Re: hide payroll from the security officer

Alan,
Sorry this reply is so late. I've had a problem as a new user to the list
getting my mails through.

You wrote:-

>I'd like to set up someone as a security officer, but exclcude them from
>certain libraries.  What is the best way to go about doing this?

If you user profile has *ALLOBJ special authority then you cannot restrict
access to libraries. Typically a *SECOFR user will have *ALLOBJ.

Here's what you can do:

1. Create a group profile (eg: GRPSEC) as a *SECOFR user class (with
*ALLOBJ authority etc)

2. Create a user profile (GEORGE) with say the *SYSOPR user class and group
this profile to GRPSEC. parameter GRPPRF(GRPSEC).

3.  Grant private authority to the libraries for GEORGE to be *EXCLUDE. You
can leave PUBLIC authority alone.

This will allow George to be a Security Officer with ALL the *SECOFR
special authorities, but will restrict his authority to the libraries you
choose, even if PUBLIC authority is *USE *CHANGE or even *ALL.

This works because of the sequence that that the authority is checked.  I
have an old redbook that lists the Authority search order:

USER PROFILE
1. Does user profile have *ALLOBJ special authority (In GEORGE's case
...NO)
2. Does user profile have explicit authority to the object (This is where
we come in. GEORGE is EXCLUDED)
3. Does user profile appear on the authorization list of the object.

GROUP PROFILE
4. Does group profile have *ALLOBJ special authority.
5. Does group profile have explicit authority to the object.
6. Does group profile appear on the authorization list of the object.

PUBLIC
7. Use the object *PUBLIC authority unless *AUTL is indicated.
etc
etc

GEORGE is EXCLUDED from you sensitive libraries in step 2. Authority
checking then stops.

Hope this helps

Greg Day


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---