Comments on: User profiles

By: tomliotta

tomliotta — Tue, 03 Nov 2009 23:18:44 +0000

Have all profiles owned by a particular profile.

This, of course, would be very difficult to implement. Who will own QSYS? …QSECOFR? …profiles created by 3rd-party products that are engineered to act as owners?

Tom

By: astradyne

astradyne — Mon, 04 Aug 2008 11:44:11 +0000

I wonder why the OP wants to be able to display a list of user profiles in the first place. In my experience there’s a reason for not having the authority to do something and usually a request to the administrator is enough to get the access.

Other than a Helpdesk user resetting profiles/passwords or an application validating against user profiles names I can’t think of any reason why an unauthorised user would need to view a list of user profiles (well, I can, but it would involve breaching security).

By: jsev

jsev — Tue, 01 Jul 2008 21:32:02 +0000

The OP asked how a person without *ALLOBJ could view all profiles. *SECADM authority has nothing to do with this. I guess this has been brought up on the assumption that the original question would be for people who need to modify/create profiles.

My preference would be a program that adopts authority. There are 2 ways this could be done.

1. Have all profiles owned by a particular profile. The program would then adopt the authority of this profile.
2. Have the program adopt the authority of an *ALLOBJ profile. You could create a profile e.g. ADPALLOBJ that could be used for this purpose.

I don’t agree with Mikes approach as this creates an inherent security exposure in that these users would be able to submit a job under any one of these user profiles.

By: mcl

mcl — Wed, 25 Jun 2008 18:29:39 +0000

If you go the “small CL program” route, just make sure the user that needs to use it has authority to it as well.

Realistically, all the user profiles should be “owned” by one account. If that account is a group account, then makeing your SECADM user part of that group will give him access to the user accounts.

Regards
Mike