RE: object ownership

While I agree with Charles that a proper design would preclude users from
putting objects into the main application library (outside of an adopted
authority program that was designed to do it) many applications do just
that. So saying don't do it is not a solution.

I would write a program that scans the library twice a day to find permanent
objects (not transient ones that are used in processing like data areas,
user spaces, temporary files etc.) and simply change the owner and
permissions to what you want. At the same time punch out a report that the
security officer can review to see if inappropriate objects are showing up.

--
Jim Oberholtzer
Agile Technology Architects


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Charles Wilt
Sent: Tuesday, May 31, 2016 8:08 AM
To: Midrange Systems Technical Discussion
Subject: Re: object ownership

Probably not a good idea...

The only way you could do it without exit programs ect would also end up
with all your users having *ALL authority to every object in your ERP.

IMHO, your users shouldn't be allowed to create objects in the ERPLIB.

Instead, create a ERPUSRLIB to use as the default current library for the
users. Any user created objects should go in there.

Charles


On Fri, May 27, 2016 at 11:17 AM, Gerald Magnuson <
gmagqcy.midrange@xxxxxxxxx> wrote:

so say we have a library, and those objects are owned by a group
profile
like:
"ERPSYS",

however, our users are in groups like "PURCHASC" and "OPERATNS"...

when _they_ create objects in our main library (they rarely do), the
objects are owned by their group, not the group "ERPSYS"...

I am not sure it matters from a security standpoint, but we would like
all objects owned by "ERPSYS".

what do we need to change so when a USER creates Files, they will be
owned by the ERPSYS group?
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.