Ed, >From your "in most cases, not cause an existing job that is running under that user profile to pick up the new group" comment that STRDBG may just be one of the exceptions. I say this because it appears as though debug with a program specified, looks at the profile running the job and not the current profile or group. I am starting with a profile that has no group or supplemental groups. I then set the effective group to the owner of the program I am trying to debug and then run the STRDBG command specifying the program name and it fails. If I run STRDBG with no program, debug starts. I can then add the program to debug with DSPMODSRC - F14 - option 1. In any case the authority check for a PGM and SRVPGM are different on the STRDBG command. You can start debug and specify a service program who's authority is derived solely from an effective group swap. You cannot run the debug command specifying a program who's authority is derived from an effective group. With the DSPMODSRC - F14 workaround I mentioned earlier it is possible to debug a program based on authority derived from an effective group. I have not tried using STRSRVJOB. Thanks, David Morris >>> email@example.com 03/18/02 10:23AM >>> David, >Hopefully this doesn't confuse the issue more. I realize >authority is checked at runtime, but I always thought it >was derived when you sign on or swapped a profile. I >am under this impression because changes to a profile >are not retroactive to jobs that are signed on. No we do not derive authority at sign-on or when the profile is swapped. It is derived at each point in time where it needs to be checked. Grant and revoke type changes will apply to all jobs that are currently active. It is true that adding a group profile to user profile will, in most cases, not cause an existing job that is running under that user profile to pick up the new group. The only case were it would pick it up is if that job swapped user profiles to the changed user profile. >I am changing the effective group to get more authority >before running strdbg. I thought that I should get the same >authority as I would get by changing the group profile >and then signing on. That is not the case with debug. > >The strdbg command works OK if I change the profile >to add the group profile in question and then signon. It >does not work if I change the profile and then set the >effective group for the job. Swaps do not work either, >but my explanation of how I have tested that would >probably add to the confusion. Is the user profile a member of more than one group? Changing the effective group will replace only the first group profile and not any of the Supplemental groups of the user profile while swap replaces everything. Are you using STRSRVJOB to debug this job or are you entering the debug commands from within the job that is being debugged? Ed Fishel, edfishel@US.IBM.COM
As an Amazon Associate we earn from qualifying purchases.
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.