Authorizations for changing job priority

To control the job priority access for each role, you must the set the appropriate RBAC job authorizations and set the maximum allowed priority for each role as described in the following topics:

Authorizations related to job priority

To control job priority access, define and apply the following authorizations as described in the following table.

Required role-level property

You must define the following role-level property:
MAXIMUM_ALLOWED_RUNTIME_JOB_PRIORITY*

This property determines the upper boundary for the runtime priority of a job, regardless of the value specified in the job PRIORITY* property value or the job schedule's PRIORITY*.

The default value is JOB.NORMAL_PRIORITY*. You can set this boundary on a per role basis. For example, you may want to limit the higher priority levels (CRITICAL and HIGH) to a small set of users with a specific role.

To change this default value, you must assign the Role.ModifyProperties authorization in addition to Role.Create (while creating the role) or Role.Modify (while modifying an existing role).

User scenario

Suppose that Deploy Jobs in your environment are configured with a job priority of normal. However, you want to create a new Deploy Job that you need executed with a job priority of critical. To change the default priority while creating the Deploy Job, your active role must contain all of the following authorizations:

• Jobtype.Create
• Jobtype.ModifyProperties
• Jobtype.ModifyPriority

If the Deploy Job is already running, and you want to pause it and change the priority, you need the following authorizations:

• DeployJob.Read
• DeployJob.ModifyProperties
• DeployJob.ModifyPriority
• DeployJob.PauseResumeExecution (which controls the access to the ability to pause and resume Jobs)
• BL_Administration.ModifyRuntimeJobPriority

To change the priority of a currently executing job instance (including pausing the job instance), the global role-level authorization BL_Administration.ModifyRuntimeJobPriority is required. By default, only the BLAdmins role has this authorization.

Recommendations for using job priority

To prevent unauthorized users from changing job priorities and affecting operational performance, make sure that only authorized users have permissions to change the job priority.

BMC recommends that job priority change permission be granted to only a few super-user roles. All changes made to a job's priority are tracked in the audit trail, so that you can review them and take corrective action if needed.