Re: Restricting User Access - Explaination

["Jeffrey M. Carey" <jeffreycarey@xxxxxxx>]

Another way to handle this is to create a very minimal systems library
list and give the user profile a jobd that only gives it access to the
minimum libraries needed.  Make *PUBLIC *EXCLUDE to all objects in the
system libl, and give the new user proflie explicit access only to what
it needs.  Revoke the user profile's authority to any other libraries on
the system.  

The thing to remember about security is that it can be turned off!  If a
client is running level 10, there is no security, PERIOD.  No one can be
restricted from anything!  Kinda like UNIX...

Chris Ring wrote:
> 
> Thanks for all the replys!
> 
> The reason that I want to do this is because we are developing a client
> application that needs to signon to the AS/400 and check a user ID and
> password (using API's) to see that the the user is a valid AS/400 user
> before allowing the application to run.  The client application will first
> call an RPG program on the AS/400 that accesses the Retrieve User
> Information and Get Password Handle API's, the program needs to have
> appropriate authority to access these API's.  We would like to ensure to
> our customers that the user ID that runs this program cannot access any
> objects on the AS/400 besides the check password program.  We create the
> user profile using this command: CRTUSRPRF  USRPRF(SECUSER)
> INLMNU(*SIGNOFF) LMTCPB(*YES) DSPSGNINF(*NO)  PWDEXPITV(*NOMAX)
> ATNPGM(*NONE)
> 
> We must assume that any security level may be used by our customers.
> 
> Thanks again for your help.
> 
> Chris Ring
> Senior Systems Analyst
> Arksys Inc.
> Little Rock, Arkansas
> 
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to "MIDRANGE-L@midrange.com".
> | To unsubscribe from this list send email to MAJORDOMO@midrange.com
> |    and specify 'unsubscribe MIDRANGE-L' in the body of your message.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to "MIDRANGE-L@midrange.com".
| To unsubscribe from this list send email to MAJORDOMO@midrange.com
|    and specify 'unsubscribe MIDRANGE-L' in the body of your message.
| Questions should be directed to the list owner/operator: david@midrange.com
+---