Re: Single schema access

On 15-Jan-2016 07:03 -0700, rob wrote:

Is there some way to say that if an ODBC user connects to your system
they are only allowed to query data from one particular schema (aka
library)?

Due to a mess with security let's forego the thought of changing each
of the several hundred schemas to GRTOBJAUT ODBCUSER *EXCLUDE one at
a time.

Normally I'm a big fan of securing the data itself and not trying to
patch each of the several dozen ways one can access that data. This
is kind of an audit thing. I'd really rather not go down this tangent
and would rather focus on how I can limit this user to one schema via
ODBC.

Instead of granting *EXCLUDE to that specific user, why not grant *EXCLUDE to *PUBLIC for every library that should not be publicly available? Allow whatever is regarded as /public/ to be available to that user, who by default would be considered part of /public/, and merely /correct/ whatever libraries currently incorrectly allow for access publicly. Having changed Creation Authority (CRTAUT) for the library QSYS to be *EXCLUDE, any new libraries would default to the more secure setting.