Darryl:
From my perspective this is the correct approach.
What I don't understand is why you grant authority to a group profile? If
that's the same profile that owns the objects, then it does not need
explicit authority. With adopted authority you won't need additional group
profiles. In fact the owner does not need to be a group profile at all,
just an owner.
I have several customers that have implemented exactly what you are
proposing. The only catch came with submitted jobs, when adopted authority
was needed for those jobs to run. We had a bit of tinkering to do in order
to get past that.
The security guide on the information center is OK, and I've not seen a
Redbook updates since V6R1. There is a Redbook on Row/Column security but
that does not really apply to your use case.
--
Jim Oberholtzer
Agile Technology Architects
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of a4g
atl
Sent: Friday, October 05, 2018 9:08 AM
To: midrange-l@xxxxxxxxxxxx
Subject: Use of adopted profiles
Is there a document that describes how the adopted authority works and maybe
best practices? I am reviewing a project to lock the system down and it has
been a long time since I last set up a highly secure system.
My plan is to
- revoke all authorities from user libraries, objects and the IFS.
- Grant authority to a group profile.
- The group profile will own all objects.
- Users will have none or limited authority directly.
- When users signon to the menu, the menu program will grant authority
whilst using the job. When they sign off, they will have no authority.
Objective:
- Prevent unauthorized access to the system
- There are users on multiple systems accessing this system and its wide
open. - Plan to grant authority to objects only where required example read
rights to file where a remote system needs to access files to retrieve data
and so on.
The same will apply to the IFS.
What are the best practices today? I know some folk don't like this approach
but it is one of the cleanest and easiest approaches to implement and
maintain.
TIA
Darryl Freinkel
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
http://amzn.to/2dEadiD
midrange.com
