Re: Adopted authority vs profile switching

[Vern Hamberg <vhamberg@xxxxxxxxxxxxxxxxxxxxxxxxx>]

One use of profile switching is to _enforce_ security. Esp. for client 
apps, you switch to the logged on user, then only the authorization of that 
user is allowed. So it is not just for switching to something with more 
authority.

Vern

At 11:37 AM 7/16/2004, you wrote:
> Rob,
>
> I think profile switching should only be done in batch jobs at night time, 
> not in interactive jobs. And I also think, that profile swapping is 
> (still) a great security hole.
>
> I do not want to know what could and will happen (or even to find that 
> out), if users get access to a command line after a profile switch.
>
> It is easy to write a simple command using profile switching; half the 
> code is in the manuals. If you have *USE rights to a user profile with 
> higher authority, you can swap to that profile without knowing her 
> password. I experienced once with this: being a user of class *SECOFR I 
> granted myself the *USE right to the QSECOFR profile. Then swap to the 
> QSECOFR profile (without entering a password)  and I was the QSECOFR, 
> viewing the DLO folders, as my user profile was not registered in the DIR.
>
> Perhaps I should put the code on the list.
>
> Regards,
> Carel Teijgeler
>
> *********** REPLY SEPARATOR  ***********
>
> On 16-7-04 at 9:57 rob@xxxxxxxxx wrote:
>
> >At one time IBM decided that using adopted authority should not work in 
> certain situations, like creating certain group profiles, etc.  >Perhaps 
> they thought this was a security enhancement.Then they allowed a 
> workaround with profile switching.
> >
> >So then, does this not allowing adopted authority in these situations 
> now go into the realm of 'security by obscurity' and should they >just 
> open these up to adopted authority?  Or do you see a value into making 
> people use these api's to do profile switching, - in this >situation - ?
> >
> >Now, I am not arguing that profile switching may not be useful in some 
> client serving or web based applications.  I am just arguing >about it in 
> the first situations.