RE: Hiding Password Parm on QSYGETPH

[qsrvbas@xxxxxxxxxxxx (Tom Liotta)]

midrange-l-request@xxxxxxxxxxxx wrote:

>   5. Hiding Password Parm on QSYGETPH (Bill Freiberg)
>
>I am using the QSYGETPH API to validate a users individual credentials
>(user id and password) in an application and have discovered that if you
>display the QAUDJRN entries for the job running this API, you can see the
>parameters in the open. Is there a way to prevent this? Is there a better
>way to validate a user's profile/password in an app?

Bill:

I suppose the first answer could be to stop logging that info to the audit 
journal if you don't want it there. I'm not sure how many ways there are to get 
call/parm info logged. You may be logging instances of the CALL command for 
example, and there's no way for the system to know which parms of a CALL 
command you'd want excluded.

If you don't want it logged, turn it off. Perhaps you'd be better off logging 
object access on the program object instead.

Or perhaps you should change your method of access.

E.g., instead of QSYGETPH, call the Get Profile Handle (QsyGetProfileHandle) 
API as a procedure. For V5R3, to obtain a profile handle for *CURRENT user, for 
a profile that does not have a password, for a profile that is disabled or when 
the password is expired, use the Get Profile Handle No Password 
(QsyGetProfileHandleNoPwd) API. Refer to Get Profile Handle 
(QsyGetProfileHandle) API documentation for other releases.

Tom Liotta

-- 
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788 x313
Fax    253-872-7904
http://www.powertech.com


__________________________________________________________________
Switch to Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register

Netscape. Just the Net You Need.

New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp