Unsupported content

   

This version of the documentation is no longer supported. However, the documentation is available for your convenience. You will not be able to leave comments.

Setting up authorizations for changing job priority

To control the job priority access for each role, you must the set the appropriate RBAC job authorizations and set the maximum allowed priority for each role as described in the following topics:

Authorizations related to job priority

To control job priority access, define and apply the following authorizations as described in the following table.

 

Authorization

Permission granted

Jobtype.ModifyPriority

Modify the priority at the:

  • Job type level — Change the default priority for the job Type.
  • Job level — Change the priority for that job instance.
  • Job schedule level — Change the priority for each different job type.

Jobtype.ModifySchedule

Change the priority for a scheduled job, or override the job default while creating the schedule.

Note

The corresponding Jobtype.ModifyPriority and Jobtype.ModifySchedule authorizations are required.

BL_Administration.ModifyRuntimeJobPriority

Change the priority of a currently executing job instance. By default, only the BLAdmins role has this authorization.

Note

The highest available priority for a user is controlled by the MAXIMUM_ALLOWED_JOB_PRIORITY* property value of that user's role, even if that role is granted the BL_Administration.ModifyRuntimeJobPriority authorization.

Required role-level property

You must define the following role-level property:
MAXIMUM_ALLOWED_RUNTIME_JOB_PRIORITY*

This property determines the upper boundary for the runtime priority of a job, regardless of the value specified in the job PRIORITY* property value or the job schedule's PRIORITY*.

The default value is JOB.NORMAL_PRIORITY*. You can set this boundary on a per role basis. For example, you may want to limit the higher priority levels (CRITICAL and HIGH) to a small set of users with a specific role.

To change this default value, you must assign the Role.ModifyProperties authorization in addition to Role.Create (while creating the role) or Role.Modify (while modifying an existing role).

Note

Administrators with the BL_Administration.ModifyRuntimePriority authorization can override the MAXIMUM_ALLOWED_RUNTIME_JOB_PRIORITY* while modifying the priority of the running job.

User scenario

Suppose that Deploy Jobs in your environment are configured with a job priority of normal. However, you want to create a new Deploy Job that you need executed with a job priority of critical. To change the default priority while creating the Deploy Job, your active role must contain all of the following authorizations:

  • Jobtype.Create
  • Jobtype.ModifyProperties
  • Jobtype.ModifyPriority

If the Deploy Job is already running, and you want to pause it and change the priority, you need the following authorizations:

  • DeployJob.Read
  • DeployJob.ModifyProperties
  • DeployJob.ModifyPriority
  • DeployJob.PauseResumeExecution (which controls the access to the ability to pause and resume Jobs)
  • BL_Administration.ModifyRuntimeJobPriority

To change the priority of a currently executing job instance (including pausing the job instance), the global role-level authorization BL_Administration.ModifyRuntimeJobPriority is required. By default, only the BLAdmins role has this authorization.

Note

The greatest available priority for a user is controlled by the MAXIMUM_ALLOWED_JOB_PRIORITY* property value of that user's role, even if that role has been granted the BL_Administration.ModifyRuntimeJobPriority authorization.

Recommendations for using job priority

To prevent unauthorized users from changing job priorities and affecting operational performance, make sure that only authorized users have permissions to change the job priority.

BMC recommends that job priority change permission be granted to only a few super-user roles. All changes made to a job's priority are tracked in the audit trail, so that you can review them and take corrective action if needed.

Was this page helpful? Yes No Submitting... Thank you

Comments