Restrict developers access to a MobileFirst production environment - ibm-mobilefirst

Question

Have a business requirement to prevent development users from being able to access production and integration MFP environments; However, they can retain full access to the test environment.
Currently have the following Active Directory security groups configured for the production environment:
mfpadmin
mfpdeployer
mfpmonitor
mfpoperator
mfpanalytics_administrator
mfpanalytics_infrastructure
mfpanalytics_support
mfpanalytics_developer
mfpanalytics_business
mfpappcenteradmin
mfpappcenteruser
Within the server.xml file there is an LDAP connection and then a section defining security roles. These AD group names are reflected in the security role section. To fulfill the requirement above, one may presumably creates new active directory security groups similar to the ones listed above (something like mfpadmin-test, mfpadmin-int), add development users to these newly created test groups, e.g., mc-admin-test, remove these same users from the groups defined for the production environment, e.g., mfpadmin, and update the appropriate server.xml file.
Is there anything inside of the specific applications (Admin, Analytics, AppCenter) that one needs to do to further restrict access?
Is there anything needed to be done with the war file?

Answer 1

Is there anything inside of the specific applications (Admin, Analytics, AppCenter) that one needs to do to further restrict access?
(A) No just defining the right security roles should be sufficient
Is there anything needed to be done with the war file?
(A) No , nothing to do with the war file.
mfpadmin,mfpdeployer,mfpmonitor, and mfpoperator are the default security roles defined by Mobilefirst. The same security roles will need to be defined for your test and integration environments. These security roles can in-turn be grouped to the right groups i.e
mfpadmin-test, mfpadmin-in etc.