Re: object Authority ... frustration

that is how we have all our programs.
USRPRF(*OWNER).
and what you state is how I thought it was supposed to be.

we have all objects owned by the same user as owns database object
we have USRPRF(*OWNER)

I took away *PUBLIC (made *PUBLIC *EXCLUDE)
--- they then couldn't download table into excel.
I then added their group profile to object (FINANCGRP *USE)
---they then got green screen application errors, couldn't open file for
*UPDATE
I then changed authority to FINANCGRP *CHANGE
--- it now all works, but that is more authority than I want to grant.





On Thu, May 21, 2020 at 10:17 AM David Gibbs via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

On 5/21/20 9:42 AM, Gerald Magnuson wrote:

so my users that need file transfer and excel to bring down data,
they need to be as *all or *change authority? because if I just give
them *use, then their green screen apps won't work (they can't update
data anymore)....

having their group profile in authority list trumps adoptive authority?
how is this supposed to work?

I realize this may be a big change, but what about setting the program to
use
owner authority and changing the program owner to a profile that can
update the
file?

That way you can remove the users authority to update the file. They will
be
able to read it, but not update. When the program runs, the authority
used will
be that of the *PGM object's owner.

So, create a application owner profile that has authority to update the
file.

Change the owner of the program to the new profile.

Change the program to use *OWNER as the USRPRF attribute: 'CHGPGM
PGM(ABC/XYZ)
USRPRF(*OWNER)'

You may need to control access to the program itself if you don't control
access
at the application level.

david

--
IBM i on Power Systems: For when you can't afford to be out of business!

I'm riding in the American Diabetes Association's Tour de Cure to raise
money
for diabetes research, education, advocacy, and awareness. You can make a
tax-deductible donation to my ride by visiting
https://mideml.diabetessucks.net.

You can see where my donations come from by visiting my interactive
donation map
... https://mideml.diabetessucks.net/map (it's a geeky thing).

I may have diabetes, but diabetes doesn't have me!
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com