RE: [Security400] Authority annoyances, continued...

[Anton Gombkötö <gombkoetoe@xxxxxxxxxx>]

--
[ Picked text/plain from multipart/alternative ]

>Hi Anton!  (can't imagine what one could do with "Gombkötö", but maybe
>that's a German thing?  Ich spreche Deustch nicht so gut.  I didn't
>slaughter that too badly, did I?  <g> )

Well, "Gombkötö" is hungarian and Austrians do quite some harm to it.
Your german sentence was perfect. (Except for the typo, of course ;-)

>The CHKOBJ idea:  I might be inclined to use this in a program that
>*absolutely* without fail had to finish what it started.  But for the
>scenarios I am looking at, I really need to know beforehand that user
>ABC can run the program in its entirety before running it.

That's what i thought a while before, too. But somehow sometimes "they"
realize what they have to run to do it. And then i have the same problem
again. For instance, when there's something to vary on or off, i do the
CHKOBJ in the beginning before anything else bad has begun.

>That's why *I think* I like the USRPRF(*OWNER) approach with programs.
>Sure makes it easy as it concerns authorization.  If I can run the whole
>program without authority issues, then my worries are over by using
>USRPRF(*OWNER).  Rhetorical question: Why not create all applications
>this way?  Go ahead, scare me!

That is actually done.

Think of this:

A user is authorized to enter data in file A with PGMA. But he isn't
authorized to change data with UPDDTA.
The data is owned by the owner of the programs, running with adopted
authority. And the owner hasn't to be more powerful than the user, it's
just a separation of rights. "The boss" gets a program written that helps
"the user" do his job in they way the boss wants it. So the program is
owned by "The boss" and so is the data, and "The user" hasn't got any
rights on the data. He can't display it, he can't change it, he can't save
or mail it.
There are just the means the boss gives him.

Not so bad, ha?

But i think almost impossible to implement in a company where users are
used to changing (they call it "correcting") data on the fly.... :-)



Mit freundlichen Grüssen / best regards

Anton Gombkötö

Avenum Technologie GmbH
Wien - Mattsee - Stuttgart
e-mail Office   :       mailto:Anton.Gombkoetoe@avenum.com
Homepage        :       http://www.avenum.com

Lest das Redbook / read the redbook "Who knew you could do that with RPG?":
http://www.redbooks.ibm.com/abstracts/sg245402.html
--