...

• all write access requires a kerberos ticket, except the OPR accounts
• all configdb api's will use hutch/instrument in the api which will be used for authentication
• all cnf files will access ConfigDB using the opr-account style
• expert groups means unix groups like ps-xpp, psdataps-data
• there will be cross-hutch-expert protection: e.g. ps-xpp won't have permission to write to the TMO databases
• Murali has said experts may have to do an extra step (e.g. set an environment variable) in order use a different URL/end-point for expert-group access (Feb. 25, Murali says since we use kerberos everywhere, don't need different URL).

Calibration Database Access Patterns

...