Re: Authorization Lists vs Private Authorities

In the security checking process, OS/400 will first check for any private
authorities. In the example you give, if an authority greater than *USE is
required, this first authority check will fail. OS/400 will then go on to
check authorities provided by authorization lists. In this situation, the
user will be found to have authority to the object in question and allowed
to proceed.

Regards,

Richard J. Serrano
Palace Guard Software
Within the U.S.   (800) 762-3696
Outside the U.S   (562) 435-3355
Fax                      (562) 435-0010
rjs@pgsas400.com
http://www.pgsas400.com

Palace Guard Software is a leading developer and provider of Information 
Technology Security
software dedicated to assisting Information Security professionals in 
protecting the information
assets of their organizations.

----- Original Message -----
From: <robert.lilley@springs.com>
To: <MIDRANGE-L@midrange.com>
Sent: Monday, February 07, 2000 5:57 AM
Subject: Authorization Lists vs Private Authorities


> If a given user profile has *ALL authority to an object via an
> authorization list and *USE authority (private authority) is also granted
> to the same profile to the same object, what level of access does the
> profile truly have?  In other words, which takes precedence -- the
> authorization list or the private authority?


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---