Re: User Profile handling in ancient release(s)

We do the same , I am not surprised. I confirm it is a great way of solving the problem by the way and it works well. 

Allen 



> On Sep 21, 2021, at 12:55 PM, Chris Hird <chrish-lbwoW8fqX/[email protected]> wrote:
> 
> The reason is security enforcement. You can use any user to sign onto the IBM I from a remote web request, swapping the profile to the person who signed on ensures that they only have rights that are afforded when signed directly onto the IBM i. Otherwise the profile the job is running under is used for authority and that can either be too little or too much. Profile swapping is very valid for this purpose. Plus it helps with password checking.
> 
> Yes you can switch profiles on other platforms (Linux is using the sudo or su command, Windows is by using the ability to use the admin user to run the request etc.)
> 
> Chris...
> 
> -----Original Message-----
> From: C400-L <[email protected]> On Behalf Of Richard Schoen
> Sent: September 21, 2021 1:06 PM
> To: [email protected]
> Subject: Re: [C400-L] User Profile handling in ancient release(s)
> 
> What's the reason for switching profiles ?
> 
> No other platform does this that I'm aware of. 
> 
> In general a daemon job or web server/service generally runs under a specific server/daemon user profile and then all work is done under that user. 
> 
> However on IBMi you can certainly authenticate via the user profile check API, I would not be switching user profiles. 
> 
> Unless you have a specific reason to do so. 
> 
> I did this with a product several years back for recreating spool files with the right user and it forced us to store user/password combos in a table. Ugh.
> 
> Regards,
> Richard Schoen
> Web: http://www.richardschoen.net
> Email: richard-DiTrGpQEJGItADg8e/3/[email protected]
> 
> ----------------------------------------------------------------------
> 
> message: 1
> date: Mon, 20 Sep 2021 19:32:00 +0200
> from: Patrik Schindler <[email protected]>
> subject: [C400-L] User Profile handling in ancient release(s)
> 
> Hello,
> 
> lately I was following the blog of Cris Hird to learn about "daemon programming". He provides a great example with a main task (testsvr) spawning a worker task (worker) on request.
> 
> https://www.shieldadvanced.com/Blog/ibm-i/lets-c-integration-with-security/
> 
> For switching the user profile on the fly, he uses functions from qsyphandle.h. These functions aren't available on OS/400 V4R5.
> 
> POSIX setuid() doesn't work, because the function isn't referenced in sys/types.h, nor in unistd.h (as it's in Linux).
> 
> Does anybody remember how user switching was done two decades ago in OS/400?
> 
> :wq! PoC
> 
> 
> 
> --
> This is the Bare Metal Programming IBM i (AS/400 and iSeries) (C400-L) mailing list To post a message email: [email protected] To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/c400-l
> or email: [email protected] Before posting, please take a moment to review the archives at https://archive.midrange.com/c400-l.
> 
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com
> -- 
> This is the Bare Metal Programming IBM i (AS/400 and iSeries) (C400-L) mailing list
> To post a message email: [email protected]
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/c400-l
> or email: [email protected]
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/c400-l.
> 
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com

-- 
This is the Bare Metal Programming IBM i (AS/400 and iSeries) (C400-L) mailing list
To post a message email: [email protected]
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/c400-l
or email: [email protected]
Before posting, please take a moment to review the archives
at https://archive.midrange.com/c400-l.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com