Re: SBMJOB adopted authority...

who is the "issuer"? is it QPGMR (the owner)? or is it the actual user?



On Fri, May 20, 2016 at 8:47 AM, Rob Berendt <rob@xxxxxxxxx> wrote:

Cause . . . . . : The issuer of the ... Submit Job (SBMJOB), ... command
must be authorized to both the job description and its
library.
Recovery . . . : Have the security officer or the object owner grant
the
user *USE authority to the job description and *EXECUTE authority to the
job
description library.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Gerald Magnuson <gmagqcy.midrange@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 05/20/2016 09:44 AM
Subject: Re: SBMJOB adopted authority...
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



sorry.... CPF1141...


On Fri, May 20, 2016 at 8:36 AM, Rob Berendt <rob@xxxxxxxxx> wrote:

DSPMSGD CPF1411
Message identifier CPF1411 not found in message file QCPFMSG in QSYS.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Gerald Magnuson <gmagqcy.midrange@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 05/20/2016 09:31 AM
Subject: Re: SBMJOB adopted authority...
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>

CHGPGM MYPGM USRPRF(*OWNER)

Yep...

CHGOBJOWN OBJ(MYPGM) OBJTYPE(*PGM NEWOWN(QPGMR)

Yep...

GRTOBJAUT OBJ(SECJOBD) OBJTYPE(*JOBD) USER(GOD) AUT(*USE)

.we have USER(QPGMR) as *ALL

yet we get the CPF1411.




On Fri, May 20, 2016 at 8:23 AM, Rob Berendt <rob@xxxxxxxxx> wrote:

The program doing the SBMJOB needs to have authority to the *jobd

object.

CHGPGM MYPGM USRPRF(*OWNER)
CHGOBJOWN OBJ(MYPGM) OBJTYPE(*PGM) NEWOWN(GOD)
GRTOBJAUT OBJ(SECJOBD) OBJTYPE(*JOBD) USER(GOD) AUT(*USE)



Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Gerald Magnuson <gmagqcy.midrange@xxxxxxxxx>
To: Midrange Systems Technical Discussion

<midrange-l@xxxxxxxxxxxx>

Date: 05/20/2016 09:18 AM
Subject: Re: SBMJOB adopted authority...
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



my trouble is when I do make the *JOBD's *PUBLIC *EXCLUDE, our
SBMJOB's fail with the CPF1411 "not authorized to JOBD"...

is it because we have the sbmjob doing: USER(*CURRENT) not
USER(*JOBD) ? (because the jobd's have USR(*RQD) on them...)

I guess my question is...

how should I properly submit jobs when using adoptive authority?





On Fri, May 20, 2016 at 7:45 AM, Rob Berendt <rob@xxxxxxxxx> wrote:

So, it's perfectly acceptable that any user can do
SBMJOB CMD(CLRLIB LIB(PRODLIB)) JOBD(SECJOBD) USER(*JOBD)
SBMJOB CMD(CHGUSRPRF QSECOFR PASSWORD(HITHERE)) JOBD(SECJOBD)

USER(*JOBD)

My auditors tend to believe differently.
If someone "just has to" submit such a job it's done from a program

with

adopted authority.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Denis Robitaille <denis_robitaille@xxxxxxxxxxxx>
To: Midrange Systems Technical Discussion

<midrange-l@xxxxxxxxxxxx>

Date: 05/20/2016 08:34 AM
Subject: RE: SBMJOB adopted authority...
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Hello,

I dont know who told you that *public *use was bad for JOBD but, in

my

mind, that is perfectly acceptable.


Denis Robitaille
Chef de service TI - Solution Entreprise
Infrastructure et Opérations
Cascades Centre des technologies,
412 Marie Victorin
Kingsey falls(Québec) Canada J0A 1B0
T : 819 363 6130




-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf

Of

Gerald Magnuson
Sent: 19 mai 2016 17:27
To: midrange-l@xxxxxxxxxxxx
Subject: SBMJOB adopted authority...

ok, we do run adoptive authority, but we do have our *jobd's as

*public

*use....

I am told that is bad.

I read stuff about adoptive authority and a submitted job, and a new

call

stack....
but that doesn't address the CPF1411 error I am getting on the

SBMJOB

command "not authorized to job description" when I change the *JOBDs

to

*PUBLIC *EXCLUDE


I also read stuff about creating a different SBMJOB command, or

adding

routing entries to our batch subsystems...

Is my only recourse, to create a *AUTL, to put on my *JOBD's, to

only

allow those users I want to use those *JOBDs?
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please

take

a

moment to review the archives at

http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.