|
Yes, there are some things about *ALLOBJ special authority that you need to be aware of. While you may not consider looking at an *ALLOBJ joblog to be a problem, others do. Users with *ALLOBJ may have created profiles or other objects that you don't want just anyone knowing about, for example. If not being able to view the joblog of an *ALLOBJ user is an issue, you may want to consider writing a CL command that displays job logs and have the CL program be owned by and adopt the authority of a user with *ALLOBJ. Then authorize your operators to this program.
The issue with users that have *SECADM not being able to manage user profiles is not because the profiles were created by an *ALLOBJ user. It's because the *SECADM users don't have authority to the profiles. You must have *USE and *SECADM to change a profile.
These "exceptions" are all documented or noted in Appendix D of the iSeries Security Reference manual, available as a .PDF from the IBM Information Center
==================================
MORE INFORMATION ON THIS TOPIC
==================================
The Best Web Links: tips, tutorials and more.
Search400's targeted search engine: Get relevant information on security.
Ask your systems management questions--or help out your peers by answering them--in our live discussion forums.
Check out this Search400.com Featured Topic: Top ten security tips
|
