Authority for Query/400 users using MAPICS files

Forwarded by the moderator on behalf of Jacqueline Morgan:
----------------------------------------------------------

All;
We would like to allow a few of our 'power users' to create queries using
Query/400.   We have been struggling for some time as to how to secure
MAPICS files, such that the users cannot get to files they should not see.

One thought is to put these users in a group and GRTOBJAUT AMFLIB/*ALL (our
group) *EXCLUDE, then individually by file, change the authority to allow
access by the group profile.

Another idea is to create special logicals over the sensitive files, and
allow the group access to these but not to the physical.   Either of these
solutions requires us to individually pick and choose each file to secure.
It sounds like a maintenance nightmare.  Particularly, we are concerned with
Payroll.  This means we would have to secure at a minimum, EMPMAS, EMPDED,
PRHSTS, PRHSTD and all the related logicals.  And of course, there is one
person in this group who NEEDS access to the payroll files, so she would
have to be an exception.

It seems no matter what we do, there is some loophole.  We have had to
temporarily secure the WRKQRY command so that they cannot run it from the
MAPICS command line, which would them give them access to the entire MAPICS
database.

I am looking for ideas as to how others have handled this situation.  We
were given a directive to let these users create and run queries, so to
prevent them from doing so is NOT an option.

Any help is greatly appreciated.  Thank you.
_______________________________
Jacqueline Morgan
+---
| This is the MAPICS Mailing List!
| To submit a new message, send your mail to MAPICS-L@midrange.com.
| To subscribe to this list send email to MAPICS-L-SUB@midrange.com.
| To unsubscribe from this list send email to MAPICS-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: dshaw@spartan.com
+---