Re: Use of adopted profiles

All. Thank you.

I know its a sticky subject and this has been a good reminder of the
pitfalls.

I have used authorization lists in the past too, but it was subsequently
recommended not to use them. I don't recall the reason but I am happy to
test that option again.

Once again, Thanks

Darryl.


On Sun, Oct 7, 2018 at 1:58 PM a4g atl <a4ginatl2@xxxxxxxxx> wrote:

Jim

The objects are not necessarily owned by the correct owner. I also plan to
use 2 group profiles, 1 to own the objects. The second would be a basic
group profile to link all users to but with very limited access, enough to
allow the users to sign on and access their menus. In this way we would
only need to manage 2 profiles, hopefully.

Additional group profiles may be used for remote access such as Excel
up-loaders, and other users retrieving data off the system.

Darryl

On Fri, Oct 5, 2018 at 10:49 AM Jim Oberholtzer <
midrangel@xxxxxxxxxxxxxxxxx> wrote:

Darryl:

From my perspective this is the correct approach.

What I don't understand is why you grant authority to a group profile? If
that's the same profile that owns the objects, then it does not need
explicit authority. With adopted authority you won't need additional
group
profiles. In fact the owner does not need to be a group profile at all,
just an owner.

I have several customers that have implemented exactly what you are
proposing. The only catch came with submitted jobs, when adopted
authority
was needed for those jobs to run. We had a bit of tinkering to do in
order
to get past that.

The security guide on the information center is OK, and I've not seen a
Redbook updates since V6R1. There is a Redbook on Row/Column security but
that does not really apply to your use case.


--
Jim Oberholtzer
Agile Technology Architects


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
a4g
atl
Sent: Friday, October 05, 2018 9:08 AM
To: midrange-l@xxxxxxxxxxxx
Subject: Use of adopted profiles

Is there a document that describes how the adopted authority works and
maybe
best practices? I am reviewing a project to lock the system down and it
has
been a long time since I last set up a highly secure system.

My plan is to
- revoke all authorities from user libraries, objects and the IFS.
- Grant authority to a group profile.
- The group profile will own all objects.
- Users will have none or limited authority directly.
- When users signon to the menu, the menu program will grant authority
whilst using the job. When they sign off, they will have no authority.

Objective:
- Prevent unauthorized access to the system
- There are users on multiple systems accessing this system and its wide
open. - Plan to grant authority to objects only where required example
read
rights to file where a remote system needs to access files to retrieve
data
and so on.

The same will apply to the IFS.

What are the best practices today? I know some folk don't like this
approach
but it is one of the cleanest and easiest approaches to implement and
maintain.

TIA

Darryl Freinkel
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe,
or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link:
http://amzn.to/2dEadiD

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD