RE: RE: Supplemental Groups

midrange-l-request@xxxxxxxxxxxx wrote:

>   3. RE: Supplemental Groups (Rubino, Jim)
>
>All of these replies have been somewhat interesting but not answering my
>question or helping me very much.
>
>For auditing purposes here, we need to show all of the files that have
>the supplemental group id/profile having authority to it and a listing
>of all of the user profiles who have this supplemental group id/profile
>on the SUPGRPPRF field.
>
>Does anyone know of a way to get this information (IBM command to *print
>or a Taatool)?

Jim:

Try the List Objects User Is Authorized to, Owns, or Is Primary Group of 
(QSYLOBJA) API. Format OBJA0100 gives basic info for QSYS.LIB objects; format 
OBJA0110 gives similar info for non-QSYS.LIB (IFS) objects. Formats OBJA0200 
and OBJA0210 give more detail, and OBJA0300/310 even more.

The request is for a given profile and is for *OBJAUT (objects authorized), 
*OBJOWN (objects owned) and/or *OBJPGP (objects for which the profile is the 
'primary group'). A continuation handle allows the API to be called multiple 
times if the list is too large for a single space.

Getting the list out to a printer means writing a program to call the API, and 
then to loop through the list while sending each list entry to a print line.

Particularly because of non-QSYS.LIB objects, I'm not sure if any OS/400 
command helps you a lot. The DSPUSRPRF *OBJOWN and *OBJAUT parameters could do 
most of the work for QSYS.LIB.

Keep in mind that special-authorities can change the effective list 
drastically. Various authorities to other profiles or to programs that adopt 
also complicate it all.

Tom Liotta