Rights needed in LID for Development Tasks

Can you keep your developers, or most of them, on a test server only? Then security might be more comfortable with the required level of access. If you have test and production on the same box then security is more difficult.

Developers will need access to the directories you named -- but not necessarily write access. With additional effort, you could limit developer write access to certain subdirectories. for example, in LAWDIR/PL/*src, developers will need write access in a development product line, but probably not in production .

They would likely need write access to certain src and metadata folders, access to env utilities, etc. The easiest way to accomplish this, and in addition build your source control procedures, etc. would be to keep them on dev server and have them write detailed deployment instructions. Then put one of your people in the position of deploying/promoting to test and production. Given the scope of the modifications you are anticipating would warrant 3 (dev/test/prod) servers/environments.

Thanks Ben and John. I should have clarified what our landscape looks like. We will have separate Development and Production boxes, and developers will only have rights on the Development box.

On the Development box, we will have 3 product lines: TRN (training), DEV (development), and TEST (testing/functional sandbox). All of the development and unit testing will be done in DEV, and the objects will be moved to TEST for the system/business testing.

On the Production box, we will likely have 2 product lines - VER (Verification) and PROD (Production). Verification will be used to validate the changes on the new box, and Production will be Production.

Deployment and source control discussions are planned, but we are on a Managed Services contract so we know they will be responsible for moving objects from the Dev server to the Production server. Whether they will move the objects between product lines on the same server has not yet been discussed.

Based on our setup, I assume we could limit access to the folders relating to the DEV product line - but I think there are some things that cross product lines. How can we find out what we really need access to? Where are the src, metadata, utilities, etc that we will need to access, and what rights do we need on those folders?

It seems to me that Lawson would have something like this documented, but I sure can't find anything.

Thanks for your thoughts.

Have you looked at using the different options with permsmaint? That--combined with the "LAWDEV" group is probably sufficient.

permsmaint can be used to implement a security policy, but Lawson doesn't provide much guidence on how to configure it. I have never seen any good documentation on who really needs access to what, especially permissions on files/directories. Lawson provides default settings, but not much explanation.

Having remote developers is one thing, but I personally would feel very uncomfortable having offshore developers moving code to my production server.

Generally, I think that just about everything a developer would need to UPDATE would be product line specific for development activities. But moving code accross product lines or servers requires access to other utilities that I don't think of as part of normal developer access.

I'll point our sysadmin to the permsmaint utility documentation to get him pointed in the right direction. I have noticed that most of the available Lawson documentation (for everything) does a good job of describing what tools/forms/settings are, but there is almost nothing that describes how to USE the tool/form/setting/etc to do what needs to be done. Very odd.

I know none of the developers will be moving anything to Production themselves - Managed services will be responsible for moving everything into production.

Thanks for your help. Hopefully this will get us going in the right direction.