× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Charles Wilt wrote:

*ALLOBJ means all objects....

However....trying taking *ALLOBJ off the user's profile. Instead,
make them a member of a gourp that has *ALLOBJ.

Now the security check will see the exclude before it checks for
*ALLOBJ on the group.

This can be a useful _temporary_ technique, but should not be relied upon nor put into general or widespread use. I've used it in a number of cases where further actions had to be delayed.

It works pretty much as advertised -- the private authorities are checked and /found/ before group authorities are checked. Once an appropriate authority is found, authority checking ends.

/However, it cannot be ignored that *ALLOBJ is still available./ An enterprising user may discover (or learn) multiple ways to access it.

As noted in the first sentence, "*ALLOBJ means all objects....". Beyond that, it is a 'special authority'. It's "special" because it overrides any and every private object authority that's granted to the user who has *ALLOBJ.

With *ALLOBJ, you can be fairly certain that any other desired authority can be obtained. There's a lot of info available out there nowadays.

Tom Liotta

On 8/14/08, Burns, Bryan wrote:
Is there a way to restrict a user with *ALLOBJ user profile special
authority from adding a job to the advanced job scheduler? I changed the
function authority to *EXCLUDE for the user but the user can still add a
job.



As an Amazon Associate we earn from qualifying purchases.

This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.