Re: Adopted authority and triggers

[Brian <system.i.lists@xxxxxxxxx>]

Roger,

On your SQLRPGLE program, check to see what is specified for Dynamic User
Profile; the default is *USER. To fully adopt authority when creating an
SQLRPGLE program, you need to specify DYNUSRPRF(*OWNER) on the CRTSQLRPGI
command in addition to USRPRF(*OWNER).

Kind regards,

BJ


On 4/3/07, Mackie, Roger L. (Precision Press) <RLMackie@xxxxxxxxxxxxx>
wrote:
> I am working on a project to give a specific user (LMTUSR) limited
> access to our database. As currently designed, LMTUSR is excluded from
> all but one library. The external stored procedures (SQLRPGLE and RPGLE)
> in that library adopt the owner's authority to access functions and data
> in other libraries. As long as those functions are in modules that only
> read the data, they work fine. However, the project requires procedures
> to insert data in certain tables that have *BEFORE *INSERT and *BEFORE
> *UPDATE external triggers.
>
> >From reading the security reference manual (we are on v5r3) I understand
> that triggers do not adopt authority from programs earlier in the call
> stack. Changing the external trigger programs to adopt authority (CHGPGM
> PGM(EXTTRG) USRPRF(*OWNER)) did not allow LMTUSR to open the files for
> update using adopted authority. When the triggers are disabled, UDFs
> that access the files complete correctly. When the triggers are enabled,
> the process fails with SQL0443 and CPF4236 "Not authorized to open.." in
> the job log. I could not find a parameter on the ADDPFTRG command to
> adopt authority.
>
> Did I miss something? While using adopted authority is there a way to
> insert and/or update data into files with triggers? If not, I'll
> probably use a data queue to get the data to a job whose user does have
> authority. Or is there a better way?
>
> Thanks,
> Roger Mackie
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.