Re: Questions on USING ADOPTED AUTHORITY

[Charles Wilt <charles.wilt@xxxxxxxxx>]

Forgot a case...

PGMA USEADPAUT() USRPRF(*OWNER)  - runs under PGMA OWNER + user authority
PGMB USEADPAUT(*NO) USRPRF(*OWNER)  - runs under PGMB OWNER + user authority

Charles

On Wed, Jan 25, 2017 at 9:28 AM, Charles Wilt <charles.wilt@xxxxxxxxx>
wrote:

> Use adopted authority  (USEADPAUT) is poorly named.
>
> It doesn't control rather or not a program adopts authority.  Rather, it
> controls rather or not a program will make use of authority adopted by a
> prior program in the call stack.
>
> User profile (USRPRF) controls rather or not a program adopts authority.
>
> USRPRF(*OWNER) means the program adopts it's owners authority.
> USRPRF(*USER) means the program runs under the users authority.
>
>
> I suppose one could argue that USEADPAUT is technically a perfect name and
> the USRPRF is the poorly name parm.  :)
>
> Given PGMA calling PGMB...
>
> PGMA USEADPAUT() USRPRF(*USER)  - runs under user authority
> PGMB USEADPAUT() USRPRF(*USER)  - runs under user authority
>
> PGMA USEADPAUT() USRPRF(*OWNER)  - runs under PGMA OWNER + user authority
> PGMB USEADPAUT(*NO) USRPRF(*USER)  - runs under user authority
>
> PGMA USEADPAUT() USRPRF(*OWNER)  - runs under PGMA OWNER + user authority
> PGMB USEADPAUT(*YES) USRPRF(*USER)  - runs under PGMA OWNER + user
> authority
>
> PGMA USEADPAUT() USRPRF(*OWNER)  - runs under PGMA OWNER + user authority
> PGMB USEADPAUT(*YES) USRPRF(*OWNER)  - runs under PGMA OWNER + PGMB OWNER
> + user authority
>
> Note that USEADPAUT for PGMA has no effect as it's the first program in
> the call stack, there's nothing earlier which could have adopted authority
> for it to use.
>
>
> Charles
>
>
> On Wed, Jan 25, 2017 at 8:51 AM, a4g atl <a4ginatl2@xxxxxxxxx> wrote:
>
> > I am locking down a system to READ only rights.
> >
> > Unfortunately the guys before me gave all users *ALLOBJ and assigned USE
> > ADOPTED AUTHORITY to all programs. Now I am rusty on this topic as its
> > been
> > years since I last needed this.
> >
> > I have changed the authority on all objects, revoking and re-granting *USE
> > rights to all objects that the system would allow me to change.
> >
> > I created a new user ID with limited user rights getting its authority
> > from
> > a new group profile that also only has *USE, *JOBCTL and *SPLCTL rights.
> >
> > Problems:
> >
> > 1. There are about 5 programs that I do not have source for (Vendor
> > restriction) that have use adopted authority and the system will not
> > permit
> > me to change that to *NO. I am *SECOFR. These programs are part of the
> > logon process which I do not want to re-write.
> >
> > 2. Something is allowing the files to be updated even though we only have
> > *USE rights.
> >
> > Questions:
> > 1. does the use of adopted authority apply only to the object that is
> > being
> > executed or does it apply to all programs and objects used in the stack?
> > 2. if yes, is there a way to turn it "off"?
> >
> > TIA
> >
> > Darryl Freinkel
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
> >
> > Please contact support@xxxxxxxxxxxx for any subscription related
> > questions.
> >
> > Help support midrange.com by shopping at amazon.com with our affiliate
> > link: http://amzn.to/2dEadiD