Re: CLRDBFMBR authority ; CLRPFM or similar replace data option

[CRPence <crp@xxxxxxxxxxxxxxxxxxxx>]

  Neither ownership nor *ALL authority are required, even if there is 
no special value to represent the specific set of object and data rights 
combined to enable the clear physical file member request.  The Security 
Guide documents authority requirements for commands:
http://publib.boulder.ibm.com/infocenter/iseries/v5r4/topic/books/sc415302.pdf

  CLRPFM [or the effective equivalent action by REPLACE(*YES) features 
e.g. MBROPT(*REPLACE) on CPYF], the *OBJOPR (object operational) object 
right and the *DLT (delete) data right are both required.  Additionally, 
either either the *OBJALT (object alter) object right or *OBJMGR (object 
management) object right.  The additional object authority/right is, 
beyond *CHANGE authority which gives more typical change capabilities, 
an added requirement for actions against the members of a database file.

  If there is an error clearing the member when the user has *ALLOBJ 
special authority, then most likely, the problem preventing the 
requested function is due to an error condition with an origin other 
than authority.  The specific error condition should be reviewed; first 
action, to get the message details from a spooled joblog.  And if the 
problem is with authority, then an AF (Authority Failure) entry should 
be logged in the audit journal; when of course, such auditing is active, 
and so DSPJRN QAUDJRN can reveal the logging for the failing job.  So if 
there is no AF audit entry for the failing case, the origin of the 
problem is almost surely not due to an authority issue.

  Some possible origins for the clear being prevented: referential 
integrity, file.mbr.data in-use, delete trigger, others

Regards, Chuck