AS/400 Authorization List
Home > IT Answers > AS/400 > AS/400 Authorization List
Qmaster
300 pts.
0
Q:
AS/400 Authorization List
AS/400 security
What is use of authorization list in as/400?
ASKED: Aug 14 2009  1:12 PM GMT
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
RELATED QUESTIONS
0
TomLiotta
8090 pts.
0
A:
 RATE THIS ANSWER
+1
Click to Vote:
  •   1
  •  0
  • AddThis Social Bookmark Button
You use Authorization Lists to group users together.
Then to control security you can grant/revoke authority to objects using the Authorization lists instead of individual User Profiles.

=======================================================

The purpose of an authorization list (*AUTL) is to provide a single object that can hold authorities for a list of users to a list of objects. Each user on the list may have different authorities specified. Authorities that are specified for a particular user are applied for that user against each object on the list.

A common usage is to combine *AUTLs with group profiles.

Assume library BUSINESS has files MASTER and NOTES. Officers of the company might have *ALL authority to everything. Managers might have *CHANGE authority. Sales people might have *USE authority only.

Three group profiles are OFFICER, MANAGER and SALES. Those three are added to the list with *ALL, *CHANGE and *USE associated with them. And MASTER and NOTES files would be assigned to the *AUTL with the EDTOBJAUT or GRTOBJAUT commands.

*PUBLIC should also be added to the *AUTL with *EXCLUDE authority. When that is done, the objects on the list should have *PUBLIC authority assigned as AUT( *AUTL ).

The BUSINESS *LIB object might also be assigned to the *AUTL like the objects in it.

With authorities assigned in that way, any new user can be authorized appropriately simply by making them members of the OFFICER, MANAGER or SALES group. Changing the group for a user will change authorities for everything on the *AUTL. Removing the group membership drops that user back to *PUBLIC authority. Changing the authority for any of the groups on the list change authorities for every member of that group for every object on the list in a single operation.

Authorities can be viewed and maintained for everything and everyone through the WRKAUTL command.

Note that this facility is intended for the basic authorization structure. It does not provide for specific details that could be needed for individual users against particular objects. Use *AUTLs for collecting similar authorities into a list. An object may be listed on only a single *AUTL. Users may be on any number of *AUTLs with different authorities.

Tom
Last Answered: Oct 16 2009  1:12 AM GMT by TomLiotta   8090 pts.
Latest Contributors: CharlieBrowne   6540 pts.
  •   
0
0
RSS - Discussions Help
Discuss This Answer:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _



_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

DiegoDH   275 pts.  |   Aug 14 2009  1:26PM GMT

However, you also group users together via “groups”. ;)

 

Qmaster   300 pts.  |   Aug 14 2009  1:40PM GMT

so, Authorization lists are more or like Group Profiles.????

 

4819   235 pts.  |   Aug 14 2009  1:49PM GMT

Hi,

Let me clearify this with an example.
Let’s say the bookkeeping department of a company will work during off office hours, the persons who will work are named into an authorization list, which is known by the system.

So everybody whose name is specified in that authorization list, can sign in without being rejected by the system.

You get it now?

Bye

 

Herbina   275 pts.  |   Aug 17 2009  6:22PM GMT

Let me add on…..

In group profiles, all the members of the group get the same authority for a particular object.

In Authorization list, different users get different authorities for different objects.

 

Pdraebel   885 pts.  |   Aug 18 2009  7:34AM GMT

The main advantage of Authorisation Lists in securing Objects is that you do not need a lock on the objects when you want to change the access rights of a user to the objects in the list.

First you will have to see how you divide your objects over the authorisation lists (sort of making security areas). Adding objects to authorisation lists will require an exclusive lock on the objects, but once this has been done you can easily change access rights without the need of having to obtain a lock on the objects.

 

Qmaster   300 pts.  |   Aug 18 2009  2:34PM GMT

Thanks to one and all!!!!!

 

RVP400   250 pts.  |   Oct 16 2009  4:02PM GMT

Hi,

You might find this article interesting:

 <a href="http://www.mcpressonline.com/tips-techniques/security/techtip-managing-authorization-lists-101-part-i.html" title="http://www.mcpressonline.com/tips-techniques/security/techtip-managing-authorization-lists-101-part-i.html" target="_blank">http://www.mcpressonline.com/tips-techni…</a>

Rgds,
RVP

 
0