Re: Why do software companies always want ALLOBJ -- MIDRANGE-L



This is the method we have used as well, and our auditors were OK with it too.
All of our application objects, with the exception of the initial program and
batch driver program, are owned by a dummy profile with NO password. We run
reports regularly to check that no one is grouped to this profile. Public
authority on all application objects is set to *EXCLUDE. We have a different
group profile that has private authority to the application libraries (not the
objects inside) and the initial program and batch driver program. Both of these
programs are also owned by the application owner profile and run under adopted
authority. Security is then handled at the application menu level. This set up
doesn't really work for people who may need to access files directly (such as
downloading to a PC), so we use separate group profiles with private authority
to control this.


Adam Driver
Star City
Sydney, Australia





"alan shore" <SHOREA@dime.com> on 14/09/2000 03:24:48

Please respond to MIDRANGE-L@midrange.com

To:   MIDRANGE-L@midrange.com
cc:    (bcc: Adam Driver/SC/StarCity)
Subject:  Re: Why do software companies always want ALLOBJ




Create a user profile (for example DUMMYUSER), with NO password, but with
ALLOBJ.
Change the owner of the application (each and every executable where applicable)
to DUMMYUSER.
Change each and every executable where applicable to adopt owner authority.
This means that whatever, whenever and whereever this application is run, each
executable run adopts the owners authority.
We have used this method in a number of places so that the user can obtain the
data they are looking for, even though thay may not be authorized to a
particular command or object.
NOTE - quite a lot of analysis will be needed to obtain the "where applicable"
portion. Its well worth the effort as both our internal auditing and ALL the
external auditors had NO problems with this procedure.

>>> "Graziano, Marie" <mgraziano@badgermeter.com> 09/13 11:37 AM >>>
I am currently working with a software vendor that is asking for the userid
for the software to have ALLOBJ.  Now we all know that this is a very very
bad move.  However, in order to get the product up and running I had to do
it.  What are other companies doing?  And why do the software vendors not
understand what ALLOBJ is and does.  IF the user id was not used to sign in,
then I would not have a problem, but the software signs in with the userid
each day.

Marie Graziano

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---








______________________________________________________________________
This document should only be read by those persons to whom it is addressed and
is not intended to be relied upon by any other person. Accordingly, Star City
disclaims all responsibility and accepts no liability (including in negligence)
for the consequences for any other person acting, or refraining from acting, on
such information prior to the receipt by those persons of subsequent written
confirmation.

If you have received this document in error, please notify our Helpdesk
immediately by telephone on 61 2 9657 9797. Please also destroy and delete the
document from your computer.

Copyright Star City Pty Ltd. Any form of reproduction, dissemination, copying,
disclosure, modification, distribution and/or publication of this document and
its contents is strictly prohibited.


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---