Re: Spool files under original User even after QWTSETP was issues to Swap a User Profile.

Not according to the docs:
Set Profile Handle (QWTSETP, QsySetToProfileHandle) API

"A QPRTJOB job is the name of a job that files are spooled under when
the current job's user name is not the same as the user profile
currently running. For example, if you use Set Profile Handle to set
the profile to user JOE and create a spooled file, the file is spooled
under job nnnnnn/JOE/QPRTJOB. This ensures that user JOE owns the
spooled file and if that user uses the WRKSPLF command, the file is
displayed."

Jorge, what version are you running?

Charles

On Mon, Jul 11, 2011 at 7:19 PM, Vern Hamberg<vhamberg@xxxxxxxxxxx> wrote:

Jorge

Spooled files WILL have the original job user as their user - to change
that, you need to do an OVRPRTF SPLFOWN(swapuser) - something like that
- before running the program that creates the spooled file.

HTH
Vern

On 7/11/2011 5:28 PM, Jorge Merino wrote:

Hi!

I just created a program to do "impersonation" and execute a give command, that is a small program that basically will swap the user id and execute a given command.

The program uses the following APIs in the following order:
ori_user_ph = QSYGETPH(*current)
New_user_PH = QSYGETPH(New_user)
QWTSETP(New_user_PH)
QWTSJUID( set )
--Command Execution--
QWTSETP( ori_user_ph )
QWTSJUID( clear )
QSYRLSPH( new_user_ph )
QSYRLSPH( ori_user_ph )

The program gets compiled with a regular PGMR non-*ALLOBJ user. Let's say that my program is called IMPERSONAT.

After compilation, I have a *SECADM level user to change the program as:
CHGPGM PGM(MYLIB/IMPERSONAT) USRPRF(*OWNER) USEADPAUT(*NO)
CHGOBJOWN OBJ(MYLIB/IMPERSONAT) OBJTYPE(*PGM) NEWOWN(SECADM)

I execute the program in a regular interactive Job and it works great. It creates some spool files under the new user, so far so good. These are some job attributes:
Subsystem . . . . . . . . . . . . . . . . . : QINTER
Subsystem pool ID . . . . . . . . . . . . : 2
Type of job . . . . . . . . . . . . . . . . : INTER
Special environment . . . . . . . . . . . . : *NONE

However, this program must be called from a existing server job running under QPGMR, so I call the new program exactly as I called the program interactively, and here is the problem: the spool files are still shown under QPGMR rather than the new user.
Subsystem . . . . . . . . . . . . . . . . . : RNSFIN2
Subsystem pool ID . . . . . . . . . . . . : 1
Type of job . . . . . . . . . . . . . . . . : BATCH
Special environment . . . . . . . . . . . . : *NONE

I'm receiving the Error DS from QWTSETP (and any API involved) in order to know if there is errors, I even logging every error returned from any API into the job log but no errors are returned; I'm even doing SBMJOB CMD(CALL IMPERSONAT) from the server job rather than a regular CALL , notice that I'm not using the USER() parameter on SBMJOB but the program gets executed under the new User even using its Job Description.

The first version of my program was using the Service Program APIs equivalent, but I changed them to use API OPMs just in case. I also added QWTSJUID to change the Job User Identity for the Job, just after QWTSETP (for both to set and to clear).

How can I force the server job to generate the new spool files under the user just after QWTSETP happened?

Any Ideas, suggestions?
Thanks.

Jorge Merino
~jmerinoh~
http://nuvek.com/
http://vektr.com/

--
This is the RPG programming on the IBM i / System i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/rpg400-l.