To restrict job execution users, create a user control list for job execution using a text editor such as vi or Notepad.
Only users listed in the user control list for job execution can execute jobs. Job execution is restricted as shown in the following table when the user control list for job execution has been set up. User limit lists for job execution are not set up immediately after installation. User limit lists for job execution are created separately for each subsystem, and are only valid for the particular subsystem for which they have been created.
User control list for job execution exists? | User registered with the user control list for job execution? | Job execution |
|---|---|---|
Exists | Registered | Can execute jobs (*1) |
Not registered | Cannot execute jobs (*2) | |
Does not exist | - | Can execute jobs |
Note that commands that require system administrator privileges cannot be executed as jobs unless the system administrator (root) is registered in the user control list for job execution.
If a user that has been specified by the job privileges does not exist in the user control list for job execution, a submission error will occur when the job is submitted, and the job will not be executed.
Refer to "2.5.2.2 Job Execution Privileges" for details on job privileges.
Creation Procedure
Use the following procedure to create user limit lists for job execution.
Only the system administrators can create the user limit list for job execution.
If multiple subsystem operations are being performed, create a separate user control list for job execution for each subsystem.
Create a user control list for job execution
Use an editor such as vi or Notepad to enter the names of users that will be allowed to execute jobs in a user control list for job execution.
Save the user control list for job execution
Use the following file name to save the user control list for job execution that has been created:
mjexuser
Restart Job Execution Control
Job Execution Control must be restarted to enable these settings. Restart the Job Execution Control daemon.
Refer to "User Limit Lists for Job Execution" for details on how to specify user limit lists for job execution, file storage locations, and other notes.
Once these settings have been enabled, the users that are allowed to execute jobs can be changed simply by changing the content of the user control list for job execution.
To disable a user control list for job execution, delete the user control list for job execution and then restart the Job Execution Control daemon.
Information
Backing up and restoring user limit lists for job execution
User limit lists for job execution can be backed up and restored using the mpbko command and the mprso command respectively.
Refer to the Systemwalker Operation Manager Installation Guide for details on the backup and restoration procedures.
Extracting and distributing policy information
The user information in user limit lists for job execution can be extracted and distributed as policy information. Policy information can be extracted and distributed by selecting Operation information from the Environment definition tab of the Extract Policy window.
Refer to the Systemwalker Operation Manager Installation Guide for details on the procedures for extracting and distributing policy information.
Network jobs
For network jobs, execution users can be restricted by creating a user control list for job execution on either the schedule server or the execution server.
The relationship with older versions is as follows:
If a network job request is sent to V13.1.0 or earlier:
Create a user control list for job execution on the schedule server.
If network jobs are received from V13.1.0 or earlier:
Create a user control list for job execution on the execution server.
