RE: hide payroll from the security officer

Greg,

This will work up to a point.  However, since GEORGE has *ALLOBJ 
authority, he can just remove the *EXCLUDE from his profile and then 
he will be in.

Remember, *ALLOBJ is God.  If you have this, there is not much you can 
NOT do.  It is more of a question of how much do you know how to do.

Bob

-----Original Message-----
From:   Greg Day [SMTP:gregday@starcity.com.au]
Sent:   Tuesday, June 22, 1999 1:32 AM
To:     MIDRANGE-L@midrange.com
Subject:        Re: hide payroll from the security officer

Alan,
Sorry this reply is so late. I've had a problem as a new user to the 
list
getting my mails through.

You wrote:-

>I'd like to set up someone as a security officer, but exclcude them 
from
>certain libraries.  What is the best way to go about doing this?

If you user profile has *ALLOBJ special authority then you cannot 
restrict
access to libraries. Typically a *SECOFR user will have *ALLOBJ.

Here's what you can do:

1. Create a group profile (eg: GRPSEC) as a *SECOFR user class (with
*ALLOBJ authority etc)

2. Create a user profile (GEORGE) with say the *SYSOPR user class and 
group
this profile to GRPSEC. parameter GRPPRF(GRPSEC).

3.  Grant private authority to the libraries for GEORGE to be 
*EXCLUDE. You
can leave PUBLIC authority alone.

This will allow George to be a Security Officer with ALL the *SECOFR
special authorities, but will restrict his authority to the libraries 
you
choose, even if PUBLIC authority is *USE *CHANGE or even *ALL.

This works because of the sequence that that the authority is checked. 
 I
have an old redbook that lists the Authority search order:

USER PROFILE
1. Does user profile have *ALLOBJ special authority (In GEORGE's case
...NO)
2. Does user profile have explicit authority to the object (This is 
where
we come in. GEORGE is EXCLUDED)
3. Does user profile appear on the authorization list of the object.

GROUP PROFILE
4. Does group profile have *ALLOBJ special authority.
5. Does group profile have explicit authority to the object.
6. Does group profile appear on the authorization list of the object.

PUBLIC
7. Use the object *PUBLIC authority unless *AUTL is indicated.
etc
etc

GEORGE is EXCLUDED from you sensitive libraries in step 2. Authority
checking then stops.

Hope this helps

Greg Day


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to 
MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: 
david@midrange.com
+---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---