RE: Installing 3rd Party Software using QSECOFR??

midrange-l-request@xxxxxxxxxxxx wrote:

  5. RE: Installing 3rd Party Software using QSECOFR?? (QSCANFSCTL)

qsrvbas@xxxxxxxxxxxx wrote:

The _only_ company that should be asking you to install (or even sign on) 
with QSECOFR is IBM.

<snip>

A flat QSECOFR requirement makes me wonder if the product itself was written 
with a solid understanding of OS/400.

It's more likely the instructions were overly simplified to say QSECOFR
which any System i/i5/iSeries/AS400 administrator should understand.

There are many shops out there with a minimal knowledge of i5OS/OS400.
Just saying QSECOFR minimizes mistakes.

Oh, I don't doubt that and that's a fairly good point.

But OTOH, it's trivial to call the Check User Special Authorities (QSYCUSRS) 
API with, for example, '*ALLOBJ   *SECADM   *IOSYSCFG' as the primary input 
parm and check the indicator that's returned. If the indicator comes back as 
'N', you send a message that says "You need *ALLOBJ *SECADM and *IOSYSCFG to 
install" and exit. The API allows the authorities to come from group 
authorities and elsewhere; it simply checks whether the authorities are 
available to the job.

That's not a lot more difficult than testing if the user is QSECOFR and, if it 
isn't, sending a message saying "You need to be QSECOFR to install" and then 
exiting.

If necessary, the first message might add "...You can install as QSECOFR for 
those authorities.".

But _requiring_ QSECOFR? That's an odd step beyond _allowing_ a QSECOFR install 
or even suggesting one. I suspect we're near the point where that will simply 
disqualify a product from consideration purely on some audit rules. There 
simply is no need for it and hasn't been a need for quite a few years.

Tom Liotta