RE: Problems with adopting authority

It aids in "Security by obscurity" techniques for one thing.
 
 
 
---------------------------------------------------------
Booth Martin   http://www.MartinVT.com
Booth@xxxxxxxxxxxx
---------------------------------------------------------
 
-------Original Message-------
 
From: Midrange Systems Technical Discussion
Date: Monday, March 24, 2003 14:24:52
To: Midrange Systems Technical Discussion
Subject: RE: Problems with adopting authority
 
Why is it so much better to create a user profile with all the authorities 
of QSECOFR, and have the program owned by that user profile than just to 
have it owned by QSECOFR?
 
Rob Berendt
-- 
"They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety." 
Benjamin Franklin 
 
 
 
 
qsrvbas@xxxxxxxxxxxx (Tom Liotta)
Sent by: midrange-l-bounces@xxxxxxxxxxxx
03/21/2003 06:25 PM
Please respond to Midrange Systems Technical Discussion
 
To: midrange-l@xxxxxxxxxxxx
cc: 
Fax to: 
Subject: RE: Problems with adopting authority
 
 
Rob:
 
I'd try it this way...
 
1. Leave owner as QSECOFR (or better, a *SECOFR but not QSECOFR).
2. Leave program as usrprf( *OWNER ).
3. Early in the program, switch to an authorized profile that can execute 
user profile changes.
4. Call QCAPCMD (or whatever) to do the work.
5. Then immediately switch back to whatever user was running the job 
(possibly QTCP).
 
This way, usrprf(*OWNER) has authority to switch both ways and the 
switched-to profile has authority to do the work without requiring adopted 
authority.
 
You should only need to create the one switched-to profile unless you also 
choose to create the alternative *SECOFR profile (a very good idea, 
avoiding QSECOFR).
 
Tom Liotta