Re: User can't see all profiles

[Alan Campin <alan0307d@xxxxxxxxx>]

Does the user have *USE authority to the User Profile?


On Tue, Jun 25, 2013 at 2:31 PM, Bakutis, Becky <
BBakutis@xxxxxxxxxxxxxxxxxxxx> wrote:

> I have a user owned by GRP_SD with the following profile parameters:
>
> User class . . . . . . . . . . . . . . . . :   *USER
>
> Group profile  . . . . . . . . . . . . . . :   GRP_ROA
> Owner  . . . . . . . . . . . . . . . . . . :   *GRPPRF
>
> The user can see MOST user profiles owned by GRP_ROA but not all with the
> wrkusrprf command.  The user can see one user profile owned by GRP_SD with
> the user class set to *USER and group profile set to *NONE and no other
> GRP_SD owned profiles.
>
> The user claims that she could see all profiles owned by GRP_SD before we
> upgraded to V7R1.  I created a copy of this profile for testing purposes so
> there are no authorization lists or anything special involved.  Has V7R1
> closed some type of loophole?  Why would one profile owned by GRP_SD be
> visible while the others are not?  When I added GRP_SD as a supplemental
> group in the profile all GRP_SD owned profiles were visible.  Again this
> made sense so I'm not sure how it worked before.
>
> I haven't had to do this much security research in quite some time and I
> may have missed something that changed in V7R1.  Hopefully someone can
> point me in the right direction.  I considered opening an IBM ticket, but
> I'm just not sure it is their problem.
>
> Becky Bakutis
> Systems Engineer
> Republic Services
>
> 480.627.2760 (w)
> bbakutis@xxxxxxxxxxxxxxxxxxxx
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.