Re: Authority on Java calls

[Vernon Hamberg <vhamberg@xxxxxxxxxxxxxxx>]

You could make the GID user profile pretty useless for anything except 
this purpose - PASSWORD(*NONE) INLMNU(*SIGNOFF) LMTCPB(*YES).

This is a useful thread - IFS security is a challenge, as you've been 
discovering.

Cheers
Vern

On 10/9/2013 1:57 PM, Justin Taylor wrote:
> OK, so I got it to work with one major caveat.  Since qsysetegid does not seem to respect adopted authority, every user who will need to run this must have *USE authority to the user profile used for the effective GID.
>
> The 3027 error was my fault.  I guess I didn't actually grant my test user *USE authority to the GID profile.  Once I got that fixed, I got a 3440.  That turned out to be because my test user had OWNER(*GRPPRF) in its user profile.
>
>
> I'm still not happy about having to give out *USE on the GID user profile.
>
>
>
> -----Original Message-----
> From: Justin Taylor
> Sent: Wednesday, October 09, 2013 1:10 PM
> To: 'RPG programming on the IBM i (AS/400 and iSeries)'
> Subject: RE: Authority on Java calls
>
> Well I continued to pester Google about "errno" even after making my last post.  It finally relented and revealed the answer to me.  The errno is:
> EPERM
> 3027
> The operation is not permitted.
> You must have appropriate privileges or be the owner of the object or other resource to do the requested operation.
>
> The test user has *USE authority to the group profile.
>
>
>
> And FYI, it appears that qsysetegid does not respect adopted authority.
>
>
>
> -----Original Message-----
> From: Justin Taylor [mailto:JUSTIN@xxxxxxxxxxxxx]
> Sent: Wednesday, October 09, 2013 11:28 AM
> To: rpg400-l@xxxxxxxxxxxx
> Subject: RE: Authority on Java calls
>
> The "qsysetegid" API seems like it should do the trick for me, but I haven't been able to get it to work.  I retrieve the GID OK, but the call to qsysetegid fails.  The Info Center (the v5r2 one because the 7.1 is down right now) says that errno is set to indicate the error.  How do I retrieve the errno?  I tried the following, but just get null:
>
> lpErrNo = Qp2errnop();