SPDO Procedure

ADD ACL Statement

Creates new ACL entries.

Requirement:	You must be the resource owner, have ACL access to a resource, or have special privilege in order to add an ACL to a resource. When using special privilege, set the ACLSPECIAL= option in the LIBNAME statement.
Interactions:	Before using ADD ACL, you must set the context for the request with the SET ACLUSER statement. For more information, see SET ACLUSER Statement.
Interactions:	If you are creating an ACL for a resource other than a domain or a table, set the ACL type before using ADD ACL. For more information, see SET ACLTYPE Statement.
See:	For detailed information about how the server supports ACLs, see ACL Security Model.

Example 1: Add Domain ACL

Example 2: Add Resource ACL

Example 3: Add Generic ACL

Example 4: Add Column ACL

Example 5: Add Generic Column ACL

Example 6: Add Catalog ACL

Example 7: Add Generic ACL for Catalog Entries

Syntax

ADD ACL acl1[ acl2...] [C=cat T=type] [/options];

Optional Arguments

acl

specifies the name of the ACL. Use a one-part name to identify resources except domains and table columns. You do not need to specify a name when creating a domain ACL. The domain is inferred from the libref. Use a two-part name (table.column) to identify an ACL for a table column. You can specify multiple names. Each name creates a separate ACL entry.

ALTER

grants universal ALTER access to the resource.

C=cat

identifies the specified ACL names as the names of catalog entries in the catalog cat. You pair this value with the T= option.

/GENERIC

specifies that the ACL name is a generic ACL.

Note	If you specify /GENERIC when defining a table column ACL, the /GENERIC applies to the table name, not to the column name.

GROUPALTER

grants group ALTER access to the resource.

GROUPREAD

grants group READ access to the resource.

GROUPWRITE

grants group WRITE access to the resource.

/LIBNAME

creates an ACL for the domain. You can control access permissions to an entire domain with this option.

MODEL

specifies the name of another ACL. This option requests the software to copy all the access permissions and access list entries from this ACL.

/PERSIST

specifies that the ACL (or ACLs) is a persistent ACL. A persistent ACL entry is an ACL that is not removed from the ACL tables when the resource is deleted.

READ

grants universal READ access to the resource.

T=type

identifies the catalog entry type to associate with the specified ACLs names. This option is required when you specify the C= option.

WRITE

grants universal WRITE access to the resource.

Details

SPD Server uses access control lists (ACLs) to secure resources. ACL permissions affect all server resources, including domains, tables, table columns, catalogs, catalog entries, and utility files. By default, only the owner (creator) of a resource has access to a resource. Resource owners can grant others access to their resources, including their ACLs. Resource owners can grant ACL permissions to specific users, to specific groups of users (called an ACL group), or to all SPD Server users or all groups (universal permissions). Users with special privilege can also modify ACLs. For more detailed information about how the server supports ACLs, see ACL Security Model.

The examples below show the ADD ACL statements that are necessary to define various types of ACLs. For examples of how ACLs might be used to secure resources at a customer site, see ACL Examples.

Examples

Example 1: Add Domain ACL

This creates a domain ACL that grants universal READ and group WRITE access.

add acl/LIBNAME
read
groupwrite;

Example 2: Add Resource ACL

This ACL for the resource MINE_AUG2016 grants universal READ and WRITE access.

add acl mine_aug2016/read write;

Example 3: Add Generic ACL

This generic ACL for MINE* grants universal READ access.

add acl mine/generic read;

Example 4: Add Column ACL

This ACL for the column MINE_AUG2016.SALARY grants group READ access and denies access to all others.

add acl mine_aug2016.salary/groupread;

Example 5: Add Generic Column ACL

This ACL for the column MINE*.SALARY grants group READ access and denies access to all others.

add acl mine.salary/generic
groupread;

Example 6: Add Catalog ACL

This ACL for the MYCAT catalog grants universal READ and group READ/WRITE access.

set acltype catalog;
add acl mycat/read
groupread
groupwrite;

Example 7: Add Generic ACL for Catalog Entries

This ACL for catalog entries, MYCAT.MY*.CATAMS, grants universal READ and group READ access.

set acltype catalog;
add acl my
c=mycat
t=catams/generic
read
groupread;

Last updated: February 3, 2017