Re: sbmjob user(xxxxx)

Jay,

Only the submit program would be adopted, then only with sufficient authority to submit the job you want run, with the user you want to run it. The CLP run by user A can submit the job to run the job so it runs under user B profile. No changes to current jobs/programs at all.

In this way user A submits your SFTP job so user SFTPUSER is running it, preserving SFTPUSER as the one with the authority checks in the FTP job.

Jim Oberholtzer
Agile Technology Architects

On Dec 27, 2019, at 7:49 AM, Jay Vaughn <jeffersonvaughn@xxxxxxxxx> wrote:

jim thank you...

we don't want to necessarily just adopt the authority of another user, we
literally need it to run under the "other" user profile...

the reason for this is we have a pgmA that is a clp that runs an sftp
process.

When pgmA is invoked and ran, we don't know if this particular sftp will be
password or ssh key auth.

But we do know if it will be sshkey or password when we code the sbmjob in
our application.
And if it is ssh key then we want to sbmjob user(sftpuser). (sftpuser is
the sole userprofile for holding all the ssh keys.)

jay

On Fri, Dec 27, 2019 at 8:43 AM Jim Oberholtzer <midrangel@xxxxxxxxxxxxxxxxx>
wrote:

Jay:

I’m not certain what the use case is here, but I’ll bet you don’t really
want to give everyone that authority, or at least based on your note a
limited number.

The best way to accomplish this in my view is with an adopted authority
CLP wrapper.
Take in parms that you need for the job, and craft a SMBJOB command as
needed. Create your own command if it makes sense to do so.

That way you can accomplish your goal and maintain some level of control.
I’ve even seen those programs encode a journal entry to a user journal in
order to memorialize the job for later audit.

Jim Oberholtzer
Agile Technology Architects

On Dec 27, 2019, at 7:25 AM, Jay Vaughn <jeffersonvaughn@xxxxxxxxx>

wrote:

so we have a need to submit a job under another specific user profile.

what is the best/cleanest method for implementing this?

obviously we can just specify the new user on the sbmjob user() parm, but
what about each individual user profile that may do the sbmjob, what is

the

best/cleanest way to maintain those user authorized to the sbmjob user()
user profile?

tia

jay
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related

questions.

Help support midrange.com by shopping at amazon.com with our affiliate

link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com