Re: Authority to a spool file

["John Earl" <john.earl@xxxxxxxxxxxxxxxxxx>]

Richard,

Check to see which user owns the file.  It is likely some user that you are
swapping to in the middle of your job.  The user that built and owns the
file is likely not the same user that you are running as when you try to
access it.

Watch the attribute in the Job header called "Current User".  That is the
user who's authority you are currently running under.  It is not always the
same as the "Job User" - the user that started the job.

You can also control who can read a file based on the attributes of the
outfile that you are routing to.  The out queue may have more restrictive
rights than you are used to.  There is a good chapter in the Security
Reference manual about Out queue authority.  It should help you get quickly
up to speed.

And no, you do not want to give *SPLCTL to QTMHHTTP - unless you want to
grant to everyone on the web the ability to read, change or delete every
spool file on your system.   =:o

jte



--
John Earl
www.powertechgroup.com  john.earl@powertechgroup.com
The Powertech Group Inc. Seattle, Washington
Where the Security Experts Live!

Phone: +1-253-872-7788
Fax:      +1-253-872-7904
--
----- Original Message -----
From: <rbaird@esourceconsulting.com>
To: <midrange-l@midrange.com>
Sent: Monday, May 06, 2002 7:08 AM
Subject: Authority to a spool file


>
> hey all,
>
> I've got a situation where I have an RPG CGI program that creates a spool
> file, closes the printer file and then tries to manipulate the spool.
>
> I'm trying to convert the spool file to a PDF file, using spool-o-matic by
> gumbo.
>
> the spool file is created, and completed, and closed.  but the convert
> command is bombing because it says it the job doesn't have authority to
the
> spool file.
>
> my problem with this is that the job trying to access the spool is the
same
> one that created it.
>
> I do an override to the printer file splfown(*job), and I've double
checked
> that the spool IS listed with the attributes of the job that created it
> (i.e. job name, user and number)
>
> The convert spool command uses JOB(*) for 'current' job and SPLNBR(*LAST)
> to identify the spool file i'm trying to convert.
>
> So, my question(s) are:
>
> Under what circumstances would a job NOT have authority to a spool file
> that it created?
>
> I hate to give the QTMHHTTP user more authority than it needs, is it
> advisable to give QTMHHTTP *splctl authority?   would it even help my
> situation?
>
> any insight would be appreciated.
>
> Thanks,
>
> Rick
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>