User profiles
How can a person without *ALLOBJ authority display ALL user profiles?
Thanks
Software/Hardware used:
Software/Hardware used:
ASKED:
June 24, 2008 12:15 PM
UPDATED:
November 3, 2009 11:18 PM
Answer Wiki:
Hi,
If the user has *SECADM authority and has the right to the user profiles (for example someone has used GRTOBJAUT to give permission to all the user profiles), then the user should be able to display all the user profiles.
If you want something to allow this, you could create a small CL program to do a WRKUSRPRF *ALL or DSPUSRPRF *ALL, change the program with USRPRF(*OWNER) and change the owner of the program to be a user profile with *ALLOBJ and *SECADM. This should allow your user to display or work with all user profiles.
Regards,
Martin Gilbert.
To see all answers submitted to the Answer Wiki: View Answer History.
If you go the “small CL program” route, just make sure the user that needs to use it has authority to it as well.
Realistically, all the user profiles should be “owned” by one account. If that account is a group account, then makeing your SECADM user part of that group will give him access to the user accounts.
Regards
Mike
The OP asked how a person without *ALLOBJ could view all profiles. *SECADM authority has nothing to do with this. I guess this has been brought up on the assumption that the original question would be for people who need to modify/create profiles.
My preference would be a program that adopts authority. There are 2 ways this could be done.
1. Have all profiles owned by a particular profile. The program would then adopt the authority of this profile.
2. Have the program adopt the authority of an *ALLOBJ profile. You could create a profile e.g. ADPALLOBJ that could be used for this purpose.
I don’t agree with Mikes approach as this creates an inherent security exposure in that these users would be able to submit a job under any one of these user profiles.
I wonder why the OP wants to be able to display a list of user profiles in the first place. In my experience there’s a reason for not having the authority to do something and usually a request to the administrator is enough to get the access.
Other than a Helpdesk user resetting profiles/passwords or an application validating against user profiles names I can’t think of any reason why an unauthorised user would need to view a list of user profiles (well, I can, but it would involve breaching security).
Have all profiles owned by a particular profile.
This, of course, would be very difficult to implement. Who will own QSYS? …QSECOFR? …profiles created by 3rd-party products that are engineered to act as owners?
Tom