Re: Library Authority

   If possible, separate libraries for logical files should not be used 
to secure the data.  Doing so complicates save/restore and disaster 
recovery.  Instead of giving *USE to the PF, grant only *READ, and Then 
give only *USE to the LF.  Leave both the PF & LF in the same library. 
That accomplishes the same thing, without two libraries.

   Also the claim that more authority than the PF can not be given to 
the LF, is misleading.  As many rights may be granted as are available, 
i.e. up to *ALL.  The data rights from the LF however, can not override 
the PF data rights that are available to the user accessing the LF.

Regards, Chuck

Mike wrote:
> Jim Franz wrote:
>> 
>>  <<SNIP some of quoted text and reply>>
>> 
>> Mike wrote:
>>>
>>> Also, if we have *EXCLUDE on a library. Then we have a logical in
>>> another library pointing to a file within the secured library.
>>> Would that work? The file in the locked library would have READ
>>> access only.
>>> 
>> yes - (i've not tested this), note: data authorities on LF cannot
>> be more than on PF. (this one i was not positive till checking
>> Woodbury/Botz's Experts Guide book p164)
> 
> I did just try this one and it works.  I give the READ data authority
> only on the PF in one library with *EXCLUDE on the library, then give
> them *USE access on the logical on a separate library. Now we can
> control what live data they can access and what data within the file
> they can access.
> 
> I'll have to look into that book more.
_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.