Re: Odd security issue with adopted authority

[Charles Wilt <charles.wilt@xxxxxxxxx>]

Here's a tech note linked to in thread I posted...
http://www-01.ibm.com/support/docview.wss?uid=nas8N1013328

Charles

On Mon, Sep 14, 2015 at 1:20 PM, Monnier, Gary <Gary.Monnier@xxxxxxxxx>
wrote:

> It was working until Friday and suddenly stopped and nothing has changed?
> Hmm.  Forgive me if I'm skeptical.
>
> IBM's manual states the following about the CRTUSRPRF...
>
>   Restrictions: The user of this command must have:
>
>       Security administrator (*SECADM) special authority
>       Use (*USE) authority to the initial program, initial menu, job
> description, message queue, output queue, and attention-key-handling
> program (if specified)
>       Change (*CHANGE) and object management (*OBJMGT) authorities to the
> group profile and supplemental group profiles (if specified).
>
> Your adopted authority scheme meets these requirements correct?   If so
> your program should be working.
>
> Did the program get promoted to production recently?   Did the user
> profile parameter get changed to *USER or, did the program owner get
> changed during the promotion?  Maybe an audit stated special authorities
> should be removed from the user profile and something was removed?  Is
> there an exit program in place for exit point QIBM_QSY_CRT_PROFILE?
>
> Gary Monnier
>
>
> -----Original Message-----
> From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
> Jim Franz
> Sent: Monday, September 14, 2015 9:41 AM
> To: Midrange Systems Technical Discussion
> Subject: Odd security issue with adopted authority
>
> This has worked for several years, and no recent program change, ptfs, or
> profile change that we can detect. It worked up to Friday morning...
>
> Looking at an issue where a program that adopts authority (User profile . .
> . . . . . . . :   *OWNER)
> and owner has *ALLOBJ and *SECADM is executing a CRTUSRPRF and not
> authorized to the Group Profile of the user to be created.
> This is a client job (C#) calling my program
>
> Job . . :   QZRCSRVS      User . . :   QUSER         Number . . . :
>  008237
>
> Message ID . . . . . . :   CPF9802       Severity . . . . . . . :   40
> Message type . . . . . :   Escape
> Date sent  . . . . . . :   09/14/15      Time sent  . . . . . . :   11:4
>
> Message . . . . :   Not authorized to object GR_NONXYZ in QSYS.
> Cause . . . . . :   You do not have the correct authority for object
>   GR_NONXYZ in library QSYS type *USRPRF.
> Recovery  . . . :   Contact your security officer or the object owner to
>   obtain the correct authority and try your request again.
>
> This still works in out test partition but not in production.
> We allow a select group of users, outside of IT, to manage outside users.
> V7R1.
> Owner has *ALLOBJ *AUDIT  *IOSYSCFG  *JOBCTL  *SAVSYS
> *SECADM    *SERVICE  *SPLCTL
>
> Program still works fine to change or delete profiles. Only CRTUSRPRF
> fails .
>
> Any ideas before call IBM?
>
> Jim Franz
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
> unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
> moment to review the archives at http://archive.midrange.com/midrange-l.
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.