Re: Securing an output queue

[John Earl <john.earl@xxxxxxxxxxxxxx>]

Nevermind - I see you have already made it clear that A & B can't see  
each others data, but it is possible to put all of USERDEPT's data in  
the another queue.


So try this...

UserA and User B's data already go to Q1.
OUTQ Q1 is defined as:
>>>Authorized users should have *CHANGE access to the OUTQ
>>>OPRCTL(*YES) if you want programmers and operators to be able to  
manage and view data in the queue or OPRCTL(*NO) if you don't want  
programmers and operators to be able to manage and view data in the  
queue
>>>DSPDTA (*NO) if you want to shield the data from *SPLCTL users as  
well, or DSPDTA(*OWNER) if the owner and *SPLCTL users can view the  
data.
>>>AUTCHK(*OWNER) to limit access to the owner of the spool file entry.

DEPTUSER data used to go to Q1, now you will change it to go to Q2.
OUTQ Q2 is defined as:
>>>Authorized users should have *CHANGE access to the OUTQ
>>>OPRCTL(*YES) if you want programmers and operators to be able to  
manage and view data in the queue or OPRCTL(*NO) if you don't want  
programmers and operators to be able to manage and view data in the  
queue
>>>DSPDTA (*YES) if you want to share the data with all the  
authorized users of the OUTQ
>>>AUTCHK(*DTAAUT) thus allowing all authorized users to have *CHANGE  
access to everything on the OUTQ


If this works, I'll be at COMMON to collect.  :-)

jte


On Apr 21, 2010, at 5:31 PM, John Earl wrote:

> Hmmm....  If my solution works you owe me a beer :-)
>
> OK, everybody needs to be able  see DEPTUSR's data, but is it also  
> important that UserA not be able to see UserB's data, UserB cannot  
> see UserA's data?
>
> If User A and B can see each other's data, solution is easy.  If  
> not, solution is more difficult....
>
> let me know.
>
> jte
>
>
> On Apr 21, 2010, at 3:55 PM, Lance Gillespie wrote:
>
> > I would like to do just the opposite -
> > give a group of users that have no special security
> > and can now only see their own spool files the
> > ability to see the spool files created by one additional
> > user id, call it DEPTUSER.
> >
> > The result would be that each of these individuals would
> > still have full control of their own spool files and would
> > also be able to control any spool files created by DEPTUSER,
> > without also being able to control each others.
> >
> > If need be, I can create an out queue and make all of DEPTUSER's
> > files go there, but I don't see that helping.
> >
> > Thanks,
> > Lance
>
> --
> John Earl
> President and CEO
> Patrick Townsend Security Solutions
> "The Encryption Company"
>
> Olympia, WA | www.patownsend.com
> Office: 360-357-8971 Ext 118

--
John Earl
President and CEO
Patrick Townsend Security Solutions
"The Encryption Company"

Olympia, WA | www.patownsend.com
Office: 360-357-8971 Ext 118