Re: Locking out USRPRF with *ALLOBJ

["Buck Calabro" <buck.calabro@xxxxxxxxxxxx>]

> Is there a way to lock a USRPRF that has
> ALLOBJ authority out of a specific
> library and/or command?

As you've undoubtedly been told, you can't give someone the master key
to the building and then have a particular lock which doesn't allow
use of the master key.  For whatever reason, computer OS folks have
not adopted this particular real-world model.

A workaround is to create a different user profile which is explicitly
authorised to all the objects in the system (not via *ALLOBJ) -
perhaps an *AUTL.  Revoke that user from the command you want to
secure.  I don't think there is an easy, one-step method to do this.

As a footnote, no one should ever use a *ALLOBJ profile for any daily
work whatsoever.  All too often, that person creates object which
lesser profiles can not access, and it gradually becomes easier to
give everyone *ALLOBJ than to change the authority on the
mis-authorised objects.  If one goes that route, one may as well not
bother with authority.
  --buck