z/OS Security Server RACF Security Administrator's Guide
z/OS Security Server RACF Security Administrator's Guide
Previous topic |
Next topic |
Contents |
Contact z/OS |
Library |
PDF
Holding groups z/OS Security Server RACF Security Administrator's Guide SA23-2289-00 |
|
A popular technique that retains user definition centrally, yet allows the effective use of group administrators, is to establish a holding group. You define all users centrally and initially connect them to a group named HOLD with the minimum of authorities. HOLD does not appear in any access lists, and therefore has no real significance to the user. Group administrators, to whom you give CONNECT (but not JOIN) authority, can connect the appropriate users to the groups under their control and change the users' default group name as appropriate. This technique allows the installation to assign correct account numbers and control other installation considerations while allowing flexibility in the grouping of the user population. Note: A group cannot contain more than approximately 5900 users. Therefore,
if you have more than this number of users, you cannot assign them
to a single holding group. Also, you should be aware that extremely
large groups can have performance implications for the RACF® database. For more information, see z/OS Security Server RACF System Programmer's Guide.
|
 Copyright IBM Corporation 1990, 2014 |
