Outq Security
I have a user that wants his staff to be able to view reports in a special outq but no delete access. Several reports in this queue are his staff's reports. What settings are required so a user cannot delete their own (or anyone else's) report in a specific outq and have read only rights? None of my users have *SPLCTL authority.
Thanks in advance,
Kim
Software/Hardware used:
Software/Hardware used:
ASKED:
October 19, 2005 4:43 PM
UPDATED:
November 6, 2010 3:33 PM
Answer Wiki:
Yes, it is possible. To give someone read only access to spool files on a given outq, do the following:-
A) Change the DSPDTA parameter on the outq (wrkoutqd F13)to *YES
B) Change the relevant user authority to the outq (EDTOBJAUT) to READ only.
To see all answers submitted to the Answer Wiki: View Answer History.
You can’t stop users from deleting their own spooled files (even if they only have *READ authority to the *OUTQ). Especially if they have ways of viewing them through system interfaces.
If ALL access is through program control — no WRKJOB, no WRKSPLF, etc. — then as long as the program doesn’t surface a DLTSPLF command and as long as there is no network access via iNav, etc., it can be done. In that case, of course, it doesn’t matter what the authorities or attributes of the *OUTQ are.
Tom
As Tom said, you can not stop people from deleting their own spool files. What may be an option is to have the reports run under a special profile that you create for this purpose. That way the spool file no longer belongs to the user and they can not delete it.
I came across this while researching this question:
http://forums.systeminetwork.com/isnetforums/showthread.php?t=50185
You may want to give it a try.
Yes, use the DUPSPLF command in the application to create a copy with under a different User and then use DLTSPLF to get rid of the orignal, and then with the proper security settings on the output queue users will only be able to read the spool files. The solved a HUGE problem for us when users would delete spool files used to print invoices.
…use the DUPSPLF command in the application to create a copy with under a different User…
A DUPSPLF isn’t required. If current-user is set to some application profile when the spooled file is created, it will already belong to another user. No need to duplicate/delete.
Tom
This may be overkill for your needs, but so others are aware (who may read this thread looking for spool file security access) 7.1 introduced a Spool File Security exit point documented here. This provides for very granular access to spooled reports on your system. Again this might be way more than you were asking for…
Bruce