Re: Access to swapped username after call to QWTSETP

Hi Rob,

That's true, but I'd say that's the exception, not the rule. As a general rule, I'd suggest using the current user profile instead.

Furthermore, I'd suggest that if you do need to temporarily swap profiles to open an IFS file, that you do so just for the open() call, then swap back. Don't stay swapped! The shorter the time you're swapped to the higher authority, the less likely there will be an opportunity for a security compromise.

Better yet, for IFS authority concerns, instead of swapping profiles, see if it's possible to use group profile authorities and swap the group profile (setgid) instead of the regular profile. The security exposure is much more limited that way.



rob@xxxxxxxxx wrote:

There may be some rare times when you do want the job user instead of the current user. For instance, a job is running under CLERK but needs higher authority to access an IFS file and adopted authority doesn't respect IFS so you swap profiles to MRALLOBJ. In that case you may still want the job user profile (CLERK) on the report and not the current user profile (MRALLOBJ).
Just food for thought.

Rob Berendt