Re: Restricting Users with *ALLOBJ in the Advanced Job Scheduler

[Tom Liotta <qsrvbas@xxxxxxxxxxxx>]

Charles Wilt wrote:

> *ALLOBJ means all objects....
>
> However....trying taking *ALLOBJ off the user's profile.  Instead,
> make them a member of a gourp that has *ALLOBJ.
>
> Now the security check will see the exclude before it checks for
> *ALLOBJ on the group.

This can be a useful _temporary_ technique, but should not be relied 
upon nor put into general or widespread use. I've used it in a 
number of cases where further actions had to be delayed.

It works pretty much as advertised -- the private authorities are 
checked and /found/ before group authorities are checked. Once an 
appropriate authority is found, authority checking ends.

/However, it cannot be ignored that *ALLOBJ is still available./ An 
enterprising user may discover (or learn) multiple ways to access it.

As noted in the first sentence, "*ALLOBJ means all objects....". 
Beyond that, it is a 'special authority'. It's "special" because it 
overrides any and every private object authority that's granted to 
the user who has *ALLOBJ.

With *ALLOBJ, you can be fairly certain that any other desired 
authority can be obtained. There's a lot of info available out there 
nowadays.

Tom Liotta

> On 8/14/08, Burns, Bryan wrote:
> > Is there a way to restrict a user with *ALLOBJ user profile special
> > authority from adding a job to the advanced job scheduler?  I changed the
> > function authority to *EXCLUDE for the user but the user can still add a
> > job.