mcl Apr 8, 2009   6:59 PM GMT

For a group profile, make sure you specify *NONE for the User Password - especially if you want to manage the profiles through iSeries Navigator. For any users that are part of the group, in addition to changing the "Group Profile" value, you may also want to change the "Owner" value to *GRPPRF. Regards Mike

2,740 pointsBadges:

TomLiotta Nov 4, 2009   3:51 AM GMT

AFAIK, there is no reason to set password *NONE for a group profile, except of course if that profile is one that you don't want signing on for some reason. A group profile has no significant extra authority. By definition, members of a group have the authority of the group. So signing on as a member is practically equivalent to signing on as the group profile itself. Tom

125,585 pointsBadges:

Teandy Nov 4, 2009   5:07 PM GMT

In our environment we have multiple divisions, each with their own data libraries. We use group profiles to secure the libraries so that one division can not get into other divisions data. As an extra security measure we set the password for these profiles to *NONE.

5,860 pointsBadges:

Dsfdsfjsfkfds Oct 19, 2011   2:25 AM GMT

Hi , Can any one give me clear steps to how to create a new group profile and how to add this group to userprofiles?

10 pointsBadges:

TomLiotta Oct 19, 2011   3:13 AM GMT

Can any one give me clear steps to how to create a new group profile and how to add this group to userprofiles? A group profile is created like any other user profile, with the CRTUSRPRF command. You then change each user profile that you want to be a member of that group by running the CHGUSRPRF command against the member profile; use the GRPPRF() parameter to set the group you want the user to join. If that user is already the member of a group, you make the user also be a member of other groups by using the SUPGRPPRF() parameter. For example, you might have four user profiles in your system -- USER1, USER2, USER3 and USER4. You want to put those users into two groups, so you create two new user profiles named possibly GRP1 and GRP2.

CRTUSRPRF USRPRF(GRP1) SPCAUT(*JOBCTL)
CRTUSRPRF USRPRF(GRP2) SPCAUT(*SPLCTL)

Now, add USER1 and USER2 to GRP1 and add USER3 and USER4 to GRP2:

CHGUSRPRF USRPRF(USER1) GRPPRF(GRP1)
CHGUSRPRF USRPRF(USER2) GRPPRF(GRP1)
CHGUSRPRF USRPRF(USER3) GRPPRF(GRP2)
CHGUSRPRF USRPRF(USER4) GRPPRF(GRP2)

The GRP1 group now has two members -- USER1 and USER2. The GRP2 group has USER3 and USER4. That covers the most basic parts. However, because GRP1 was given *JOBCTL special authority, both USER1 and USER2 now can use that special authority. And GRP2 was given *SPLCTL, so USER3 and USER4 now have it. To make USER1 also be a member of GRP2:

CHGUSRPRF USRPRF(USER1) SUPGRPPRF(GRP2)

USER1 now has GRP1 as its group, but also has GRP2 as a "supplemental" group. USER1 now can use both *JOBCTL and *SPLCTL special authorities. When you create or change a profile that will be used as a group profile, only give authority to the group that you want every member of the group to have. This also goes for resource authority such as for files, programs, libraries or anything else. That's one of the major reasons for group profiles -- authorities only need to be given to one profile, and it becomes effective for every member. This helps when a new employee needs a profile. Create the user profile and assign the appropriate group. The new employee immediately has all authorities needed to work as a member of that group. When you change a user to be a member of a group, you should also decide how you want to set the OWNER(), GRPAUT() and GRPAUTTYP() parameters for members. If a member creates a new object, should it belong to that member or should it automatically belong to the group? Should authority to any new object be made available to the group? By assigning ownership to the group, a member profile can be deleted without needing to handle any objects that the member created. But those parameters are up to you to decide over. That's the major elements. Details will always be up to the site that uses the profiles. Tom

125,585 pointsBadges:

Dave04002 Feb 27, 2018   7:49 PM GMT

Question on messaging. Will anyone assigned to the group profile receive a message if it is sent to the group profile?

10 pointsBadges:

ToddN2000 Feb 28, 2018   2:20 PM GMT

@dave04002: What type of message are you looking to send? I can't think of one iSeries message command that can be directed to a specific group. You may have to code a program to do that by looping through a list. You can probably build that list with a few command as well.

100,265 pointsBadges: