Re: Need to create a program that uses QSECOFR as adopted authority

On 25-Jul-2016 15:51 -0500, Paul Nelson wrote:

On 25-Jul-2016 15:45 -0500, Darryl Freinkel wrote:

We have a need to grant the help desk the authority to reset and/or
change user's passwords. We have written code to prompt the profile
name and then after doing some validation (not QSECOFR...) the
program resets the user ID.

The CL program is owned by QSECOFR.

A help desk user, say PETER1, has access to the program via a menu
option. He runs the program and it aborts with a CPF2217 - not
authorized to the user profile.

What are we missing here?

I have not done this for many years and my understanding was that
if the program was owned by QSECOFR or a profile of *SECOFR class,
the program should execute as if the program was being run by
QSECOFR.

So why is it aborting?

What am I missing?

Prompt the CRTCLPGM command and look at the help text for the user
and replace program parameters.

That would be the User Profile (USRPRF) and Replace Program (REPLACE) parameters.

I suspect somebody forgot to delete the program before recompiling
it.

And if the issue did originate per both no prior request to Delete Program (DLTPGM) and an existing program had been replaced, the Create CL Program (CRTCLPGM) request logged a msg CPI2119 "AUT and USRPRF parameter values were ignored." and msg CPI2121 "Replaced object &1 type *&4 was moved to &5." to inform of the effect.

Rather than deleting [or moving or renaming] the existing program and then re-creating anew the program, just to establish the desired user name for adopted authority, the correction of the adoption is possible with use of Change Program (CHGPGM) which also [like the CRTCLPMG] provides a User Profile (USRPRF) parameter. That would be available as corrective, irrespective the origin; even if perhaps the original CRTCLPGM had defaulted or explicitly effected USRPRF(*USER) or the program lost adoption per effects of a restore. And that the program is not first deleted with the CHGPGM as corrective action, the existing public authority and private authority to the object are maintained; assuming those are correct, which apparently is the case, as PETER1 as a help-desk user has authority -- presumably other than from *PUBLIC, and more likely from the *GROUP that defines the help-desk personnel.

CHGPGM The_Pgm USRPRF(*OWNER)