Library / Object security

[warrawong]

Hi All,

Currently have an issue with a profile attached to a Group Profile that has a high level of authority ( *ALLOBJ, *JOBCTL, *SAVSYS, *SPLCTL ) which over the past 20 years of being in use has been abused by various apps and hard coded in programs due to its known password. Yep don't start me on that !!

Anyhow i'm now trying to unravel it all and in becoming public enemy No.1 to all the Applications Team & programmers etc ( plan to either remove this profile altogether or at least change its password) getting all their code changed over to use a vanilla user profile with base access.
User class . . . . . . . . . . . *USER
Initial program to call . . . . *NONE
Initial menu . . . . . . . . . . *SIGNOFF
Limit capabilities . . . . . . . *YES
Special authority . . . . . . . *NONE

The issue i am fronted with now is that of object/library authority as we have various object/libraries that have *PUBLIC exclude authority. Rather than granting authority access to each lib/object is there a better "standard" approach i should be taking.

Appreciate your help/comments/assistance

Cheers,
Warrawong

[Brian Rusch]

One of the things you can do is to use authorization lists. Create an authorization list, point the library/objects to the authorization list [GRTOBJAUT OBJ(libname/*ALL) OBJTYPE(*ALL) AUTL(name)], and authorize users to the authorization list.

[john.sev99]

There are many way of doing this depending on the situation.
As Brian has mentioned, an authorisation list might be a good way to do this.
Another way would be to create a group profile and grant it authority to your objects. Then any users that need access to those objects can have the group profile added. This approach can give role based access.
Another option is you could grant also the user ID access to the required objects.
And yet another option might be for the programs to use adopted authority. It would have to adopt the authority of a profile that has access to your objects in some way (via ownership/private authority/*allobj etc).