Re: Edit Object Authority for Library, Program, File and User Security.....

Joep Beckeringh wrote:

<<SNIP>> Adopted authority is passed on in the call stack.

Say user PETER calls program A, that is owned by PAUL and has USRPRF(*OWNER). During execution of A the combined authorities of
PETER and PAUL are used. When program A calls program B, that is
owned by MARY and has USRPRF(*OWNER), authorities of PETER, PAUL
and MARY are used.

Exceptions:
- When a program has USEADPAUT(*NO) it 'breaks the chain';
- SQL statements; when you use <ed: Dynamic> SQL in your program and want to use adopted authority you have to use SQL setting DYNUSRPRF(*OWNER)
- Stream files; filesystems other than QSYS.LIB have no notion of
adopted authority; you're on your own 'out there'.

Another exception, and it is subtle: If PgmA is in the stack and adopting, if PgmB is not called directly from PgmA but instead as an Exit-Program [registered perhaps via WRKREGINF or something like a SQL UDF or Stored Procedure, the adopted authorities are stopped. In that case the OS [e.g. the integrated DB2 for i] must effect the CALL of the /exit/ program [i.e. an exit from system code into user code] with a "suppress adopt" feature; i.e. effectively invoking the called program as if that callee had the USEADPAUT(*NO) attribute established, irrespective of its actual Use Adopted Authority attribute setting.

Regards, Chuck