RE: Group Ownership (was RE: Private Authority)

[Steve Martinson <s.martinson@xxxxxxxxxxxxx>]

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
--
[ Picked text/plain from multipart/alternative ]
Steve,

Tom's message about having an innocuous profile act as the object owner is
right on.  The standard that I have used in the past is to have "dummy"
profiles that do nothing but own objects.  For example, profile PRODOWNER
would own all of the production application objects and TESTOWNER would own
all of the test objects (if unable to physically separate your production
and test environments).  Each of these profiles would be set to PASSWORD =
*NONE, with INLPGM = *NONE and INLMNU = *SIGNOFF.  This would ensure that
the object-owning profiles could not be used, which is important since the
object owner has *ALL authority to the objects.  Additionally, if using a
change management utility like Implementer or Aldon's Workbench, the
ownership of objects being promoted from test to production can easily be
configured to follow this scheme.  Finally, the fact that an unused profile
owns the object ensures that there will not be any issues when deleting the
profiles of terminated employees.  Nothing's worse than trying to delete a
profile in accordance with your user profile management policy only to find
that it owns tons of objects, many of which are often locked by production
processes!!

I have experienced the benefits of this on many occasions as a security
practitioner.  In many OTS (Office of Thrift Supervision), FDIC, and
self-engaged third party audits, this ownership scheme was lauded as the
best way to manage object ownership.

Steven Martinson
Product Marketing Manager, iSeries and AS/400
PentaSafe Security Technologies, Inc.
http://www.pentasafe.com
Toll Free: 1.888.400.2834, x9585
Direct Dial: 1.713.860.9585


-----Original Message-----
From: srichter [mailto:srichter@mail.autocoder.com]
Sent: Thursday, September 06, 2001 7:56 PM
To: midrange-l@midrange.com
Subject: Re: Group Ownership (was RE: Private Authority)


---------- Original Message ----------------------------------
From: thomas@inorbit.com
Reply-To: midrange-l@midrange.com
Date: 6 Sep 2001 17:31:21 -0700

>Wherever possible, I would recommend having a separate owner profile that
does nothing but act as owner. Allowing rights of an owner to be available
to the group members can be serious trouble (especially with programmers).
>

Refresh my memory here Tom, does not the group member have the authority of
the group profile? Esp if group members are Owner(*GrpPrf).
Are you refering to the special authority that the group profile may have
that is not propagated to the members?

Regards,

Steve Richter

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.