Re: Commands for Limited Users -- SECURITY400

We might also point out that under these circumstances, the groupprofile(s) would essentially be the only user(s) entered on theauthorization lists.

The links in the authority chain can be very concise this way. I'd beinterested in how Rob's group profiles were set up so that they causedlong save-times.


Tom Liotta

john.earl wrote:

Rob,

I don't believe Authority lists and Group Profiles are mutually
exclusive, I think they are complimentary.  The way we have always
practiced (and preached) it is like this:

Group Profiles are used to assemble users who do a similar function into
a group.  Authority lists assemble objects that should be secured
similarly into an object group.  The combination of the two provides for
the most efficient way that I know of to secure individual objects in
OS/400.

You could choose to use just one or the other, but they are not mutually
exclusive.

-----Original Message-----
From: security400-bounces@xxxxxxxxxxxx
[mailto:security400-bounces@xxxxxxxxxxxx] On Behalf Of
rob

I much prefer authorization lists over groups.
Supplemental groups make
me shudder.  The overhead on them is tremendous.  A simple
SAVSYS went
from 4 minutes to 44 minutes when we tinkered around with
them.  IBM
dialed in and via PRTPVTAUT determined supplemental groups
to be the
culprit.  Besides, we had more supplemental groups than
you could put in
CHGUSRPRF SUPGRPPRF(...).  Lots of divisions, and then
each division had a
different software vendor between accounting and ERP.
When you have two
different divisions feeding two different fierce
competitors we had to
demonstrate a pretty solid line between the two.


"David Morris"
Sent by: security400-bounces@xxxxxxxxxxxx

Adopted authority is nearly as outdated as limited
capability. It
doesn't work well with triggers or IFS files and is
incompletely
implemented. Adoption is ineffective in exits but based on
your message
you may have overcome some of the limitations I have run
up against. The
biggest reason to avoid adoption is that it is often
implemented
incorrectly and is frequently the source of serious
security problems.

A few years back, I started using a technique that gives
similar
function by swapping in or setting effective groups and
supplemental
groups.