RE: Locking out USRPRF with *ALLOBJ

There are few exceptions.  For example if you turn on the system value to 
limit what devices a security officer may use then they cannot use a *DEVD 
unless they are specifically listed on that device.  Even if they have 
*ALLOBJ.  This allows you to limit your security officers from signing on 
other than under the glaring eye of Frau Bluka.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





"Mike" <mshaw2456@xxxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
06/22/2004 01:51 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
"'Midrange Systems Technical Discussion'" <midrange-l@xxxxxxxxxxxx>
cc

Fax to

Subject
RE: Locking out USRPRF with *ALLOBJ






It looks to see if *ALLOBJ is present first when authority lookup is
performed.  If it does find *ALLOBJ, the authority lookup is done and is
allowed to do what is required.

<hth>

Mike Shaw

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
michaelr_41@xxxxxxxxxxxxxx
Sent: Tuesday, June 22, 2004 11:41 AM
To: Midrange Systems Technical Discussion
Subject: RE: Locking out USRPRF with *ALLOBJ

And the security checking model short circuits as soon as it finds
*ALLOBJ, which is checked before other authorities IIRC.

On Tue, 22 Jun 2004 14:37:00 -0400, "Fisher, Don"
<Dfisher@xxxxxxxxxxxxxxxxx> said:
> The CHGUSRPRF help text for *ALLOBJ states:
> "All object authority is granted to this user.  This user has authority
> to
> all objects on the system."
> 
> As I recall, this is definitive.  Any user with *ALLOBJ can do anything
> to
> any object regardless of any authority restrictions. 
> 
> Hope that helps. 
> 
> Donald R. Fisher, III
> Project Manager
> Roomstore Furniture Company
> (804) 784-7600 extension 2124
> DFisher@xxxxxxxxxxxxx
> 
> <clip>
> Is there a way to lock a USRPRF that has ALLOBJ authority out of a
> specific
> library and/or command?
> <clip>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
> 
-- 
 
  michaelr_41@xxxxxxxxxxxxxx

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.