RE: Security Question

Hello all:

The referenced API method provides the following characteristics:

You will need *USE authority to the QSECOFR profile in order to make this
work or
      the program calling these APIs will have to adopt authority.
Jobs submitted are using the QSECOFR profile.
Print files will show using the QSECOFR profile.
Objects created are based upon the QSECOFR profile.
The "created by user profile" in the object description will be QSECOFR.
The adopted authority is QSECOFR and not the combination of prior
authorities.
Security Audit Journal will a PS record, if enabled.
Auditing based upon new user profile.
The QSECOFR authority WILL NOT TERMINATE when the program is ended.

The referenced adopted authority method has the following characteristics:

Anybody with *USE authority to the program will be able to get QSECOFR
authority.
Jobs use the original user profile.
Objects created are still based upon the original profile.
The "created by user profile" in the object description will be the base
user profile.
The audit journal will get an AP record, if enabled.  Unfortunately, there
could be
        tons of these AP records so the use of adopting authority can get
hidden.
Exiting the program that calls QCMD will lose the adopted authority.


Steve Glanstein
mic@aloha.com



>From: "Kenneth E. Graap" <kgraap@clackesd.k12.or.us>
>Subject: Security question

>Midrangers....

>What, if any, difference is there between the following two methods of
>giving a user access to a command screen with QSECOFR authority:

>Program #1 - API method... 

>Owner  . . . . . . . . :   QSECOFR 
>User profile . . . . . :   *USER 

> DCL        VAR(&PRFHDL) TYPE(*CHAR) LEN(12)
> CALL       PGM(QSYGETPH) PARM('QSECOFR   ' '*NOPWD    ' &PRFHDL)
> CALL       PGM(QWTSETP) PARM(&PRFHDL)                      
> CALL       PGM(QCMD)

>Program #2 - Program authority adoption method

>Owner  . . . . . . . . :   QSECOFR 
>User profile . . . . . :   *OWNER

> CALL       PGM(QCMD)

 
>Kenneth                 
                                                            
>- -- 
>* *************************************** *
>Kenneth E. Graap               
>Coordinator - Network Operations Center 
>Clackamas Education Service District   
>PO 216 / Marylhurst,  OR  97036-0216   
>503 635 0551        FAX 503 635 0578
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---