×
The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.
On 12/05/2009, at 6:38 AM, Joep Beckeringh wrote:
At this point I would expect QSYGETPH to succeed, because user
PANTHEON
has *USE authority for *USRPRF object PANTHEON. However, QSYGETPH
fails
when *USRPRF PANTHEON has *PUBLIC authority *EXCLUDE. When *USRPRF
PANTHEON has *PUBLIC authority *USE, QSYGETPH succeeds.
Working as designed and documented. The caller of the QSYGETPH API
must have sufficient authority to the target user profile. If neither
the program user nor the program owner (presuming the poorly named
USRPRF(*OWNER) is in effect) have sufficient authority then the call
to QSYGETPH will fail.
Note that *USE to the *USRPRF is only required when you supply a
special value for the password.
You need to ensure that either the caller supplies the correct
password for the target user profile (in which case authority to the
target profile is not required) OR you need to grant the owner of the
program calling QSYGETPH *USE authority to any profile that may be a
target profile OR you need to adopt a sufficiently high level of
authority so you can access any desired profile. All of these options
come with various levels of security risk.
When I used this API in a product it was so a host server could change
to run under the profile of the requesting user. In this case the user
needed to authenticate by supplying both UID and PWD. Because the
object calling QSYGETPH adopted authority for other reasons I added
code to ensure that the special password values were not allowed. End
result is that swap to any profile was allowed but only if the user
knew the correct password. The code was no less a risk to "cracking"
passwords than attempting the same on a sign-on screen.
Regards,
Simon Coulter.
--------------------------------------------------------------------
FlyByNight Software OS/400, i5/OS Technical Specialists
http://www.flybynight.com.au/
Phone: +61 2 6657 8251 Mobile: +61 0411 091 400 /"\
Fax: +61 2 6657 8251 \ /
X
ASCII Ribbon campaign against HTML E-Mail / \
--------------------------------------------------------------------
midrange.com
