Re: CPYFRMSTMF, adopted authority and QSYGETPH

Joep Beckeringh wrote:

In 6.1 command CPYFRMSTMF was changed; the database file member
is accessed through its IFS path, instead of as a library object.
One annoying side effect of this 'enhancement' is that adopted
authority is no longer in effect.

Is that new outcome\restriction listed in the Memo to Users? If not, request a PTF, because that new restriction was apparently unplanned.... and it will surely affect many more.

In order to overcome this problem I made a wrapper around
CPYFRMSTMF that does the following: - Check whether current user
has sufficient authority for the member - If not, walk through
the call stack to see if adopted authority is in effect - If an
authority adopting program is found, switch to the user profile of the owner of the program - Execute the CPYFRMSTMF - If
switched, switch back to the original profile

All is fine if the current user has *USE authority for the owner
profile, but QSYGETPH (Get Profile Handle) fails with CPF22E9 if
current user has insufficent authority, even if the user with
whose authority we are running does have *USE authority for his
own profile.

It appears that QSYGETPH, although the *PGM object does have Use
Adopted Authority 'Y'es, ignores adopted authority when accessing
a user profile.

Does anyone have experience with this phenomenon? Or a different
explanation?

Do not confuse /Use Adopted Authority/ with USER(*OWNER). The former requires the calling program [with the API as callee] to adopt necessary authority to access the user profile. The latter would enable any user authorized to the API to access any user profile authorized to the owner of the API; as QSYS, that would be a huge security hole.

Regards, Chuck