Re: AS400 Class *USER and special authority *SECADM

[Jim Oberholtzer <midrangel@xxxxxxxxxx>]

True a *USER can perform *SECADM tasks but there is a caveat; they must 
also have the appropriate rights to the objects they are working on, for 
instance the user profile.  User A has rights to users B, C, and D, but 
not to E, F, and G.  User A would would be able to work on B, C, and D.  
User A would not be able to administer E, F, and G.

See the following.  User A is set up as suggested.  Only four user 
profiles show up in the list
*A
QDBSHR         Internal Data Base User Profile
QDBSHRDO       Internal Data Base User Profile
QTMPLPD        ALLOW REMOTE LPR REQUESTERS
*
Now look at the top of the list when a profile has authority to all of 
the user profiles:

*A
 ADVUSR01    DB2 Web Query user
 ADVUSR02    DB2 Web Query user
 ASIGEORGE   GEORGE - Disabled. Owns lots of ZEND
 AXES        (C) LANSA GROUP
 AXES_GROUP  (C) LANSA GROUP
 B
 BRADF       Brad Ford
 CGATEPRO *

So the answer provided is correct, but with a limit or two....  Example 
from a 6.1 box.



Jim Oberholtzer
CEO/Chief Technical Architect
Agile Technology Architects, LLC


On 3/24/2010 4:15 AM, Dennis Lovelady wrote:
> *This message was transferred with a trial version of CommuniGate(r) Pro*
>    
> > A user has a class *USER and special authority *SECADM.
> > Does this mean that this user will be able to perform all privileges of
> > *SECADM
> > or are they restricted to some degree because of *USER class.
> >      
> Special Authorities are cumulative. The user can perform all *SECADM
> actions.
>
> Regards,
>
> Dennis Lovelady
> http://www.linkedin.com/in/dennislovelady
> --
> "The direct use of force is such a poor solution to any problem, it is
> generally employed only by small children and large nations."
>          -- David Friedman
>
>
>
>