On 19-Nov-2015 13:07 -0600, Roger Harman wrote:
I just tried it on our production system and got very few records
returned. Likely there is some authorization checking?

Would make sense since it's analogous to DSPUSRPRF.


Somewhat different than DSPUSRPRF, yet more like WRKUSRPRF, and even more like WRKOBJ; I'd imply instead, much more analogous to DSPOBJD, but only for the object name and Text (fields ODOBNM and ODOBTX).

The VIEW named AUTHORIZATIONS in QSYS2 [file name AUTHIDS] is a derivation of the column data [columns OBJNAME and OBJTEXT] of the User Defined Table Function (UDTF) named OBJECT_STATISTICS in library QSYS2 along with [at least in v7r1] two identical literal values 'USER', having been invoked with the arguments 'QSYS' and 'USRPRF' for which the request is to obtain the Object Information Record (OIR) and other object details [e.g. size] about the objects in QSYS [aka objects in the Machine Context].

That UDF is what would be performing an authority check, possibly a test of AUT(*ANY). Whereas the RTVUSRPRF and DSPUSRPRF might required specifically, a minimum of AUT(*USE), or perhaps even more such as AUT(*USE +*OBJMGT) for the minimum; I did not check the Security Guide.

I believe your results, described as being limited, likely due to authority, probably reflects a proper outcome.

In my testing however, oddly [and I suppose quite possibly a security\integrity defect for which a PTF has not been applied] for the system on which I tried the UDTF, my user profile appears to be able to see a vastly larger number of user profile names than I am able to via either of the other interfaces WRKOBJ or WRKUSRPRF; nothing conspicuously obvious being wrong with what was displayed using DSPSRVPGM QSYS/QDBSSUDF2, the service program that implements the feature, and only SPCAUT(*SAVSYS *JOBCTL) from my group. Perhaps instead of a defect, just something I have overlooked.?

Anyhow from WRKUSRPRF I see three users that I surely have the ability to see [myself, my group, and a user that my group profile had created (but likely should not have)]. And in WRKOBJ I see an expected list of users for which I have *ANY [i.e. one or more] authority bits available to me via *PUBLIC which is the additional three user profiles: QTMPLPD, QDBSHR, and QDBSHRDO. Given the OBJECT_STATISTICS is effectively mimicking output for DSPOBJD or WRKOBJ, I would expect to see only those same six users.

While I see also, that on the system I am using, someone had /effectively corrupted/ the installation of the OS by having granted *PUBLIC with many unexpected authorizations for some other objects\object-types, I can not verify the same issue exists for any *USRPRF objects. I am still unsure why I see more than six users, except possibly by some defect.


This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2019 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].