RE: How can I limit spooled file access under OperationNavigatorUserwith *SPLCTL special authority ?

 
> For example, QSYSOPR have *SPLCTL special authority to all spooled
file.
> If I limit access outq resource authority to QSYSOPR, QSYSOPR could
not
> operate the important spooled. I just want to limit QSYSOPR couldn't
> display spooled file and couldn't change outq or printer, and  allow
> other operation for problem solving like reprint some page on some
> spooled file owner area locked by spoolede file woner. I can do it
with
> VCP. Could Operation Navigater  do it  ?

Ah!  That's a better question.

I believe that what you really want is for QSYSOPR to have *JOBCTL
special authority not *SPLCTL special authority because *JOBCTL can be
regulated but *SPLCTL cannot.

A user with *JOBCTL special authority can only bypass the authority of
Queues that have their OPRCTL parameter set to *YES (do a WRKOUTQD to
see this parameter, and a F13 to change the parameter).  If the Queue
has the OPRCTL(*YES) parameter setting, then a *JOBCTL user has complete
authority to the queue and it's entries. If OPRCTL is set to *NO, then a
user with *JOBCTL can still work with the queue itself (assuming object
authority of at least *USE), but will need some other authorization to
work with entries on the Queue.

To accomplish what I think you're asking for, do the following:

1) Take away *SPLCTL and grant *JOBCTL to QSYSOPR.
2) Change the Out Queue(s) in question to OPRCTL(*NO).
3) Make sure the DSPDTA parameter is set to *NO (the default) for the
Out Queue(s) in question.
4) Make sure the AUTCHK parameter is set to *OWNER (the default) the Out
Queue(s) in question.
5) Make sure that QSYSOPR (either individually, or through *PUBLIC) has
at least *USE authority to the Out Queue object(s).

Now QSYSOPR will still have broad access to all the other Queues
(assuming that the default parameter sets were taken when the Queues
were built), but won't be able to display the data in the queue's that
you want to restrict.

jte


John Earl - john.earl@powertechgroup.com
The PowerTech Group - Seattle, WA 
+1-253-872-7788 - www.powertech.com