Re: object Authority ... frustration -- MIDRANGE-L

Further testing....
/facepalm
here is how I tested....
(old bpcs system)
I revoked *public, and put their group profile as *USE...
I asked them to go into their Payment terms master, and make a change...

they said "they couldn't ... cannot update!!!"

I now find out....
1) whole message on ACR110 said "cannot update. Entry not found".
2) would you have guessed that the app doesn't understand the difference
between the payment term "S " and " S" (Sblank vs blankS)????

On Thu, May 21, 2020 at 11:48 AM Rob Berendt <rob@xxxxxxxxx> wrote:

I am suspecting that your owner and your group profile are the same. This
is a shot to the foot.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Gerald Magnuson
Sent: Thursday, May 21, 2020 11:38 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: object Authority ... frustration

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know
the content is safe.

that is how we have all our programs.
USRPRF(*OWNER).
and what you state is how I thought it was supposed to be.

we have all objects owned by the same user as owns database object
we have USRPRF(*OWNER)

I took away *PUBLIC (made *PUBLIC *EXCLUDE)
--- they then couldn't download table into excel.
I then added their group profile to object (FINANCGRP *USE)
---they then got green screen application errors, couldn't open file for
*UPDATE
I then changed authority to FINANCGRP *CHANGE
--- it now all works, but that is more authority than I want to grant.

On Thu, May 21, 2020 at 10:17 AM David Gibbs via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

On 5/21/20 9:42 AM, Gerald Magnuson wrote:

so my users that need file transfer and excel to bring down data,
they need to be as *all or *change authority? because if I just give
them *use, then their green screen apps won't work (they can't update
data anymore)....

having their group profile in authority list trumps adoptive authority?
how is this supposed to work?

I realize this may be a big change, but what about setting the program to
use
owner authority and changing the program owner to a profile that can
update the
file?

That way you can remove the users authority to update the file. They will
be
able to read it, but not update. When the program runs, the authority
used will
be that of the *PGM object's owner.

So, create a application owner profile that has authority to update the
file.

Change the owner of the program to the new profile.

Change the program to use *OWNER as the USRPRF attribute: 'CHGPGM
PGM(ABC/XYZ)
USRPRF(*OWNER)'

You may need to control access to the program itself if you don't control
access
at the application level.

david

--
IBM i on Power Systems: For when you can't afford to be out of business!

I'm riding in the American Diabetes Association's Tour de Cure to raise
money
for diabetes research, education, advocacy, and awareness. You can make

a

tax-deductible donation to my ride by visiting
https://mideml.diabetessucks.net.

You can see where my donations come from by visiting my interactive
donation map
... https://mideml.diabetessucks.net/map (it's a geeky thing).

I may have diabetes, but diabetes doesn't have me!
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com