RE: Record level security

>Afaik you're right about the DDM files. With ODBC, I the
>server job swaps to the user profile it's currently
>servicing, but it still uses QUSER when
>obtaining the object lock.  Maybe a couple of exit programs?

An alternative is to create matching DDM files at the remote sites, pointing
to the proper logical:

RMTBOX1       CORPBOX
  DDMCO01 -> LGL01

Secure the DDM files with the same authorisation list/group that the
logicals get.

Another alternative is to disallow all access to the base file, write a
custom "server" program that uses it's own authorisation scheme (i.e. pass a
user ID that's in a validation list along with a request to get a record.)
Then make everybody who wants access use that program.  If you make it
socket capable you can avoid the DDM files.  This will of course only work
if you own all of the programs in the application...
  --buck