HP Archive Backup System for OpenVMS Guide to Operations

Media Management
4.2 Domain
4.2.1 ABS Rights
4.2.2 Application Rights
4.2.3 Check Access
4.2.4 Deallocate State
4.2.5 Default Rights
4.2.6 Mail Users
The domain attribute ABS_RIGHTS controls whether a user having certain pre-V4.0 ABS rights
can map these to MDMS rights for security purposes (see Chapter 5, Security for more information
about rights). Setting the attribute allows the mapping, and setting the attribute to false disallows
the mapping.
The right MDMS_APPLICATION_RIGHTS is a high-level right that maps to a set of low level
rights suitable for MDMS applications (for example, ABS and HSM). Normally these rights
should not be changed, or at least not reduced from the default settings otherwise ABS and HSM
may not function correctly. You may add rights to application rights if you have your own
MDMS applications or command procedures. The ABS and MDMS$SERVER accounts should
have MDMS_APPLICATION_RIGHTS granted in the User Authorization File.
The check access attribute determines if access controls are checked in the domain. MDMS uses
two forms of security: Rights and Access Control. Rights checking is a task-oriented form of
security and is always performed. However, access control is an object-oriented form of security
and can be optionally enabled or disabled with this attribute. Setting Check Access enables
access control checking. Clearing Check Access disables access control checking even if there
are objects with access control entries.
When a volume is deallocated after its data has expired, it may go into one of two states. The
transition state is an interim state that the volume goes into after deallocation, but it is not eligible
to be used again until a period of time called the transition time expires. This is a safety feature
that allows you to examine whether the data has legitimately expired, and if not to retain the
volume (put back to the allocated state). If you do not wish this feature, you can disable the transition
state and allow volume to return directly to the free state, where it is eligible for immediate
allocation and initialization for new data. The domain deallocate state is applied to all volumes
that are automatically deallocated by MDMS. When manually deallocating volumes, you can
override the domain deallocate state with a state on the deallocate operation itself.
The MDMS default rights attribute maps a set of MDMS low-level rights to all users in the
domain. This allows you to give all users a limited set of rights to access MDMS objects and perform
operations, without having to expressly modify their accounts. Be aware that default rights
are applied to all users on all nodes in the domain, so granting such rights should be carefully
reviewed. By default, MDMS maps no rights to the default rights.
When MDMS deallocates volumes based on their scratch date (an operation that is performed
once per day), it sends a mail message indicating which volumes were deallocated to the set of
users defined in the mail users attributes. You should enter a list of users in the format
node::username. Every user in the list will receive the deallocate volume mail messages. This
mail address is also used when the ABS catalog unpack process encounters an error.
4-2 Media Management