Is there a way to give someone read-only access in 8.1?

[asorrell]

I have a client that wants read-only access in production for the developers. If I remember correctly the lowest level of access is "Computer Operator" role, which still has the ability to run jobs. They want a complete lockdown of the environment that would allow end-users to only look at logs (and maybe read-only access to jobs). Only the admins could run jobs.

I'm not certain that there's a way to do that. Any ideas?

[chulett]

There have been discussions here about ways to deliver the logs in such a manner as to allow people of lesser importance (i.e. developers) the ability to view them, but I don't know if you want to build something like that. There have been other discussions around permissions lock-downs such that only your admins could successfully run jobs, others would technically still have the ability to attempt to run them but the locked down permissions would mean any such attempt would immediately fail.

I do not believe there is an existing role that allows any kind of "look but not run" access.

[Sreenivasulu]

Very good suggestion for next release

[ray.wurlod]

It's already in the current release. Job logs can be viewed through the Reporting console.

[asorrell]

So... Is there a way to setup access so they can see the Reporting Console without getting at least "Computer Operator" (which gives them ability to run jobs in Director)?

[chulett]

That was my next question, but figured I'd let you ask that one Andy.

[richdhan]

Hi Andy,

What if the User is a DataStage Suite User (DataStage and QualityStage User) but is not mapped to any of the roles that are available in DataStage Administrator (1.DataStage Operator 2.DataStage Super Operator 3.DataStage Developer 4.DataStage Production Manager) then he should be able to view the reports but cannot login into any of the DataStage Clients.

Iam not sure if this works. Just a wild guess.

HTH
--Rich

[asorrell]

I'll try it later today...

[asorrell]

Ok - this works. It gives a developer access to logs (sort of) and no other access to production.

1) Set developer's id to "Suite User" - should already be done if they are in product on any system!
2) Do NOT give them any roles on any projects in the production system - this will prevent them from opening any of the fat clients on the production system.
3) Have the administrator setup several reports that pull up information from the logs. Grant the developers access to update and run the reports.

I'm still concerned that this will not give developers access to data on the production system - and at this site most of the aborts are due to junk in the feeds.

Any suggestions?

[ray.wurlod]

Provide a separate client (e.g. TOAD) for them to have read-only access to the production data?

[Sreenivasulu]

Hi Sorrell, That looks to be a great idea of how to give minimal access. I will also try to implement that.
Regards
Sreeni