Re: WDSCI Debugging a job from any user

Hi Frank,

Please see my comment below.

Regards,

Xuan Chen,  Problem Determination Tools for iSeries
(905) 413-3769 T/L 969-3769
xuanchen@xxxxxxxxxx





Frank.Kolmann@xxxxxxxxxx 
Sent by: wdsci-l-bounces@xxxxxxxxxxxx
01/04/2007 05:51 PM
Please respond to
Websphere Development Studio Client for iSeries <wdsci-l@xxxxxxxxxxxx>


To
wdsci-l@xxxxxxxxxxxx
cc

Subject
[WDSCI-L] WDSCI Debugging a job from any user






Hi
( I am hoping Xuan can help)

I am on V5R3 and I use the WDSCi debugger, it is very good and has the
 'run to' function that I missed for a long time in the ILE debugger.
I also love the field Monitor and the way it can show the hex values.
The WDSCi debugger is very clever in how it manages to activate the 
STRSRVJOB JOB(999999/USER/JOB)DUPJOBOPT(*MSG) command with only the 
program and the USER name as input. 

I agree that it is not possible to set a SEP with *ANY as the user 
profile,(what if hundreds of users run the program) but can I have 
another function please.  That is show me a list of jobs that are 
running a particular program, this is like a 'Program where in use'. 
I dont know of any way to do this with the existing OS400 commands.

XC >> I will put this requirement into our future consideration list.

I will then see what profile/s are using the program and then I 
can start up a SEP for the profile I need, (provided that I have
the proper authority). Just a thought.

A question, I need *SERVICE special auth to debug another
users job. I saw one needs rights to the STRSRVJOB command but I
already have that. Is there some way I can do this without *SERVICE
as our security people dont want programmers to have this.
Does this PTF fix this in V5R4 and if it does can I have an 
equivalent for V5R3, please.
APAR (SE20277) has been fixed in V5R4, and the PTF # is SI19633.

XC >> Yes, this PTF fixes the setting SEP authority problem in V5R4.
      I will check Rochester to see their plan for fixing it in other
      releases. 

Frank Kolmann


======================================
The following is history I found in the archives.

date: Thu, 4 Jan 2007 15:30:55 -0500
from: Xuan Chen <xuanchen@xxxxxxxxxx>
subject: Re: [WDSCI-L] Debugging?

Not sure if this is the answer you want...

The WDSC debugger actually does a STRSRVJOB (for your application), and 
then does a STRDBG to debug application in your application job.

Thanks,

Xuan Chen,  Problem Determination Tools for iSeries
(905) 413-3769 T/L 969-3769
xuanchen@xxxxxxxxxx

Hi Diane,

Confirmed with the expert that there is no way of setting Service Entry
Point with *ALL (or *ANY) right now.  Not sure if we want to add this into
our Service Entry Point support since there may be some implication of it.

Thanks,

Xuan Chen,  Problem Determination Tools for iSeries



I have found the article that Kyle has pointed out for debugging in WDSC,
(Thank You Kyle,  my habits had me using method 3, I've now bumped up to
method 1 with service entry points, never to return to #3).
My questions are:
1) With method 1, you specify the UserID, I am trying to specify a userid
other than myself (profile USER2)  and receive the error:
CPF0609 - not allowed to use specified user profile.
So when user2 calls my program, I expect it to run in WDSC.

2) I would like to set the service entry point with *ALL as user profile,
so regardless of which operator "unknowingly" calls the program, I can
intercept it in debug mode.   Is there anyway to set the service entry
point without defining a particular user profile?

Diane  Mueller


==================================================
Xuan,

Thanks for the information.  I guess I'll have to wait until we get a 
machine that'll run V5R4.  *SERVICE authority allows way too much for our 
security officer to allow programmers to have it.  Interestingly enough 
looking at SE20227, it lists V5R1 through V5R4 as affected releases.  Too 
bad there is no PTF for the other 'supported' operating systems.  I know 
that's not you or any of the team in Toronto's fault.

Anyway, I really appreciate your response.

Thanks again,
Michael Quigley
AS/400 Programming Section
The Way International
www.TheWay.org

date: Tue, 28 Nov 2006 13:13:53 -0500
from: Xuan Chen <xuanchen@xxxxxxxxxx>
subject: Re: [WDSCI-L] Interactive Debugging

Michael,

Setting a service entry point in a program that will fire when the 
program is run under a different user profile, requires that the 
"setting user profile" have enough authority to access the STRSRVJOB 
command and to access the targeted user profile. 
The SETTER must have *USE, *CHANGE or *ALL access to both of these 

items.


There was a problem with the authority checking for setting SEP in this 
situation, and an APAR (SE20277)  had been opened for it.
The workaround for this problem is to give the SETTER user profile the 
*SERVICE special authority. 

This APAR has been fixed in V5R4, and the PTF # is SI19633.

Thanks,

Xuan Chen,  Problem Determination Tools for iSeries
(905) 413-3769 T/L 969-3769