Re: snddst

[Stephen Landess <steve_landess@xxxxxxxxxxx>]

Duane:

At my previous client, we created what we call a "Service Account":
An IBM i user profile which was set up with specific authorities and IFS permissions for tasks like this.

The Service Account user profile is *ENABLED but has no password and the users are have *USE authority to it.
In our case there is no security exposure since none of the users has command line authority on the system.

The Service Account was used for doing file transfers from the IFS to Windows file servers when using QNTC by using profile swapping.

For example, since IFS permissions work like Unix rather than IBM i authorities, the Service Account user had permissions for certain IFS folders, and the corresponding Windows Service Account (having the same user name and password) had the necessary permissions to certain target file shares and folders, such that when a program uses CPYTOIMPF to copy files from the IFS to the windows server or CPYFRMIMPF to copy data from the Windows server back to a IFS folder that it wouldn't fail because of permission failures.

The file transfer program does the following:

  1.  Calls the QSYGETPH API to get profile handles for the current profile and the Service Account.
  2.  Calls the QWTSETP API API to swap profile to the Service Account
  3.  Runs the necessary commands to copy data from/to the IFS
  4.  Calls the QWTSETP to swap profile back to the original user
  5.  Calls QSYRLSPH to release the profile handles obtained in (1)

Step 5 is very important - you must release the profile handles:

https://www.ibm.com/docs/en/i/7.4?topic=ssw_ibm_i_74/apis/QSYGETPH.htm

[...]
"Profile handles are a limited resource; it is possible to run out of handles. To guarantee that you always have a profile handle to switch back to, it is recommended that you get a profile handle for both the current thread and the user profile to which you plan to switch. If for some reason you cannot do this, and if you cannot get a profile handle that will allow you to switch back, then it probably is safest to end the thread or job."
[...]

Similarly, you could set up an IBM i profile which has a verifiable associated email address to use when using SNDDST or SNDSMTPEMM and change your program(s) and incorporate this strategy to allow for all users that are sending emails from the IBM i to use the shared service account for sending emails.

Regards,
Steve Landess
(512) 289-0387

________________________________
Duane wrote:

> Been using this CL for years,
> 0018.00              PGM
> 0019.00
> 0036.00
> 0037.00              SNDDST     TYPE(*LMSG) TOUSRID((PLUIJ S1017045) +
> 0038.00                           (BENKA300 S1017045) +
> 0038.01                           (NELSK S1017045) +
> 0038.02                           (DANND S1017045) +
> 0038.03                           (CHRIS S1017045)) DSTD('job on hold') +
> 0038.04                           LONGMSG('Accounting is done in Canada!!')

> Now it doesn't work.
> We switched our SMTP from a on premise Exchange server to a O365 smtp relay
> that requires authentication (a "from" email address)

> When trying to send emails from i-series, we need to change the "from SMTP email address" so they are all the same for different profiles, in WRKDIRE
> We can change 1 with the correct credentials and it works, but the address can only be used on 1 user, and we have different profiles that need to use this
> This works only if I run it  which is DANND
>
>                              Change Name for SMTP
>                                                              System:   FAIRMONT
>  User ID/Address . . . . . :   DANND    S1017045
>
>  Type choices, press Enter.

>    SMTP user ID  . . . . . .   donotreply
>    SMTP domain . . . . . . .   AWTX-ITW.COM

> If I change my smtp use rid ...... back to ddanner and then give

>                              Change Name for SMTP
>                                                              System:   FAIRMONT
> User ID/Address . . . . . :   NELSK    S1017045
>
> Type choices, press Enter.
>
>   SMTP user ID  . . . . . .   donotreply
>  SMTP domain . . . . . . .   AWTX-ITW.COM

> This doesn't work when she runs it.
> Lost

Then John Yeung wrote:
> I don't know how to set up email, so someone can tell me if this isn't
> going to work for your situation, but...

> For a long time now (since 6.1), the IBM-included way to send email is
> the SNDSMTPEMM command. Very simple to use and you can't beat the
> price. You should give that a try.

> We have Office 365 as well, and that command works on our system for
> internal emails. We can't send external emails that way, but I don't
> know if it's because our administrator chose to block that capability,
> or there's a technical reason why it won't work.

> So maybe that would suffice for your needs. If not, and you can spend
> a relatively small amount on a subscription basis, then Brad Stone's
> MAILTOOL is definitely worth a look.

> (For the record, our shop actually doesn't use SNDSMTPEMM or MAILTOOL,
> but I've tried them both.)