RE: EDTOBJAUT from a CL program

[BBaase@xxxxxxxxxxxxx]

Yes. I understand.   Actually I have to do a DSPOBJD first to get the 
object names to do the DSPOBJAUT on, because of the inability  to use 
generic names (ARGGGH!)   I am planning on writing a CL very similar to 
what you are suggesting.   Thank you. 


Barbara Baase
IBMi System i  Administrator
Duro-Last Roofing, Inc.
525 Morley Drive
Saginaw, MI  48601
Phone: 989-753-6486 x2610
Fax:  989-753-4472

Confidentiality Notice:
This email, including attachments, may include confidential and/or 
proprietary information, and may be used only by the person to whom or 
entity to which it is addressed.  If the reader of this email is not the 
intended recipient or his/her authorized agent, the reader is hereby 
notified that any dissemination, distribution, or copying of this email is 
prohibited.  If you have received this email in error, please notify the 
sender by replying to this message, and then delete this email 
immediately.  Thank you.






From:   "Dennis Lovelady" <iseries@xxxxxxxxxxxx>
To:     "'Midrange Systems Technical Discussion'" 
<midrange-l@xxxxxxxxxxxx>
Date:   08/11/2011 08:49 PM
Subject:        RE: EDTOBJAUT from a CL program
Sent by:        midrange-l-bounces@xxxxxxxxxxxx



Of course I meant DSPOBJAUT rather than DSPOBJD below.

Sorry for any confusion.  Especially my own.  :)

Dennis Lovelady
http://www.linkedin.com/in/dennislovelady
--
"When a man says he approves of something in principle, it means he hasn't
the slightest intention of putting it into practice."
        -- Prince Otto von Bismark 



> I did check, and the program I wrote for that function is the property 
of
> the client for whom I wrote it.  I did not retain the source.
>
> In essence, it retrieved existing authorities, object by object, for the
> libraries in question.  I think DSPOBJD OUTPUT(*OUTFILE) OUTMBR(mymbr
*ADD).
> DSPOBJAUT does not take generic names (ARGGGH!)....
>
> Then process each row of the output file with RVKOBJAUT.  Tedious but
> effective.
>
> Dennis Lovelady
> http://www.linkedin.com/in/dennislovelady
> --
> Tom Seaver: "What time is it?"
> Yogi Berra: "You mean now?"
>
>
> > I want to revoke all authorities.  In most cases, the user profile I
want
> > to remove is the original creator of the object, who is now in a group
> > that has *USE authority, so I want the individual totally removed.  I
> > don't want to see it there, even if the level is correct.  I guess 
what
I
> > am saying is that revoking the authority is not the real issue; it is
> > getting the profile to not be listed there that is the real issue.
> >
> > OK.  I just got it to work, but I see what you mean about not being 
able
> > to revoke what is not there.
> >
> > In order to get rid of a user profile that had *all authority, I had 
to
> > run two commands:
> >
> > RVKOBJAUT OBJ(JRBLIB/ARCM11FX) OBJTYPE(*PGM) USER(MNUMBERS) AUT(*DLT
*REA
> > D *UPD *EXECUTE)
> >
> >  RVKOBJAUT OBJ(JRBLIB/ARCM11FX) OBJTYPE(*PGM) USER(MNUMBERS) AUT(*ADD
*OBJ
> > OPR *OBJALTER *OBJEXIST *OBJMGT *OBJOPR *OBJREF)
> >
> > So now I just have to figure out what to do when a user has *change or
> > *use or even Userdef  It just seems like there should be an easier 
way.
> > From:   Dennis <iseries@xxxxxxxxxxxx>
> > To:     Midrange Systems Technical Discussion 
<midrange-l@xxxxxxxxxxxx>
> > Date:   08/11/2011 03:30 PM
> > Subject:        Re: EDTOBJAUT from a CL program
> > Sent by:        midrange-l-bounces@xxxxxxxxxxxx
> >
> >
> >
> > What authorities are you revoking?
> >
> > If it is changing to User Defined, take a look to see what authorities
are
> > NOT being revoked (don't forget about F11 on the DSP/EDTOBJAUT 
screens.
> > One cannot revoke authorities that have not been granted
(unfortunately),
> > so *ALL may not work for you.
> >
> > The way I have done this in the past, is to write a program to 
retrieve
> > the authorities that have been granted, and then revoke them
individually.
> >  I *may* have a program lying around that does that type of thing.
> > ++
> > Dennis
> > ++
> >  "For a moment, nothing happened.  Then, after a second or so, nothing
> > continued to happen."
> >      -- The Hitchhiker's Guide to the Galaxy
> >
> >
> >
> >
> > Sent from my Galaxy tablet phone.  Please excuse my brevity.
> > For any grammatic/spelling errors, there is no excuse.
> > ++
> >
> >
> > BBaase@xxxxxxxxxxxxx wrote:
> >
> > > Dennis:  I have tried RVKOBJAUT and it changes the authority to
> > > USERDEF
> > > and leaves the profile there.
> > >
> > >
> > >
> > >
> > > From:   Dennis <iseries@xxxxxxxxxxxx>
> > > To:     Midrange Systems Technical Discussion 
<midrange-l@xxxxxxxxxxxx>
> > > Date:   08/11/2011 03:03 PM
> > > Subject:        Re: EDTOBJAUT from a CL program
> > > Sent by:        midrange-l-bounces@xxxxxxxxxxxx
> > >
> > >
> > >
> > > Are you thinking of RVKOBJAUT?
> > > ++
> > > Dennis
> > > ++
> > > "When a person with experience meets a person with money, the person
> > > with
> > > experience will get the money.  And the person with the money will 
get
> > > some experience."
> > >     -- Leonard Lauder
> > >
> > >
> > > Sent from my Galaxy tablet phone.  Please excuse my brevity.
> > > For any grammatic/spelling errors, there is no excuse.
> > > ++
> > >
> > >
> > > BBaase@xxxxxxxxxxxxx wrote:
> > >
> > > > I am trying to clean up the authorities on some objects on our 
system.
> > > > We
> > > > recently decided to give programmers *USE authority to production
> > > > objects
> > > > after years of letting them have *ALLOBJ.  I am trying to write a CL
> > > > (or
> > > > even from a command line) do what I can easily do from the EDTOBJAUT
> > > > screen and that is completely remove a user profile from the list of
> > > > user
> > > > profiles that have authority.  It looks like this:
> > > >                          Object
> > > > User        Group       Authority
> > > > *PUBLIC                 *USE
> > > > AMAPICS                 *ALL
> > > > BBAASE                  *ALL
> > > > GRPISPGMR               *USE
> > > >
> > > > With edtobjaut, I can field exit through BBAASE and *ALL and that 
line
> > > > is
> > > > gone.  Great!
> > > > How do I do that with a command?   I have tried RVKOBJAUT and it
> > > > changes
> > > > the authority to  USERDEF and leaves the profile there.
> > > > Well I don't want it there.  Any help would be much appreciated.
> > > > Thanks,
> > > >
> > > >
> > > > Barbara Baase
> > > > IBMi System i  Administrator
> > > > Duro-Last Roofing, Inc.
> > > > 525 Morley Drive
> > > > Saginaw, MI  48601
> > > > Phone: 989-753-6486 x2610
> > > > Fax:  989-753-4472
> > > >
> > > > Confidentiality Notice:
> > > > This email, including attachments, may include confidential and/or
> > > > proprietary information, and may be used only by the person to whom 
or
> > > > entity to which it is addressed.  If the reader of this email is not
> > > > the
> > > > intended recipient or his/her authorized agent, the reader is hereby
> > > > notified that any dissemination, distribution, or copying of this
> > > email
> > > > is
> > > > prohibited.  If you have received this email in error, please notify
> > > > the
> > > > sender by replying to this message, and then delete this email
> > > > immediately.  Thank you.
> > > >
> > > >
> > > > --
> > > > This is the Midrange Systems Technical Discussion (MIDRANGE-L) 
mailing
> > > > list
> > > > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > > > To subscribe, unsubscribe, or change list options,
> > > > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > > > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > > > Before posting, please take a moment to review the archives
> > > > at http://archive.midrange.com/midrange-l.
> > >
> > > --
> > > This is the Midrange Systems Technical Discussion (MIDRANGE-L) 
mailing
> > > list
> > > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > > To subscribe, unsubscribe, or change list options,
> > > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > > Before posting, please take a moment to review the archives
> > > at http://archive.midrange.com/midrange-l.
> > >
> > >
> > > --
> > > This is the Midrange Systems Technical Discussion (MIDRANGE-L) 
mailing
> > > list
> > > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > > To subscribe, unsubscribe, or change list options,
> > > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > > Before posting, please take a moment to review the archives
> > > at http://archive.midrange.com/midrange-l.
> >
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
> >
> >
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.