Re: Record level security

Forget trying to secure the tools.  Stick with securing the data.  They're
just too danged many tools out there.
I am sure that it uses the profile that signs even though it's odbc.  Many
of the server joblogs that I look at now say something like "servicing user
profile xxxx"
Test.  Create yourself a limited user profile and try the access that
others suggested.  However by fixing your physical file and using the
logical files may make your 5250 programs go casters up unless you start
farting around with adopting authority.

Rob Berendt

==================
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
Benjamin Franklin



                    "Jim Franz"
                    <jfranz@triad.rr.       To:     <rpg400-l@midrange.com>
                    com>                    cc:
                    Sent by:                Fax to:
                    rpg400-l-admin@mi       Subject:     Re: Record level 
security
                    drange.com


                    10/30/2001 03:47
                    PM
                    Please respond to
                    rpg400-l






the logical view security may not cover your statement that
"their own IT staff that writes query tools to view the data".
I would suggest either you have some security control of the
query tools (i think ShowCase & others have security controls
based on data). You would need some exit programs to block
other access methods & verify access is thru the secured tool.
This could get fairly complicated. If your tools use sql to get data,
you could use UDF (user defined function)-never done it, but
supposed to cover this kind of security.
Your DDM/ODBC access - will you see the requesting server,
and use that in a exit program to determine auth?
If you controlled the app pgm using ddm, you could enforce this
at app level.
Would have to know lot's more about how many files, how many apps.
jim franz

----- Original Message -----
From: "Peter Dow" <pcdow@yahoo.com>
To: <rpg400-l@midrange.com>
Sent: Tuesday, October 30, 2001 6:21 PM
Subject: Re: Record level security


> Hi Aaron,
>
> My solution is more of a Midrange-L topic -- create 40 logical files (one
> for each company) with select criteria to limit the records to each
company,
> then restrict access to the physical and the logicals.
>
> hth,
> Peter Dow
> Dow Software Services, Inc.
> 909 425-0194 voice
> 909 425-0196 fax
>
> From: "Bartell, Aaron L. (TC)" <ALBartell@taylorcorp.com>
> To: <rpg400-l@midrange.com>; <ign_list@ignite400.org>
> Sent: Tuesday, October 30, 2001 2:21 PM
> Subject: Record level security
>
>
> > Hi All,
> >
> > My company has a corporate AS/400 that stores orders that we pass back
and
> > forth between about 40 different companies.  The orders have sensitive
> info
> > like credit card numbers and such that shouldn't be viewed by all of
the
> 40
> > companies.  In this scenario each of the 40 companies has their own IT
> staff
> > that writes query tools to view the data on the corporate machine.  Is
> there
> > a way for me to restrict access so they can only see orders they are
> allowed
> > to see at a system level? (i.e. They can only see orders where they are
> the
> > sender or receiver)
>
>
>
> _________________________________________________________
> Do You Yahoo!?
> Get your free @yahoo.com address at http://mail.yahoo.com
>
> _______________________________________________
> This is the RPG programming on the AS400 / iSeries (RPG400-L) mailing
list
> To post a message email: RPG400-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/rpg400-l
> or email: RPG400-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/rpg400-l.
>

_______________________________________________
This is the RPG programming on the AS400 / iSeries (RPG400-L) mailing list
To post a message email: RPG400-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/rpg400-l
or email: RPG400-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/rpg400-l.