Re: Object Security Problem

It was a DDS join logical (not sure I even know how to make one anymore), we
didn't realize that until I actually read the error message (you know that
users never give you the WHOLE message) and seen the problem. It is working
now that I gave *READ rights to the send file.

-- 
Mike Wills
Midrange Programmer/Analyst
http://whois.mikewills.name
http://www.linkedin.com/in/mikewills
-----Original Message-----
From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
[mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of Evan Harris
Sent: Wednesday, December 17, 2008 4:54 PM
To: 'Security Administration on the AS400 / iSeries'
Subject: Re: [Security400] Object Security Problem

Hi Mike

Not entirely sure it applies in your case but an interesting alternative
approach is described in here un der the section SQL VIEWS
:
http://www-03.ibm.com/servers/enable/site/education/wp/13aae/13aae.pdf

A snip of the SQL in the document is:

CREATE VIEW secureDept
(division ,deptname ,lname ,fname ,salary ) AS ( SELECT division, deptname,
lname, fname, protectsalary(deptno, salary) AS salary FROM staff a INNER
JOIN org b ON a.deptno = b.deptno WHERE division IN (SELECT division FROM
org c INNER JOIN staff d ON c.deptno = d.deptno WHERE usrprf = SESSION_USER)
)

The SESSION_USER value is the interesting thing - it allows you to create a
generic view where what the user sees is restricted by dynamically using
their user profile as part of the select statement; in effect a kind of
logical authorization rather than the resource security we are used to,
although it is obviously tied to the security implementation through the use
of the user profile specification.

I haven't had a need to even try this yet, but I think it's pretty
interesting (and kinda cool).

Regards
Evan Harris


-----Original Message-----
From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
[mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of Mike
Sent: Thursday, 18 December 2008 4:13 a.m.
To: Security Administration on the AS400 / iSeries
Subject: [Security400] Object Security Problem

We are creating a logical view of data for a user who needs access to only
data for their department. We are using an exit program with a switch user
to lock this person out of the main table. Normally we give this switch user
*READ access to the physical file and *USE access to the logical. This is
the first logical with a select in it. Do they need more access to the
physical file for a select? If so, what do they need?

--
Mike Wills

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400)
mailing list To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a
moment to review the archives at http://archive.midrange.com/security400.


_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.