qmaster Jul 9, 2010   9:07 AM GMT

hey Jinteik, i don't know in what way it violates system security....(changing their own password) do we need *secadm authority,by giving this user will get few more authorities..which is not good. i have to give only password change option to the user? any inputs pls

1,675 pointsBadges:

Adamwkiuk2002 Jul 9, 2010   1:20 PM GMT

I would have thought all you need was authority to the CHGPWD command

215 pointsBadges:

TomLiotta Jul 9, 2010   7:36 PM GMT

I suspect that it isn't the authority to change passwords that is the problem. The problem is that users don't have access to any of the "change password" options. For example, they might not have access to a command line. Or if they do, they don't have capability to run GO USER or CHGPWD. (I have no idea why anyone would be so restrictive, but it's common enough. Usually there are no reasons behind it. Well, technically, the reason is usually because security was improperly assigned in the past; so the resolution was to lock all users out of everything.) Allowing access either the the USER menu or the CHGPWD command should be sufficient. The question becomes how to do that, and the answer depends on why users can't do it now. Tom

125,585 pointsBadges:

qmaster Jul 10, 2010   5:48 AM GMT

I'm not sure which one is blocking....then what authority will give access to the users to change their password.

1,675 pointsBadges:

TomLiotta Jul 11, 2010   9:36 PM GMT

I’m not sure which one is blocking…

1. Can users access command lines?
2. If they can, can they run the CHGPWD command?
3. IF CHGPWD fails, what is the message ID that results from the error?
4. If CHGPWD fails, can they run the GO USER command?
5. If GO USER fails, what is the message ID that results from the error?

When we have an answer to some of those questions, we might know enough to answer your questions. Tom

125,585 pointsBadges:

TomLiotta Jul 21, 2010   1:40 AM GMT

what authority will give access to the users to change their password. They should all already have that authority. If they don't, then someone removed some authority. You will have to tell us what authority was removed. You can do that by trying to answer the questions that have been asked. Also, it might not be an authority problem. It might be a capability problem. Maybe all you need to do is set ALWLMTUSR( *YES ) on the CHGPWD command. Tom

125,585 pointsBadges:

A5 Jul 22, 2010   5:33 AM GMT

pls check ypur password policy & the system values set on your server.

50 pointsBadges: