6.2.17 Reusing access tokens for job execution
This subsection describes how to specify the setting for reusing access tokens when a job is executed. This setting must be specified on a job execution host. For details, see 5.4.1 User account for job execution in the manual JP1/Automatic Job Management System 3 Overview.
Note that this setting is not necessary when the queueless job execution facility is used. This is because access tokens are reused when a queueless job is executed by the facility.
- Organization of this subsection
(1) Definition procedure
-
In Windows Control Panel, open the Services administrative tool, and stop the following service:
-
JP1/AJS3 service
- Cautionary note:
-
In a cluster system, check the cluster settings, and also stop the JP1/AJS3 service on each logical host.
-
-
Execute the following command to set the environment setting parameter described in (2) below:
jajs_config -k definition-key "parameter-name"=value
-
Restart JP1/AJS3.
The new settings are applied.
(2) Environment setting parameter
|
Definition key |
Environment setting parameter |
Explanation |
|---|---|---|
|
[{JP1_DEFAULT|logical-host}\JP1NBQAGENT\Job]# |
"IsAccessTokenCache"= |
Specifies whether access tokens are to be reused when a job is executed. |
- #:
-
The specification of the {JP1_DEFAULT|logical-host} part depends on whether the host is a physical host or a logical host. For a physical host, specify JP1_DEFAULT. For a logical host, specify the logical host name.
For details about the definition of this environment setting parameter, see 20.5.2(41) IsAccessTokenCache.
(3) Notes
-
If the reuse of access tokens is enabled, access tokens are released as follows:
-
When the password for the OS user who executes the job is changed
The user releases the current access token and acquires an access token with new user information.
Cautionary note:
If password information managed by the OS is changed, the password management information for the OS user mapped in JP1/Base must also be changed. If the password management information for the OS user mapped in JP1/Base is not changed, the job is started by reusing the access token that was used before the password was changed. For notes on specifying the JP1/Base user management settings, see the chapter that contains notes on user management in the JP1/Base User's Guide. When you change the password, if you set the current password again as the new password, the access token is not released. To obtain a new access token, restart the JP1/AJS3 service.
-
When the JP1/AJS3 service is stopped
All users release their own access tokens.
-
-
If the value of the IsAccessTokenCache environment setting parameter is 1, all jobs share one desktop heap secured when the JP1/AJS3 service is started. Therefore, if there are many jobs that run concurrently, the desktop heap might no longer be sufficient.
-
If the value of the IsAccessTokenCache environment setting parameter is 2, a desktop heap area is created for each user. For example, if 10 users execute jobs, 10 desktop heap areas are created. Therefore, if there are many users, the many desktop heaps that are created might compromise the availability of the space that can be used as desktop heaps by the OS.
-
If the reuse of access tokens is enabled, jobs started by a user share the same desktop heap that was secured the first time that the user acquired an access token. That is, a new desktop heap is not created each time a job is started. If the JP1/AJS3 service account is changed from the system account to a user account, and jobs are executed by that user, new desktop heaps are not created because an access token is not acquired. For details about changing the JP1/AJS3 service account, see 4.2.3 Changing the JP1/AJS3 service settings (Windows only) in the JP1/Automatic Job Management System 3 System Design (Configuration) Guide.