Granting access through ACL; heirarchy


In AUTHORIZE, FIS_ACCT6 had the following identifies:

Identifier                         Value           Attributes

  SBR_ACCESS                       %X80010003     

  SBR_READ                         %X8001007D     

  SBR_OPER                         %X80010002     

  PAYREAD                          %X800100AC     

  PAYWRITE                         %X800100AD     

And on PAYGLD the ACLs where:

          (IDENTIFIER=[BUSINESS,FIS_PAMELA],ACCESS=READ+WRITE+EXECUTE+DELETE)

          (IDENTIFIER=[BUSINESS,ESPFIS],ACCESS=READ+WRITE)

          (IDENTIFIER=PAYREAD,ACCESS=READ+EXECUTE)

          (IDENTIFIER=PAYWRITE,ACCESS=READ+WRITE+EXECUTE)

What happened was ACLs will check for the 1st match when it goes through the list. So FIS_ACCT6 had its first match on PAYREAD. But the interface needs write access so it gave the “You do not have write access to the…” message.  One solution is to remove the PAYREAD identifier from FIS_ACCT6 or re-order the ACL and put PAYREAD after PAYWRITE.