× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  • Subject: RE: hide payroll from the security officer
  • From: "Greg Day" <gregday@xxxxxxxxxxxxxxx>
  • Date: Wed, 23 Jun 1999 17:42:59 +1000

Bob,

In my example GEORGE does NOT have *ALLOBJ authority, but is grouped to a
profile (GRPSEC) that does have *ALLOBJ.  If he is explicitly EXCLUDED from
the PAYROLL library he cannot change the authority for that library. So he
cannot grant himself authority. He would have to sign-on as QSECOFR or
GRPSEC to grant himself authority, which of course, he can do. I would
Qaudit these two profiles.

I agree with all the philosophy on protecting who has *ALLOBJ etc.  I was
simply answering the original question.

Greg







Bob Crothers <bob@cstoneindy.com> on 22/06/99 20:54:07

Please respond to MIDRANGE-L@midrange.com

To:   "'MIDRANGE-L@midrange.com'" <MIDRANGE-L@midrange.com>
cc:    (bcc: Greg Day/SC/StarCity)
Subject:  RE: hide payroll from the security officer




Greg,

This will work up to a point.  However, since GEORGE has *ALLOBJ
authority, he can just remove the *EXCLUDE from his profile and then
he will be in.

Remember, *ALLOBJ is God.  If you have this, there is not much you can
NOT do.  It is more of a question of how much do you know how to do.

Bob

-----Original Message-----
From:     Greg Day [SMTP:gregday@starcity.com.au]
Sent:     Tuesday, June 22, 1999 1:32 AM
To:  MIDRANGE-L@midrange.com
Subject:  Re: hide payroll from the security officer

Alan,
Sorry this reply is so late. I've had a problem as a new user to the
list
getting my mails through.

You wrote:-

>I'd like to set up someone as a security officer, but exclcude them
from
>certain libraries.  What is the best way to go about doing this?

If you user profile has *ALLOBJ special authority then you cannot
restrict
access to libraries. Typically a *SECOFR user will have *ALLOBJ.

Here's what you can do:

1. Create a group profile (eg: GRPSEC) as a *SECOFR user class (with
*ALLOBJ authority etc)

2. Create a user profile (GEORGE) with say the *SYSOPR user class and
group
this profile to GRPSEC. parameter GRPPRF(GRPSEC).

3.  Grant private authority to the libraries for GEORGE to be
*EXCLUDE. You
can leave PUBLIC authority alone.

This will allow George to be a Security Officer with ALL the *SECOFR
special authorities, but will restrict his authority to the libraries
you
choose, even if PUBLIC authority is *USE *CHANGE or even *ALL.

This works because of the sequence that that the authority is checked.
 I
have an old redbook that lists the Authority search order:

USER PROFILE
1. Does user profile have *ALLOBJ special authority (In GEORGE's case
...NO)
2. Does user profile have explicit authority to the object (This is
where
we come in. GEORGE is EXCLUDED)
3. Does user profile appear on the authorization list of the object.

GROUP PROFILE
4. Does group profile have *ALLOBJ special authority.
5. Does group profile have explicit authority to the object.
6. Does group profile appear on the authorization list of the object.

PUBLIC
7. Use the object *PUBLIC authority unless *AUTL is indicated.
etc
etc

GEORGE is EXCLUDED from you sensitive libraries in step 2. Authority
checking then stops.

Hope this helps

Greg Day


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator:
david@midrange.com
+---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator:
david@midrange.com
+---






+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---


As an Amazon Associate we earn from qualifying purchases.

This thread ...


Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.