Thank you Paul. I did read it.
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul Roy
Sent: Monday, September 14, 2015 3:14 PM
To: Midrange Systems Technical Discussion
Subject: RE: Odd security issue with adopted authority
Please read this..
http://www-01.ibm.com/support/docview.wss?uid=nas8N1013328
Paul
From: "Monnier, Gary" <Gary.Monnier@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 14/09/2015 19:20
Subject: RE: Odd security issue with adopted authority
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
It was working until Friday and suddenly stopped and nothing has changed?
Hmm. Forgive me if I'm skeptical.
IBM's manual states the following about the CRTUSRPRF...
Restrictions: The user of this command must have:
Security administrator (*SECADM) special authority
Use (*USE) authority to the initial program, initial menu, job description, message queue, output queue, and attention-key-handling program (if specified)
Change (*CHANGE) and object management (*OBJMGT) authorities to the group profile and supplemental group profiles (if specified).
Your adopted authority scheme meets these requirements correct? If so
your program should be working.
Did the program get promoted to production recently? Did the user
profile parameter get changed to *USER or, did the program owner get changed during the promotion? Maybe an audit stated special authorities should be removed from the user profile and something was removed? Is there an exit program in place for exit point QIBM_QSY_CRT_PROFILE?
Gary Monnier
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Jim Franz
Sent: Monday, September 14, 2015 9:41 AM
To: Midrange Systems Technical Discussion
Subject: Odd security issue with adopted authority
This has worked for several years, and no recent program change, ptfs, or profile change that we can detect. It worked up to Friday morning...
Looking at an issue where a program that adopts authority (User profile .
.
. . . . . . . : *OWNER)
and owner has *ALLOBJ and *SECADM is executing a CRTUSRPRF and not authorized to the Group Profile of the user to be created.
This is a client job (C#) calling my program
Job . . : QZRCSRVS User . . : QUSER Number . . . : 008237
Message ID . . . . . . : CPF9802 Severity . . . . . . . : 40
Message type . . . . . : Escape
Date sent . . . . . . : 09/14/15 Time sent . . . . . . : 11:4
Message . . . . : Not authorized to object GR_NONXYZ in QSYS.
Cause . . . . . : You do not have the correct authority for object
GR_NONXYZ in library QSYS type *USRPRF.
Recovery . . . : Contact your security officer or the object owner to
obtain the correct authority and try your request again.
This still works in out test partition but not in production.
We allow a select group of users, outside of IT, to manage outside users.
V7R1.
Owner has *ALLOBJ *AUDIT *IOSYSCFG *JOBCTL *SAVSYS
*SECADM *SERVICE *SPLCTL
Program still works fine to change or delete profiles. Only CRTUSRPRF fails .
Any ideas before call IBM?
Jim Franz
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
http://archive.midrange.com/midrange-l.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
http://archive.midrange.com/midrange-l.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
http://archive.midrange.com/midrange-l.
midrange.com
