iSeries object-level security question
This iSeries user is trying to augment his object-level security with exit programs. He's working on one now to control ODBC using the QIBM_QZDA_SQL2 exit point. His question is: What is the proper authority for an exit program and its log file?
All of his users without *ALLOBJ, bypass his exit program. The job log for their QZDASOINIT jobs show many "Attempt to use permanent system object ExitLib without authority", where ExitLib is the library where his exit program is stored. The connections are being allowed.
Do you have any advice?
-- Michelle Davidson, editor, Search400.com
Software/Hardware used:
Software/Hardware used:
ASKED:
September 13, 2005 1:47 PM
UPDATED:
November 2, 2010 7:20 AM
Answer Wiki:
The library and the exit programs should have *PUBLIC *USE authority.
==========================================================
Be VERY careful when assigning exit programs, especially any exit programs that return Accept/Reject flags. If you return Reject, the server will not allow the transaction. If you return Accept, be SURE that you understand how the server will act upon the value -- some exit programs can cause servers to Accept a transaction even if this contradicts normally expected i5/OS object security, in some cases even if the user requesting the service does not exist.
Server exit programs can restrict or widen access capabilities. Test, and test, and test again. If PTFs are applied, or you do an upgrade, go through the entire test cycle again (ideally, <i>before</i> upgrading your production system).
<i>What is the proper authority for an exit program and its log file? </i>
As the joblog error directly implies, the program and library must have *PUBLIC *USE authority in order for the exit program even to be called. The program may be compiled as USRPRF(*OWNER) to allow the program to access any objects that it needs to do its work. Those objects may then be *PUBLIC *EXCLUDE as long as the program owner has sufficient authority to use the objects as needed.
Tom
To see all answers submitted to the Answer Wiki: View Answer History.
RSS - Discussions Help
Discuss This Question:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
