Re: AS400 Class *USER and special authority *SECADM

[John Earl <john.earl@xxxxxxxxxxxxxx>]

Dennis,

*SECADM alone does not convey any authority to work with any object  
(including USRPRF objects), so having *SECADM alone will not allow you  
to automatically change or delete existing profiles.

*SECADM alone would allow someone to create new profiles though, and  
that would be undesirable in many circumstances.  In the original  
question, it would be far better to give the *SECADM to a program  
(through adopted authority) than to give it to an end user.

jte



On Mar 24, 2010, at 5:07 AM, Dennis Lovelady wrote:

> > True a *USER can perform *SECADM tasks but there is a caveat; they  
> > must
> > also have the appropriate rights to the objects they are working on,
> > for
> > instance the user profile.  User A has rights to users B, C, and D,  
> > but
> > not to E, F, and G.  User A would would be able to work on B, C,  
> > and D.
> > User A would not be able to administer E, F, and G.
>
> Jim, what command was used that lists the users and limits that list  
> to four
> profiles for user A?
>
> Did you actually try changing any user who wasn't in that list?  My
> understanding is that *SECADM authority gives the right to change  
> security
> regardless of other contrived privileges to profiles.  *EXCLUDE may  
> (but
> probably should not) override this.
>
> Dennis Lovelady
> http://www.linkedin.com/in/dennislovelady
> --
> "A diplomat is a man who always remembers a woman's birthday but never
> remembers her age."
>        -- Robert Frost
>
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L)  
> mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.

--
John Earl
President and CEO
Patrick Townsend Security Solutions
"The Encryption Company"

Olympia, WA | www.patownsend.com
Office: 360-357-8971 Ext 118