Map %IPM to all namespaces

[isc-rsingh]

Can we keep the code of IPM in a separate database that goes with IRIS - e.g. IPM database file, and make the code itself available from %SYS namespace only?

Testing shows this is NOT AN EASY OPTION:

The code must live in IRISSYS or IRISLIB to be available everywhere. Testing indicates that, if %IPM code exists in a database called IPMDB, and if a package mapping is created in %SYS's database that maps the %IPM package from IPMDB, IPM code will NOT be available throughout other namespaces.

[gjsjohnmurray]

Adding the package mapping to the %ALL pseudonamespace will achieve this for (almost) all names paces. Of course, first you need to add %ALL. It's about time %ALL got created automatically at IRIS installation time, IMO.

[isc-kiyer]

Data Platforms development has pointed out that the %ALL namespace has caused a lot of grief with respect to mirroring (and has had certain security issues in the past) so do not want to deliver IPM OOTB if it relies on that feature i.e. we will not be using the %ALL namespace.

[gjsjohnmurray]

Are these issues documented somewhere?

[isc-rsingh]

Not to my knowledge @gjsjohnmurray. I think it's just institutional knowledge. Let me add that we're committed to making IPM installation completely transparent to users, so it will always just be available to execute in any namespace. It just can't have role escalation abilities.

[gjsjohnmurray]

I think it's just institutional knowledge.

Off-topic for this IPM discussion, but I do hope ISC will consider sharing that "institutional knowledge" somewhere so those of us who tools that make use of %ALL mapping are aware of whatever pitfalls are known.