A group profile is created like any other user profile, with the CRTUSRPRF command. You then change each user profile that you want to be a member of that group by running the CHGUSRPRF command against the member profile; use the GRPPRF() parameter to set the group you want the user to join. If that user is already the member of a group, you make the user also be a member of other groups by using the SUPGRPPRF() parameter.

For example, you might have four user profiles in your system — USER1, USER2, USER3 and USER4. You want to put those users into two groups, so you create two new user profiles named possibly GRP1 and GRP2.

CRTUSRPRF USRPRF(GRP1) SPCAUT(*JOBCTL)
CRTUSRPRF USRPRF(GRP2) SPCAUT(*SPLCTL)

Now, add USER1 and USER2 to GRP1 and add USER3 and USER4 to GRP2:

CHGUSRPRF USRPRF(USER1) GRPPRF(GRP1)
CHGUSRPRF USRPRF(USER2) GRPPRF(GRP1)
CHGUSRPRF USRPRF(USER3) GRPPRF(GRP2)
CHGUSRPRF USRPRF(USER4) GRPPRF(GRP2)

The GRP1 group now has two members — USER1 and USER2. The GRP2 group has USER3 and USER4. That covers the most basic parts.

However, because GRP1 was given *JOBCTL special authority, both USER1 and USER2 now can use that special authority. And GRP2 was given *SPLCTL, so USER3 and USER4 now have it.

To make USER1 also be a member of GRP2:

CHGUSRPRF USRPRF(USER1) SUPGRPPRF(GRP2)

USER1 now has GRP1 as its group, but also has GRP2 as a “supplemental” group. USER1 now can use both *JOBCTL and *SPLCTL special authorities.

When you create or change a profile that will be used as a group profile, only give authority to the group that you want every member of the group to have. This also goes for resource authority such as for files, programs, libraries or anything else. That’s one of the major reasons for group profiles — authorities only need to be given to one profile, and it becomes effective for every member.

This helps when a new employee needs a profile. Create the user profile and assign the appropriate group. The new employee immediately has all authorities needed to work as a member of that group.

When you change a user to be a member of a group, you should also decide how you want to set the OWNER(), GRPAUT() and GRPAUTTYP() parameters for members. If a member creates a new object, should it belong to that member or should it automatically belong to the group? Should authority to any new object be made available to the group? By assigning ownership to the group, a member profile can be deleted without needing to handle any objects that the member created. But those parameters are up to you to decide over.

That’s the major elements. Details will always be up to the site that uses the profiles.

Tom

Can any one give me clear steps to how to create a new group profile and how to add this group to userprofiles?

Tom

For any users that are part of the group, in addition to changing the “Group Profile” value, you may also want to change the “Owner” value to *GRPPRF.

Regards
Mike