Re: Installing running applications as QSECOFR

David Gibbs wrote:

In the case of SCM products, the authority REALLY is needed ... because they have to be able to _manage_ the authorities of the code they are moving around. It's hard to manage the (often vastly differing) authorities of other code unless you have adequate authority. In these cases, QSECOFR authority is a necessity.

I have to defer to your knowledge, but as far as I know, you should never need more authority to manage an object than the owner of that object. Theoretically you should only need *USE authority to those profiles which own the application objects. Now, if you are managing objects owned by QSECOFR, then yes, the black hole opens. But it's rare in my mind that application objects need QSECOFR authority.

In fact, I would go so far as to say that a CMS system should have a mechanism by which certain objects could be designated as "secure" objects. Management of these objects would require a special CMS profile with special authority outside the realm of normal application development. The point being that Disgruntled Developer shouldn't be able to modify, say, the system startup program.

My guess is that most CMS systems would have something like that available.

Joe