Application Administration with Navigator for i
When using Application Administration to control access to Navigator tasks, you create customizations which restrict some users from seeing certain tasks
System i Navigator (probably best known as iSeries Navigator) has long had Application Administration, where you can configure which “applications” a user is allowed to access. There are several uses of Application Administration: you can control access client applications, host applications, and Navigator tasks. When using Application Administration to control access to Navigator tasks, you create customizations which restrict some users from seeing certain tasks within the System i Navigator navigation frame.
The nice thing about using Application Administration to restrict access to functions is that it is centrally controlled on your IBM i partition; if the user were to get a new PC and install System i Navigator, any prior restrictions will still be in place. I know some customers that used selective install to prevent users accessing some functions, but that requires the installation to be customized; application administration provides this capability centrally.
When Navigator for i (the web console) was introduced, it included Application Administration. And, in case you aren’t aware, the customizations you created in System i Navigator automatically apply to the users of Navigator for i.
You can launch Application Administration from two places in Navigator:
* System -> Application Administration
* Security -> Application Administration
Until the December 2016 update, there was one significant issue with Application Administration when using Navigator for i; while you could deny a user access to certain functions, they would still see those tasks as being available in the navigation tree. If they tried to use the task, an error would occur telling them they were not authorized.
For example, I have access to a 7.2 partition that does not have the latest Navigator update installed. I revoked access to Work Management -> Server Jobs from user DAWN. When DAWN signed in, she could still see the Server Jobs task under Work Management, but when that task is selected, an error occurs.
But now, with the December 2016 enhancements to Navigator, this has been changed and the tasks a user is not allowed to access are no longer displayed in the navigation tree, just as you would expect. In my example above, on my 7.3 partition with the latest Navigator update, DAWN no longer sees Server Jobs. (But with this latest update, Subsystem Descriptions is now available, which will be reviewed in a future article).
This December 2016 Navigator update applies for all supported IBM i releases – 7.1, 7.2, and 7.3.
Finally, don’t forget the Knowledge Center. You can find Application Administration documented there as well. Note this document is centered around using the System i Navigator client, but the concepts are the same (once you get into the Application Administration task) for the Navigator for i web console.