Re: QDFTJRN in V5R4 - authority issues

[CRPence <CRPbottle@xxxxxxxxx>]

  FWiW the USROPT(*EXPERT) which enables that /compact view/ presented 
by DSPOBJAUT for the Object and Data rights, is good for a visual, but 
naming each authority value separately as /special values/ is another 
option.  The special values are on the GRTOBJAUT and RVKOBJAUT commands 
for the AUT() parameter.

  Those values listed in the presented DSPOBJAUT compact view are: 
*OBJOPR, *OBJMGT, and *OBJALTER.  Searching STRJRNPF or QDFTJRN with 
*OBJMGT will find the following post in which Carsten suggests *OBJALTER 
is required [kwd sql7905 from that post]:
http://archive.midrange.com/midrange-l/200511/msg01125.html

  So apparently that is an additional object right that is required 
beyond what is documented in the Redbooks document your referenced; 
"Journaling At Object Creation On DB2 For iSeries" noted, but no link. 
A a copy of a Technote by that name, suffixed with TIPS0604, is found at 
both:
http://www.redbooks.ibm.com/abstracts/tips0604.html?Open
http://www.mgd.dk/websider/artikler/tips0604.pdf

  And if so, it that seems like an appropriate use of a Reader Comment 
submission, if an InfoCenter reference can even be found that states 
only *OBJOPR and *OBJMGT are required, or a link from InfoCenter to the 
.pdf for it not even mentioning required authority:
https://publib.boulder.ibm.com/infocenter/systems/topic/rzaki/rzaki.pdf

  However it seems this may be changed in v6r1 [errr IBM i OpSys 6.1]; 
i did not actually read the article.
http://www.google.com/search?num=50&hl=en&lr=&as_qdr=all&q=qdftjrn+objmgt+&btnG=Search
http://systeminetwork.com/article/start-journaling-libraries-ios-61-fixing-problems-qdftjrn

  And although the article implies *OBJALTER is /absurdly/ high level 
of authority, that is a daft claim since that authority offers no other 
capability to the *JRN object.  IMO the *OBJMGT requirement could more 
rightly be claimed as excessive, for what that right offers; but even 
that is moot, since neither MOVOBJ nor RNMOBJ are even supported for the 
*JRN object type... just as there is no /alter/ function applicable to a 
*JRN.

  Note that the *OBJOPR, although it enables redirecting to what Data 
rights are available, IIRC, without that object right, there is no 
ability even to obtain a pointer to the object.

Regards, Chuck

Jeff Crosby wrote:
> Thanks for the idea, I didn't even think of QUADJRN!
>
> QAUDJRN showed it was indeed the *JRN object causing the authority 
> failure.  I did some EDTOBJAUT experimenting on the *JRN object and 
> found the following to be the minimum *PUBLIC authority (so far) I 
> could get away with:
>
> -----Object------   ------Data-------
> O   M   E   A   R   R   A   U   D   E
> X   X       X
>
> (This lines up for me prior to sending the email, but just in case it 
> doesn't upon arrival, the 3 X's are all under the "-----Object------" 
> portion of the screen, under the "O", "M", and "A", respectively.
>
> The help text says:
>
> Object - Help
> The authorities that the user has specifically to the objects. An "X"
> in the column indicates that the user has the specified authority to
> the object named in the row.  The specific object authorities are:
>
> O - Object operational authority provides authority to look at the
> object's attributes and to use the object as specified by the data
> authorities that the user has to the object.
>
> <<SNIP>>
>
> I'm going to try removing from under the "O" and "M" individually and
>  see what happens.  If I read it right, I can remove it from under
> the "O" 'cause *PUBLIC doesn't *have* any data rights.