Re: special authority

[Patrick Botz <botz@xxxxxxxxxx>]

I would do the following:
Write a CL program that called CHGUSRPRF. 
If you just need to re-enable userIDs for Netserver, have the program 
accept one parameter, the USRPRF name. 
After creating the CL program, select a user profile that has *SECADM and 
*ALLOBJ the owner of the new CL program
Use CHGPGM and set the USRPRF attribute to *OWNER (this is what makes it 
adopt the authority of the owner of the program.
Make PUBLIC on this command *EXCLUDE
Create a group for the help desk personnel and give the group *USE to the 
new program.

After that I would either have the help desk folks use the new program 
either from the green screen or through the remote command GUI in iNav.




Patrick Botz


Security Architecture Consulting & Implementation

IBM Systems and Technology Group Lab Services 

mail: botz@xxxxxxxxxx

phone: 507.253.0917 / mobile: 507.250.5644



ibm.com/servers/eserver/services



midrange-l-bounces+botz=us.ibm.com@xxxxxxxxxxxx wrote on 04/26/2007 
08:51:02 AM:

> That piece of GUI is an outstanding feature to determine if NetServer 
> access is blocked that way.  We, too, have shown our help desk people 
how 
> to look at it.  We don't let them use it to fix the person though.  An 
> alternative is to change the user profile "some" way to reset that.  For 

> example if you had a short program that 
> adopted authority
> CHGUSRPRF that user.
> I believe that would reset it.
> Would telling your help desk people to do that work?  I suggest calling 
> IBM and finding out if there is some way to (through Application 
> Administration perphaps) give your help desk adopted authority or some 
> such thing to have the gui work.  If not, submit a DCR.  If you will, I 
> will.
>
> Rob Berendt
> -- 

> fu_james@xxxxxxxxxxxxxx 
> Sent by: midrange-l-bounces@xxxxxxxxxxxx
> 04/26/2007 09:13 AM
> Please respond to
> Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
>
>
> To
> Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> cc
> Subject
> special authority
>
> Hi, list,
> We would like to take away special authority from our helpdesk people. 
One
> of their responsibilities is to enable iSeries NetServer user in iSeries
> Navigator. They need *SECADM and *IOSYSCFG to do this. Is there any
> solution for that?
> Thanks in advance...
>
> Best Regards.
>
> James Fu
>
>
> The information contained in this message is confidential and may be 
> legally privileged. The message is intended solely for the addressee(s). 

> If you are not the intended recipient, you are hereby notified that any 
> use, dissemination, or reproduction is strictly prohibited and may be 
> unlawful. If you are not the intended recipient, please contact the 
sender 
> by return e-mail and destroy all copies of the original message.
>
> L'information contenue dans ce  message est de nature confidentielle et 
> peut etre de nature privilegiee. Ce  message est strictement reserve a 
> l'usage de son ou ses destinataires. Si vous  n'etes pas le destinataire 

> prevu, prenez avis, par la presente, que tout usage,  distribution, ou 
> copie de ce message est strictement interdit et peut etre  illicite. Si 
> vous n'etes pas le destinataire prevu, veuillez en aviser  l'expediteur 
> par courriel et detruire tous les exemplaires du message original.