Download Action Request System Troubleshooting and Error Messages Guide

1
Problems with Access Control
The access control strategy for the AR System uses an access control cache of
user and group information from one or more schemas on one or more servers
in an environment. The full process is discussed in the following paragraphs. It
is important to understand the process used for access control in order to
troubleshoot any problems you may be having.
The first step in the access control process involves updating the User and/or
Group schema (the name is not important, the presence of the reserved fields
like Login name [ID = 101] and group name [ID = 105] in the schema are
important). These two schemas are available on the server when installed. See
the Action Request System Administrator’s Guide for more information on the
User and Group schemas.
If you want to keep all user and group information in a single location, you can
remove the User and Group schemas from all servers except for one main
server.
When a user or group is added, deleted, or modified, the information is stored
as an entry (AR) just like for any other schema. By default, each of the servers
are independent in terms of user and group lists. Updates to these schemas are
immediately reflected in the local access control cache and any license
violations are reported interactively on each server.
To support centralized access control in a multi-server environment,you need
to use one of the access control support programs, arcache. (This program is
generally run using a filter action.) The arcache process takes the information
from the entry and sends requests to all of the registered servers and updates
the local access control cache. This is when users and groups are recognized by
the system for access control purposes. This is also when license checks are
made to see that any additions of users do not exceed the number of users with
write access that you are licensed to have. Notes about new licenses or
rejection updates due to license violations are written to the error log on the
target machine.
There may be several User and Group schemas on several servers. The
information in each is different on each server. However, the information can
be merged in the access control cache. If a user is defined in two places, they
are treated as the same user as long as the password is the same in both places.
If it is different, the two entries are treated as two separate users.
38
Action Request System Troubleshooting and Error Messages Guide—December 1995