RE: Athuorization lists

[rob@xxxxxxxxx]

Adding the appropriate group profile to the user sounds a lot like 
supplemental groups.  We tried that.  That, alone and by itself, increased 
the length of our SAVSYS from 4 minutes to 44 minutes.  Verified by a team 
of IBMers dialed into our machine.  Then we also ran into the limitation 
that 1 single user, or group profile, can only own so many objects.

Authorization lists can be some work.  However we're going that way.  We 
used some api's to clone USERB into any and all authorization lists that 
USERA is a member of.  And a few other like functions.

Adding a user to a particular object or library can be a pain if that 
object is in use, etc.  While adding a new user to an authorization list 
is no problem.  Also, if you do
CHGLIB MYLIB CRTAUT(MYAUTL) and you have that library secured by 
authorization list MYAUTL, then any new object created in that library 
will be secured by that authorization list.  With the exception of a few 
commands that IBM mucked up.  For example, we had to run CHGCMDDFT CRTSAVF 
NEWDFT('AUT(*LIBCRTAUT)')

Rob Berendt