Re: swap profile handles...

["Crispin Bates" <cbates@xxxxxxxxxxx>]

Are you sure SECXXXXP has authority to SECXXXL/SECXXXXQ ?

Where is spool file SPR201R. Is it in SECXXXXL/SECXXXXXQ outq?

Can you manually move the spool file to another outq while in QCMD? Can you 
then move it back?

If you can move the spool file around, then it sounds like DUPSPLF is using 
the USER for something (perhaps an API call) rather than CURUSER.

You would have to find out what it is that DUPSPLF is doing...

----- Original Message ----- 
From: "Gerald" <gmagnuson@xxxxxxxxxxxxx>
Newsgroups: midrange.midrange-l
To: <midrange-l@xxxxxxxxxxxx>
Sent: Friday, July 25, 2008 1:14 PM
Subject: Re: swap profile handles...


> Yes, I receive the same error:
>
>
> DUPSPLF File(SPR201R) Newsplf(SPR201R) Job(804896/GMAGNUSON/SPR201R)
> Outq(SECXXXXL/SECXXXXQ) Splnbr(1)
>   Not authorized to output queue SECXXXXQ in SECXXXXL.
> Error occurred while opening file .
>
>
>  Job:   GMAGNUSONB     User:   GMAGNUSON      Number:   915729
>
>  Status of job . . . . . . . . . . . . . . . :   ACTIVE
>  Current user profile  . . . . . . . . . . . :   SECXXXXP
>  Job user identity . . . . . . . . . . . . . :   SECXXXXP
>    Set by  . . . . . . . . . . . . . . . . . :     *DEFAULT
>  Entered system:
>
> Crispin Bates wrote:
> > Taking a step back. If instead of letting the DUPSPLF do something with
> > the spool file, replace the call to DUPSPLF with call qcmd and try it
> > manually. When in qcmd, wrkjob option 1 and see who the current profile
> > is. Do you get the same error when doing it manually?
> >
> >
> >
> > ----- Original Message ----- From: "Gerald" <gmagnuson@xxxxxxxxxxxxx>
> > Newsgroups: midrange.midrange-l
> > To: <midrange-l@xxxxxxxxxxxx>
> > Sent: Friday, July 25, 2008 12:05 PM
> > Subject: Re: swap profile handles...
> >
> >
> > > Thanks for helping me on this.
> > >
> > > The profile I'm swapping _from_ has no authority to the secured queue,
> > > and has NO special authority.
> > >
> > > I have put the program in debug, and have verified that the new profile
> > > handle is in effect. I even have commented out the swapping back of the
> > > original profile handle, and i'm seeing the "super users" spool files.
> > >
> > >
> > >
> > > Crispin Bates wrote:
> > > > What about the profile you are swapping from?
> > > >
> > > > Doesn't make much sense to me. Can you check the job when DUPSPLF is
> > > > called to make sure that the Current user is the one you have swapped
> > > > to?
> > > >
> > > > ----- Original Message ----- From: "Gerald" <gmagnuson@xxxxxxxxxxxxx>
> > > > Newsgroups: midrange.midrange-l
> > > > To: <midrange-l@xxxxxxxxxxxx>
> > > > Sent: Friday, July 25, 2008 11:26 AM
> > > > Subject: Re: swap profile handles...
> > > >
> > > >
> > > > > DSPDTA = *NO
> > > > > AUTCHK = *OWNER
> > > > >
> > > > > Yes the profile I'm swapping to does have *SPLCTL special authority
> > > > > (and
> > > > > none other)
> > > > >
> > > > > Crispin Bates wrote:
> > > > > > What are the settings for DSPDTA & AUTCHK on the Outq?
> > > > > >
> > > > > > Also, does the user you are swapping from have *SPLCTL special
> > > > > > authority.
> > > > > >
> > > > > > I get a little rusty with spool file authorities. I just created an
> > > > > > OutQ
> > > > > > that is owned by QSECOFR. I made it *PUBLIC *EXCLUDE. My low level 
> > > > > > dev
> > > > > > profile could wrkoutq it and move spool files, even though it is
> > > > > > *PUBLIC
> > > > > > *EXCLUDE. It must have *SPLCTL or something.
> > > > > >
> > > > > > Sorry, not being much help am I :-)
> > > > > >
> > > > > > ----- Original Message ----- From: "Gerald" <gmagnuson@xxxxxxxxxxxxx>
> > > > > > Newsgroups: midrange.midrange-l
> > > > > > To: <midrange-l@xxxxxxxxxxxx>
> > > > > > Sent: Friday, July 25, 2008 10:06 AM
> > > > > > Subject: Re: swap profile handles...
> > > > > >
> > > > > >
> > > > > > > Thanks for the reply
> > > > > > >
> > > > > > > DUPSPLF is from the TAATOOLS (circa 1995 version...)it uses
> > > > > > > several of
> > > > > > > the QSP* api's to make a copy of a spool file...
> > > > > > >
> > > > > > > Yes, I am checking the error codes. I do know the swap occurs
> > > > > > > because my
> > > > > > > app (a interactive list of user spool files, with ability to copy to
> > > > > > > other queues, some of which are "secure" (*public *exclude)) does
> > > > > > > show
> > > > > > > the spool files of my swapped profile...
> > > > > > >
> > > > > > > Crispin Bates wrote:
> > > > > > > > What is DUPSPLF?
> > > > > > > >
> > > > > > > > QWTSETP changes the job to run under the User that you retrieved a
> > > > > > > > handle for with QSYGETPH. The original user is completely out of 
> > > > > > > > the
> > > > > > > > picture at that point, so it has nothing to do with the original
> > > > > > > > users
> > > > > > > > authority to the Outq.
> > > > > > > >
> > > > > > > > Are you checking the Error Code from QSYGETPH?
> > > > > > > >
> > > > > > > > ----- Original Message ----- From: "Gerald"
> > > > > > > > <gmagnuson@xxxxxxxxxxxxx>
> > > > > > > > Newsgroups: midrange.midrange-l
> > > > > > > > To: <midrange-l@xxxxxxxxxxxx>
> > > > > > > > Sent: Friday, July 25, 2008 9:25 AM
> > > > > > > > Subject: swap profile handles...
> > > > > > > >
> > > > > > > >
> > > > > > > > > I am trying to get spool files copied into a secure outq.
> > > > > > > > > When I execute the swap (via QSYGETPH & QWTSETP) and run
> > > > > > > > > DUPSPLF, the
> > > > > > > > > DUPSPLF ends with a CPF4244 - not authorized to output queue...
> > > > > > > > >
> > > > > > > > > The user I am swapping to is the owner of the outq, and also has
> > > > > > > > > *all
> > > > > > > > > object authority on that object(the output queue)...
> > > > > > > > >
> > > > > > > > > Could the problem be that the original user would fall in to the
> > > > > > > > > *PUBLIC
> > > > > > > > > *EXCLUDE authority?
> > > > > > > > >
> > > > > > > > > --
> > > > > > > > > This is the Midrange Systems Technical Discussion (MIDRANGE-L)
> > > > > > > > > mailing
> > > > > > > > > list
> > > > > > > > > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > > > > > > > > To subscribe, unsubscribe, or change list options,
> > > > > > > > > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > > > > > > > > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > > > > > > > > Before posting, please take a moment to review the archives
> > > > > > > > > at http://archive.midrange.com/midrange-l.
> > > > > > > --
> > > > > > > This is the Midrange Systems Technical Discussion (MIDRANGE-L)
> > > > > > > mailing
> > > > > > > list
> > > > > > > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > > > > > > To subscribe, unsubscribe, or change list options,
> > > > > > > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > > > > > > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > > > > > > Before posting, please take a moment to review the archives
> > > > > > > at http://archive.midrange.com/midrange-l.
> > > > > --
> > > > > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > > > > list
> > > > > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > > > > To subscribe, unsubscribe, or change list options,
> > > > > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > > > > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > > > > Before posting, please take a moment to review the archives
> > > > > at http://archive.midrange.com/midrange-l.
> > > --
> > > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > > list
> > > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > > To subscribe, unsubscribe, or change list options,
> > > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > > Before posting, please take a moment to review the archives
> > > at http://archive.midrange.com/midrange-l.
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.