Question & Answer
Question
How is the IBM® Rational® ClearCase® CLEARCASE_GROUPS environment variable used in a Microsoft® Windows®, UNIX® and Linux® environment?
Answer
About the variable on UNIX an Linux Windows This variable is used to counteract a limitation in the SUNRPC protocol that is used by ClearCase whereby any user who is a member of more than 32 Microsoft Windows groups (domain or local) can run into access problems. See technote 1131881 for additional information about this limitation. Users should set CLEARCASE_GROUPS as a Windows User variable in order to specify which subset of those groups Rational ClearCase should consider when checking the user's access rights. If the user environment variable CLEARCASE_GROUPS exists for any user, ClearCase will consider the semicolon-separated list of groups specified in the value of this variable first when determining (or displaying) which groups a user belongs. In essence, when you log in to Windows, you receive an Access Token. ClearCase will process these tokens in the order Windows provides them (which is completely random and cannot be configured in any way). ClearCase will stop processing the tokens after 32 groups have been reached. The CLEARCASE_GROUPS variable is the only way to work around this behavior. When the variable is set, ClearCase will look at each group name in CLEARCASE_GROUPS list in the order the list was written and compare that to the Windows Access Tokens provided. If the group name matches a group in the Windows Access Token, then ClearCase will create a ClearCase Access Token for that group to use. Note: Review the APAR below for the work around and solution to the problem related to creating a semi-colon separated list. If the user is a member of additional groups not specified in CLEARCASE_GROUPS, ClearCase will consider those groups after it has considered the groups listed in CLEARCASE_GROUPS, up to a limit of 32 groups. Log off Microsoft Windows and log back on to enable the CLEARCASE_GROUPS variable.
When the CLEARCASE_GROUPS variable is exhausted, ClearCase will go back to the Windows Access Token list, and any group that has not already been added to the ClearCase token, will be added from the remaining list in the order provided, until all groups in the Windows token are used (if below 32) or the 32 group limit is reached.
Example:
CLEARCASE_GROUPS=DOMAIN\ClearCase Users;DOMAIN\group1;DOMAIN\group5
The list can contain domain or local groups, but must not include the group that is specified in the environment variable CLEARCASE_PRIMARY_GROUP. See technote 1135509 for more information about the CLEARCASE_PRIMARY_GROUP variable.
CLEARCASE_GROUPS is not supported on Windows 98 or Windows Me.
History:
The CLEARCASE_GROUPS workaround is only available to ClearCase 4.x with the below patches (or any later patch that obsoletes any of the following patches):
clearcase_p4.0.NT-21 |
clearcase_p4.1.NT-17 |
clearcase_p4.2.NT-1 |
Further, this feature does not work in ClearCase version 2002.05 before patches
clearcase_p2002.05.00.NT-15 |
clearcase_p2002.05.00.NT-14 |
This feature is built in to ClearCase 2003.06.00 and later.
UNIX and Linux
The CLEARCASE_GROUPS variable was introduced to UNIX and Linux as of ClearCase 7.0 and is used ONLY as part of a larger work around to help alleviate the problem related to the 16 group limitation issue. Review technote 1207807 for more details along with information about the second part of the work around which involves a new utility called setgroup-swap.
Related Information
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21124574