Lines 5 and 6: Using Retrieval and Update Codes

You may want to assign different sets of retrieval and update codes to separate departments of your company, want to restrict system privileges or access to TCL, or use a combination of these strategies. You can enter retrieval and update codes in lines 5 and 6 of File Definition items in both the Master Dictionary of an account and in any file dictionary.

Access to accounts and files can be restricted by assigning retrieval and update codes to them.

retrieval codes	Lock codes that prevent users from reading protected files and files in protected accounts.
update codes	Lock codes that prevent users from making changes to protected files and files in protected accounts.

Retrieval codes are defined in line or attribute 5 of the Account Definition item or User-ID item. Similarly, update codes are defined in line or attribute 6 of these same items. These sets of codes would be entered as MultiValued codes. One department might have the codes A, B, and C; another might have X, Y, and Z.

Further, a department might want to use four different levels of retrieval and update codes, providing increased restrictions at each level.

Accounts and files that are to be accessible to any user on the system would be assigned no retrieval or update codes. Any user, whether assigned retrieval and update codes or not, could read these files and write to them.
Accounts and files you want to make accessible only to members of the "A" department would be assigned an A code. If A is the least restrictive code, all members of that department should have the A code in their retrieval and update codes (user codes). Therefore, only members of the "A" department will have access to files and accounts containing an A as the first value of their update and retrieval codes.
For more sensitive files to which you want to restrict access within a department, for example, you could assign the code AB to accounts and files that you wanted only supervisors of the "A" department to be able to access. The supervisors’ retrieval and update codes (user codes) must contain both A and B codes in order to access these files.
Accounts and files on the system that you want accessible only to system operators and the system administrator could be assigned a code of ABC. You would then add the C code to the retrieval and update codes (user codes) of the operators and the system administrator.

Unless a password is included during the account creation process, the account is accessible to all users who know the logon-IDs. Most files when they are first created are accessible to all users of the system. Files in accounts protected by retrieval and update codes will not be accessible to users or to other accounts whose Account Definition items do not contain the same retrieval and update codes, even if the logon-ID and password are known. Files protected by retrieval and update codes cannot be accessed by any accounts or users without the corresponding code in their Account Definition item.

NOTE

It is particularly important to protect the SYSTEM Dictionary, making it accessible only from the SYSPROG account. This can be done by assigning retrieval and update codes to both the SYSPROG account and the SYSTEM Dictionary that will allow only the SYSPROG account to read or write to the SYSTEM Dictionary.

In order to update files, the following processors require that both retrieval codes and update codes match:

COPY
Editor
BASIC RUN processor
Assembler
XPROC

To open a file, the mvBASIC processor requires that retrieval codes match; both update and retrieval codes must match for mvBASIC to change data. All other processors can be considered retrieving processors; to retrieve data, they require only that the retrieval codes match.

Retrieval and update codes can be placed in any of the following items:

Account Definition items in the SYSTEM Dictionary. The first code placed in an Account Definition item limits access to the account and all of its files.
File Definition items in an account’s Master Dictionary. Codes placed in a Master Dictionary D- pointer limit access to both the data and the dictionary of the file to which they point.
File Definition items in a file dictionary. Codes placed in a dictionary D-pointer limit access to the data portion of the file. They do not limit access to the dictionary itself.
File synonym items (Q-pointers).

Retrieval and update codes can be given to an account at the time it is created. At any other time, use the Editor to enter retrieval and update codes in Account Definition, User-ID, and File Definition items.

NOTE	Remember, however, not to make any changes to items in the SYSTEM Dictionary unless all other users are logged off the system.

Retrieval and update codes can be any combination of ASCII characters. In the same way that multiple valid process codes are listed, multiple update and retrieval codes are listed with the value mark (CTRL+]) used as a separator; as mentioned earlier, update and retrieval codes are maintained in separate lines or attributes of the Account Definition, User-ID and File Definition items.

Matching Retrieval and Update Codes

In order for the file codes and the user codes to match, the following conditions must be met:

The characters of each code to be matched must correspond in order, left to right.
All characters of the file code must match the first characters of the user code. If the user codes are MultiValued, all characters of the file code must match the first characters of any one of the codes. The general rule is: file codes are subsets of user codes, but not vice versa.

For example, the following codes match:

File Code	User Code	Result
ABC	ABC	match
AB	ABC	match
ABC	ABCDE	match

However, the following codes do not match, because all the characters of the file codes are not included in the user code:

File Code	User Code	Result
ABC	AB	no match
AXY	ABC	no match

The following MultiValued codes match:

File Code	User Code	Result
B	A]B]C	match
XY	AB]XYZ	match

However, the following MultiValued codes do not match, because all the characters of the file codes are not included in one of the MultiValued user codes:

File Code	User Code	Result
AB	A]B]C	no match
XYZ	AB]XY	no match

If the accessed file is in another account, the update and retrieval codes in the User-ID will be matched against the update and retrieval codes in all of the following:

The Account Definition item of the other account.
The File Definition item in the account’s Master Dictionary.
The File Definition item in the file dictionary.

All these file codes must match the user codes in order for the user to access the file.

If a file code in the file to be accessed is MultiValued, only the first value of the file code is used to match the user code.