Administrative authority and privilege classes

After administrators are registered, they can complete a limited set of tasks. By default, administrators can request command-line help and issue queries.

To perform other tasks, administrators must be granted authority by being assigned one or more administrative privilege classes. Privilege classes determine the authority level for an administrator. Figure 1 illustrates the privilege classes. An administrator with system privilege class can complete any task with the server. Administrators with policy, storage, operator, or node privileges can complete subsets of tasks.

Important: Two server options give you extra control over the ability of administrators to complete tasks.

Use the QUERYAUTH server option to select the privilege class that an administrator must have to issue QUERY and SELECT commands. By default, no privilege class is required. You can change the requirement to one of the privilege classes, including system.
Use the REQSYSAUTHOUTFILE server option to specify that system authority is required for commands that cause the server to write to an external file (for example, BACKUP DB). By default, system authority is required for such commands.

See the Administrator's Reference for details on server options.

Figure 1. Administrative privilege classes

Table 1 summarizes the privilege classes, and gives examples of how to set privilege classes.

Table 1. Authority and privilege classes
Privilege Class	Capabilities
System `grant authority rocko classes=system`	Perform any administrative task with the server. System-wide responsibilities Manage the enterprise Manage IBM® Tivoli® Storage Manager security
Unrestricted Policy `grant authority smith classes=policy`	Manage the backup and archive services for nodes that are assigned to any policy domain. Manage nodes Manage policy Manage schedules
Restricted Policy `grant authority jones domains=engpoldom`	Same capabilities as unrestricted policy except authority is limited to specific policy domains.
Unrestricted Storage `grant authority coyote classes=storage`	Manage server storage, but not definition or deletion of storage pools. Manage the database and recovery log Manage IBM Tivoli Storage Manager devices Manage IBM Tivoli Storage Manager storage
Restricted Storage `grant authority holland stgpools=tape*`	Manage server storage, but limited to specific storage pools. Manage IBM Tivoli Storage Manager devices Manage IBM Tivoli Storage Manager storage
Operator `grant authority bill classes=operator`	Control the immediate operation of the server and the availability of storage media. Manage the IBM Tivoli Storage Manager server Manage client sessions Manage tape operations
Node `grant authority help1 classes=node node=labclient`	Access a web backup-archive client to complete backup and restore operations.