Granting OS/400 users special authorities

I remember the old VAX/VMS operating system that allowed us to give an individual certain "types" of security -- for instance, the authority to work with and to manage job queues. VMS had predefined authority items and associated them with their corresponding operating system command. In the example, the user would be able to issue any job queue command if they had the "job queue type" of authority granted to their user ID.

Is there a similar way on OS/400 that we can grant specific security options to a person or group that allows only them the authority to fully manage a specific type of task?

We would define different areas that need security, such as job queues, working with all FTP functions, working with WebSphere jobs, etc.

Right now, we just depend on the person having security officer authority and that is always difficult to maintain for several users.

In OS/400 there's the concept of special authorities that gives the user (or group) the ability to perform some function, such as *JOBCTL which gives the user authority to manage other users' jobs. However, the special authorities are predefined and you cannot create your own or customize the existing ones. There is also the concept of a group profile. Make users members of the group profile and give the group authority to access objects (files or libraries) and assign the group capabilities, and all of the members "inherit" the authority and capabilities from the group. This is how role-based access is implemented in OS/400. Define the roles, create a group for each role and based on the tasks the role must perform, grant the group the appropriate authorities and capabilities required for the tasks.

Finally there is the concept of an authorization list that allows you to quickly and easily manage a set of objects that all need the same authority.

For more details on these concepts you can check the iSeries Security Reference manual available as a .PDF from the IBM Information Center. The concepts are also explained and practical examples given in my book, Experts' Guide to OS/400 and i5/OS Security.

==================================
MORE INFORMATION ON THIS TOPIC
==================================

The Best Web Links: tips, tutorials and more.

Search400's targeted search engine: Get relevant information on security.

Ask your systems management questions--or help out your peers by answering them--in our live discussion forums.

Check out this Search400.com Featured Topic: Top ten security tips

Visit the ITKnowledge Exchange and get answers to your security questions fast.

This was first published in February 2005

Back to top