----------------~~		<p class="figure">[[File:SlibSecurity.png\|450px]]</p>

	If the Security option is entered with a file specified on the main		If the Security option is entered with a file specified on the main

Admin: 1 revision

2015-10-19T21:37:24Z

1 revision

← Older revision	Revision as of 21:37, 19 October 2015
(No difference)

JAL at 22:18, 16 October 2015

2015-10-16T22:18:01Z

New page

<var class="product">SirLib</var> security does not directly protect files.
Because programmers will be working most of the time in <var class="product">SirPro</var>,
a simple way to ensure consistent use of the <var class="product">SirLib</var>/<var class="product">SirPro</var> system
is to make all managed procedure files PUBLIC with low (read-only)
privileges, and then to allocate those procedure files to <var class="product">SirPro</var>
with read privileges and to <var class="product">SirLib</var> with update privileges.
This allows programmers to make copies of the procedures they need but not
to change anything in the managed files, forcing all updates to go through
<var class="product">SirLib</var>.

Details on this sort of conversion are given in [[SirLib "getting started" steps]].

This does not force users to use the managed update features
of <var class="product">SirPro</var> (that is, it doesn't prevent users taking "unmanaged"
copies of code to use in development work or for models in ad-hoc
reports, etc.) but it does ensure that only changes done through the
<var class="product">SirPro</var> and <var class="product">SirLib</var> managed update features will get cycled into the
production files.
Users with access to <var class="product">SirLib</var> can define projects and
reconfigure and cutover files.
And the <var class="product">SirLib</var> administrator has only
to be concerned with protecting user access to the updating functions
of <var class="product">SirLib</var>.

Protectable functions in <var class="product">SirLib</var> are Changes, Configuration, Cutover and
Reports.
In addition, <var class="product">SirLib</var> security allows administrators to protect
the Resequencing feature in <var class="product">SirPro</var> (the Z prefix command).
Access to
Administration functions (Option 3) and to View/Clear Procedure Locks
(Option 7) is via the ADMIN SCLASS for the <var class="product">SirLib</var> apsy, and through the
Administration option itself.
Access to the Security option is
restricted to users defined as file or system Administrators in the
Administration screen.

:SCREEN ID=LIBR16.SirLib System Security profile display
:SD L=01 C=01. ------------- * * * SIRLIB Security Maintenance * * * ---------------------

<table class="thJustBold">
<tr><th nowrap>Project Definition</th>
<td>The Project Definition screen, Option 1 on the <var class="product">SirLib</var> main menu, allows the definition of project names, and the entry of comments and documentation associated with them. </td></tr>

<tr><th>Reconfigure</th>
<td>Option 2 on the <var class="product">SirLib</var> main menu performs the
actual application or backout of procedure updates. </td></tr>

<tr><th>Cutover</th>
<td>This is a complex function performed to clean up update procedures and all "BASE." versions of procedures, and to re-stamp internal comments in procedures updated by the change control system.

This function has global consequences for the file being Cutover, and it is recommended that it be secured. </td></tr>

<tr><th>ReSequencing</th>
<td>This function is a prefix command in <var class="product">SirPro</var> which builds an update procedure to re-number the internal sequence numbers used to keep track of changes to a procedure.

This function isused when a great many changes have occurred against a single
procedure, to keep the system from overflowing the sequence numbers. It is rarely needed, and the consequences of resequencing a procedure when a programmer is in the midst of building changes is that the programmer's changes will not validate against the new line numbers. </td></tr>

<tr><th>Reports</th>
<td>Access to all <var class="product">SirLib</var> reports defaults to unsecured, but may be secured if a site considers the information private. </td></tr>
</table>

<var class="product">SirLib</var> is distributed as a semi-public application subsystem (APSY) with two subsystem user classes (SCLASSes).
The only special privilege associated with the <var>ADMIN SCLASS</var> is access to
the Administration functions described in the previous section.
If <var class="product">SirLib</var> is to be run on an honor-system basis, the initial administrator
(the ID that installed <var class="product">SirLib</var>) may enter the Administration Option (described in [[SirLib change control]]) and set a system default of <code>N</code> for <var>SECURE</var>, telling <var class="product">SirLib</var> to not protect functions.
Sites that require more security than this should read further.

<var class="product">SirLib</var> security works much as the Administration options described in the previous section. Users are granted access to <var class="product">SirLib</var>/<var class="product">SirPro</var>
functions at the file level:
<ul>
<li>If <var class="product">SirLib</var> finds the <var>SECURE</var> switch set to blank on the file record, it checks the system record setting for <var>SECURE</var>. </li>

<li>If <var class="product">SirLib</var> finds <var>SECURE</var> is <code>N<code> for the file, no security is in effect, and the user is granted access. </li>

<li>If <var>SECURE</var> is <code>Y</code> for the
file, the security settings from the file record are used. </li>
</ul>

If <var class="product">SirLib</var>
defaults to the system record and finds <var>SECURE</var> is <code>N</code>, the user is granted access to whatever they request, because security is off for the whole system, and no file override was input.
If <var>SECURE</var> is <code>Y</code> on
the system record, specific settings are checked for the resource being
accessed.

For instance, if a user attempts to enter Project Definitions (option
1) for the file <code>XMPLPROC</code>, <var class="product">SirLib</var> looks up the <code>XMPLPROC</code> file information:
<ul>
<li>If <var>SECURE</var> is <code>n</code> for <code>XMPLPROC</code>, the user is given access because no <var class="product">SirLib</var> functions are protected for this file. </li>

<li>If <var>SECURE</var> is <code>Y</code>, <var class="product">SirLib</var> checks to see whether the userid requesting access has authority to access the Projects option in this file. </li>

<li>If <var>SECURE</var> is blank on the <code>XMPLPROC</code> record, <var class="product">SirLib</var> looks up the system defaults and performs the same check as it does when it found file-specific information.</li>
</ul>

If the system defaults are to protect the function, the user must still
have file-specific privileges to perform the function on the file.
This makes it possible for an administrator to set only a single system
default profile for security, and then to have only to maintain user
privileges.
File-specific overrides of the system profile take effect
immediately, and effect all users.

Blanks in the system security profile mean that the resource is
not to be protected.

If <var>SECURE</var> is <code>N</code> on the Administration panel, all security settings are
ignored for the system (if it is off in the system profile) or for
individual files (if it is off in a file profile).
Security privileges
may still be defined, <var class="product">SirLib</var> just won't pay attention to them.
Security can be bypassed in emergencies by turning it off for a file or
for the system, and user privileges will not be lost.
<var>SECURE</var> set to <code>Y</code> on a file record will secure a file even when the system default for
<var>SECURE</var> is <code>N</code>.

If the Security option (option 4) is entered without a file specified
on the main menu, the top line of the security screen will show the
System Default settings, and each subsequent line will show the
settings for a file registered to <var class="product">SirLib</var>.
The filename is shown at the
left of the screen, and the user enters any character under each
protectable resource to tell <var class="product">SirLib</var> to protect the resource.
Blanks on
the top line define a system default of not protected for
that function.
Changes are not committed unless the user presses
PF12 before leaving the screen.
The SECURE column is display only.
The <var>SECURE</var> setting is changed in the Administration menu.
On this screen it tells the user which files will
default to the system settings (the settings on the top line), which
will use file security settings, and which will ignore security
altogether (<var>SECURE</var> set to <code>N</code>).

Files cannot be added to <var class="product">SirLib</var> through the Security screen.
Lines after the last registered file are protected on the Security screen.
To add a new file to <var class="product">SirLib</var>, define a profile for it first in the Administration Option.

:SCREEN ID=LIB417.Maintaining User Security Table
:SD L=01 C=01. ----------- * * * SIRLIB File Security Maintenance * * * ----------------

If the Security option is entered with a file specified on the main
menu, then the top line of the Security screen reflects the protected
status for the resources for that file.
Subsequent lines reflect access privileges for users defined to that file.
New users may be added in the blank lines at the bottom of the screen
(PF8 allows scrolling below the last user until blank lines
are displayed).
Though this screen looks the same as the Security screen for System/File settings, the settings on user lines grant access to resources that may be protected.

A <code>Y</code> in the top line of this screen reflects the resource being
protected. A <code>Y</code> in one of the user lines for the same resource
grants that user access to the protected resource.
(Any character entered is converted to <code>Y</code> when the user presses
the Enter key). Users may be granted access to resources that are
not specified as protected, but their privileges are not verified
unless the resource is switched to protected in the future.
As with the System/File defaults screen, changes on this screen are not
committed until the user presses PF10.

==See also==
{{Template: SirLib topic list}}

[[Category: SirLib]]