Re: Odd security issue with adopted authority

[Charles Wilt <charles.wilt@xxxxxxxxx>]

Working as designed...

There was a recent thread about it...
http://archive.midrange.com/midrange-l/201508/msg00726.html

Charles

On Mon, Sep 14, 2015 at 12:41 PM, Jim Franz <franz9000@xxxxxxxxx> wrote:

> This has worked for several years, and no recent program change, ptfs, or
> profile change that we can detect. It worked up to Friday morning...
>
> Looking at an issue where a program that adopts authority (User profile . .
> . . . . . . . :   *OWNER)
> and owner has *ALLOBJ and *SECADM is executing a CRTUSRPRF and not
> authorized to the Group Profile of the user to be created.
> This is a client job (C#) calling my program
>
> Job . . :   QZRCSRVS      User . . :   QUSER         Number . . . :
>  008237
>
> Message ID . . . . . . :   CPF9802       Severity . . . . . . . :   40
> Message type . . . . . :   Escape
> Date sent  . . . . . . :   09/14/15      Time sent  . . . . . . :   11:4
>
> Message . . . . :   Not authorized to object GR_NONXYZ in QSYS.
> Cause . . . . . :   You do not have the correct authority for object
>   GR_NONXYZ in library QSYS type *USRPRF.
> Recovery  . . . :   Contact your security officer or the object owner to
>   obtain the correct authority and try your request again.
>
> This still works in out test partition but not in production.
> We allow a select group of users, outside of IT, to manage outside users.
> V7R1.
> Owner has *ALLOBJ *AUDIT  *IOSYSCFG  *JOBCTL  *SAVSYS
> *SECADM    *SERVICE  *SPLCTL
>
> Program still works fine to change or delete profiles. Only CRTUSRPRF fails
> .
>
> Any ideas before call IBM?
>
> Jim Franz
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.