Re: Authority on Java calls

Can you assign the group profile as a "supplemental group" of the user profile? Or is that giving the user too much access?

If you want to use adopted authority, you'll probably have to do a profile swap. The 'profile handle' APIs will respect adopted authority, allowing you to swap to a profile that you might not have had authority to without adopting.

But, if you do profile swapping, you need to be very careful that your application can not exit without swapping back (else the user can keep the elevated authority) and also that someone cannot simply open your program in STRDBG and change variables so that they can keep the elevated authority... etc, etc.

-SK

On 10/9/2013 1:57 PM, Justin Taylor wrote:

OK, so I got it to work with one major caveat. Since qsysetegid does not seem to respect adopted authority, every user who will need to run this must have *USE authority to the user profile used for the effective GID.

The 3027 error was my fault. I guess I didn't actually grant my test user *USE authority to the GID profile. Once I got that fixed, I got a 3440. That turned out to be because my test user had OWNER(*GRPPRF) in its user profile.

I'm still not happy about having to give out *USE on the GID user profile.