RE: Problems with adopting authority

["Gary Monnier" <gary.monnier@xxxxxxxxxxxxxxxxxx>]

Rob,

Believe it or not, there are things you cannot do with QSECOFR but can
do with a profile that has *QSECOFR authority.  IBM has placed
restrictions on QSECOFR to be compliant with other systems that use
stream files.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Booth Martin
Sent: Monday, March 24, 2003 11:31 AM
To: midrange-l@xxxxxxxxxxxx
Subject: RE: Problems with adopting authority


It aids in "Security by obscurity" techniques for one thing.
 
 
 
---------------------------------------------------------
Booth Martin   http://www.MartinVT.com
Booth@xxxxxxxxxxxx
---------------------------------------------------------
 
-------Original Message-------
 
From: Midrange Systems Technical Discussion
Date: Monday, March 24, 2003 14:24:52
To: Midrange Systems Technical Discussion
Subject: RE: Problems with adopting authority
 
Why is it so much better to create a user profile with all the
authorities 
of QSECOFR, and have the program owned by that user profile than just to

have it owned by QSECOFR?
 
Rob Berendt
-- 
"They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety." 
Benjamin Franklin 
 
 
 
 
qsrvbas@xxxxxxxxxxxx (Tom Liotta)
Sent by: midrange-l-bounces@xxxxxxxxxxxx
03/21/2003 06:25 PM
Please respond to Midrange Systems Technical Discussion
 
To: midrange-l@xxxxxxxxxxxx
cc: 
Fax to: 
Subject: RE: Problems with adopting authority
 
 
Rob:
 
I'd try it this way...
 
1. Leave owner as QSECOFR (or better, a *SECOFR but not QSECOFR). 2.
Leave program as usrprf( *OWNER ). 3. Early in the program, switch to an
authorized profile that can execute 
user profile changes.
4. Call QCAPCMD (or whatever) to do the work.
5. Then immediately switch back to whatever user was running the job 
(possibly QTCP).
 
This way, usrprf(*OWNER) has authority to switch both ways and the 
switched-to profile has authority to do the work without requiring
adopted 
authority.
 
You should only need to create the one switched-to profile unless you
also 
choose to create the alternative *SECOFR profile (a very good idea, 
avoiding QSECOFR).
 
Tom Liotta

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.