RE: Adopted authority and triggers

Thank you for your response. The trigger programs and the files have the
same owner. The owner has *ALL object authority for both the programs
and the files.

However, the owner is used on our system as a group profile. It doesn't
seem to matter with the other programs in the call stack, but does that
complicate matters with triggers?

Roger Mackie

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Ed Fishel
Sent: Tuesday, April 03, 2007 8:12 AM
To: Midrange Systems Technical Discussion
Subject: Re: Adopted authority and triggers


Roger Mackie wrote on 04/03/2007 07:50:25 AM:

I am working on a project to give a specific user (LMTUSR) limited
access to our database. As currently designed, LMTUSR is excluded from

all but one library. The external stored procedures (SQLRPGLE and
RPGLE) in that library adopt the owner's authority to access functions

and data in other libraries. As long as those functions are in modules

that only read the data, they work fine. However, the project requires

procedures to insert data in certain tables that have *BEFORE *INSERT
and *BEFORE *UPDATE external triggers.

From reading the security reference manual (we are on v5r3) I
understand

that triggers do not adopt authority from programs earlier in the call

stack. Changing the external trigger programs to adopt authority
(CHGPGM
PGM(EXTTRG) USRPRF(*OWNER)) did not allow LMTUSR to open the files for

update using adopted authority. When the triggers are disabled, UDFs
that access the files complete correctly. When the triggers are
enabled, the process fails with SQL0443 and CPF4236 "Not authorized to

open.." in the job log. I could not find a parameter on the ADDPFTRG
command to adopt authority.

Did I miss something? While using adopted authority is there a way to
insert and/or update data into files with triggers? If not, I'll
probably use a data queue to get the data to a job whose user does
have authority. Or is there a better way?

Trigger programs, like most exit programs, do not use the adopted
authority of programs above it in the call stack. If the trigger
program needs more authority you can change it to adopt its own owners
authority. If after using CHGPGM USRPRF(*OWNER) for the trigger
program it still fails for these limited users then it probably means
that the owner of the trigger program does not have sufficient authority
to open the file. One way to solve that program is to change the
trigger program to be owned by the same user profile that owns the
files.

Ed Fishel,
edfishel@xxxxxxxxxx

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.