RE: EDTOBJAUT from a CL program

["Dennis Lovelady" <iseries@xxxxxxxxxxxx>]

I did check, and the program I wrote for that function is the property of
the client for whom I wrote it.  I did not retain the source.

In essence, it retrieved existing authorities, object by object, for the
libraries in question.  I think DSPOBJD OUTPUT(*OUTFILE) OUTMBR(mymbr *ADD).
DSPOBJAUT does not take generic names (ARGGGH!)....

Then process each row of the output file with RVKOBJAUT.  Tedious but
effective.

Dennis Lovelady
http://www.linkedin.com/in/dennislovelady
--
Tom Seaver: "What time is it?"
Yogi Berra: "You mean now?" 


> I want to revoke all authorities.  In most cases, the user profile I want
> to remove is the original creator of the object, who is now in a group
> that has *USE authority, so I want the individual totally removed.  I
> don't want to see it there, even if the level is correct.  I guess what I
> am saying is that revoking the authority is not the real issue; it is
> getting the profile to not be listed there that is the real issue.
>
> OK.  I just got it to work, but I see what you mean about not being able
> to revoke what is not there.
>
> In order to get rid of a user profile that had *all authority, I had to
> run two commands:
>
> RVKOBJAUT OBJ(JRBLIB/ARCM11FX) OBJTYPE(*PGM) USER(MNUMBERS) AUT(*DLT *REA
> D *UPD *EXECUTE)
>
>  RVKOBJAUT OBJ(JRBLIB/ARCM11FX) OBJTYPE(*PGM) USER(MNUMBERS) AUT(*ADD *OBJ
> OPR *OBJALTER *OBJEXIST *OBJMGT *OBJOPR *OBJREF)
>
> So now I just have to figure out what to do when a user has *change or
> *use or even Userdef  It just seems like there should be an easier way.
>
>
>
> From:   Dennis <iseries@xxxxxxxxxxxx>
> To:     Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> Date:   08/11/2011 03:30 PM
> Subject:        Re: EDTOBJAUT from a CL program
> Sent by:        midrange-l-bounces@xxxxxxxxxxxx
>
>
>
> What authorities are you revoking?
>
> If it is changing to User Defined, take a look to see what authorities are
> NOT being revoked (don't forget about F11 on the DSP/EDTOBJAUT screens.
>
> One cannot revoke authorities that have not been granted (unfortunately),
> so *ALL may not work for you.
>
> The way I have done this in the past, is to write a program to retrieve
> the authorities that have been granted, and then revoke them individually.
>  I *may* have a program lying around that does that type of thing.
> ++
> Dennis
> ++
>  "For a moment, nothing happened.  Then, after a second or so, nothing
> continued to happen."
>      -- The Hitchhiker's Guide to the Galaxy
>
>
>
>
> Sent from my Galaxy tablet phone.  Please excuse my brevity.
> For any grammatic/spelling errors, there is no excuse.
> ++
>
>
> BBaase@xxxxxxxxxxxxx wrote:
>
> > Dennis:  I have tried RVKOBJAUT and it changes the authority to
> > USERDEF
> > and leaves the profile there.
> >
> >
> >
> >
> > From:   Dennis <iseries@xxxxxxxxxxxx>
> > To:     Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> > Date:   08/11/2011 03:03 PM
> > Subject:        Re: EDTOBJAUT from a CL program
> > Sent by:        midrange-l-bounces@xxxxxxxxxxxx
> >
> >
> >
> > Are you thinking of RVKOBJAUT?
> > ++
> > Dennis
> > ++
> > "When a person with experience meets a person with money, the person
> > with
> > experience will get the money.  And the person with the money will get
> > some experience."
> >     -- Leonard Lauder
> >
> >
> > Sent from my Galaxy tablet phone.  Please excuse my brevity.
> > For any grammatic/spelling errors, there is no excuse.
> > ++
> >
> >
> > BBaase@xxxxxxxxxxxxx wrote:
> >
> > > I am trying to clean up the authorities on some objects on our system.
> >
> > > We
> > > recently decided to give programmers *USE authority to production
> > > objects
> > > after years of letting them have *ALLOBJ.  I am trying to write a CL
> > > (or
> > > even from a command line) do what I can easily do from the EDTOBJAUT
> > > screen and that is completely remove a user profile from the list of
> > > user
> > > profiles that have authority.  It looks like this:
> > >                          Object
> > > User        Group       Authority
> > > *PUBLIC                 *USE
> > > AMAPICS                 *ALL
> > > BBAASE                  *ALL
> > > GRPISPGMR               *USE
> > >
> > > With edtobjaut, I can field exit through BBAASE and *ALL and that line
> > > is
> > > gone.  Great!
> > > How do I do that with a command?   I have tried RVKOBJAUT and it
> > > changes
> > > the authority to  USERDEF and leaves the profile there.
> > > Well I don't want it there.  Any help would be much appreciated.
> > > Thanks,
> > >
> > >
> > > Barbara Baase
> > > IBMi System i  Administrator
> > > Duro-Last Roofing, Inc.
> > > 525 Morley Drive
> > > Saginaw, MI  48601
> > > Phone: 989-753-6486 x2610
> > > Fax:  989-753-4472
> > >
> > > Confidentiality Notice:
> > > This email, including attachments, may include confidential and/or
> > > proprietary information, and may be used only by the person to whom or
> >
> > > entity to which it is addressed.  If the reader of this email is not
> > > the
> > > intended recipient or his/her authorized agent, the reader is hereby
> > > notified that any dissemination, distribution, or copying of this
> > email
> > > is
> > > prohibited.  If you have received this email in error, please notify
> > > the
> > > sender by replying to this message, and then delete this email
> > > immediately.  Thank you.
> > >
> > >
> > > --
> > > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > > list
> > > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > > To subscribe, unsubscribe, or change list options,
> > > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > > Before posting, please take a moment to review the archives
> > > at http://archive.midrange.com/midrange-l.
> >
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
> >
> >
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.