Re: Mass authority change?

Justin:

NOTE: if any of these PFs or LFs are "in use" your efforts to change the private authorities will fail. So, not something you can easily do "during the day" or while "production" jobs are running. Perhaps later at night? You might need to hold some job queues, and allow any currently running jobs to "quiesce"...

Also, while you are doing this, you could create an "authorization list" (CRTAUTL ...) where the name of the *AUTL is the same as the library containing those objects. Then, when you do that operation to change the authority on those objects, you can attach the *AUTL to each object,

Specify the *AUTL for the entire library, e.g. CHGLIB LIB(XYZ) CRTAUT(XYZ) -- that way, any new objects created in this library will have that *AUTL attached automatically by default.

Then, your objects should have only the object owner (with *ALL authority) and *PUBLIC *USE or *EXCLUDE (depending on your security requirements), and all other private authorities (using "role based" group profiles as much as possible) assigned via the authorization list.

The *AUTL adds "one more level of indirection" and so then you will be able to make future authority changes to the *AUTL, during the day, while these applications are "active."

Having only the OWNER, *PUBLIC and an *AUTL defined for "private authority" on objects allows the Operating System to use a "fast path" for determining whether a user is "authorized" to a particular object.

Hope that helps,

Mark S.Waterbury

> On 5/16/2017 1:19 PM, Justin Taylor wrote:

I have an existing library with a large number of PF's & LF's. I have a service account that I want to set *EXCLUDE for every one of those PF's & LF's (then I will grant authority to the few that are actually needed). Is there a good way to do this?

Thanks