Re: Restricting Users with *ALLOBJ in the Advanced Job Scheduler

Charles Wilt wrote:

*ALLOBJ means all objects....

However....trying taking *ALLOBJ off the user's profile. Instead,
make them a member of a gourp that has *ALLOBJ.

Now the security check will see the exclude before it checks for
*ALLOBJ on the group.

This can be a useful _temporary_ technique, but should not be relied upon nor put into general or widespread use. I've used it in a number of cases where further actions had to be delayed.

It works pretty much as advertised -- the private authorities are checked and /found/ before group authorities are checked. Once an appropriate authority is found, authority checking ends.

/However, it cannot be ignored that *ALLOBJ is still available./ An enterprising user may discover (or learn) multiple ways to access it.

As noted in the first sentence, "*ALLOBJ means all objects....". Beyond that, it is a 'special authority'. It's "special" because it overrides any and every private object authority that's granted to the user who has *ALLOBJ.

With *ALLOBJ, you can be fairly certain that any other desired authority can be obtained. There's a lot of info available out there nowadays.

Tom Liotta

On 8/14/08, Burns, Bryan wrote:

Is there a way to restrict a user with *ALLOBJ user profile special
authority from adding a job to the advanced job scheduler? I changed the
function authority to *EXCLUDE for the user but the user can still add a
job.