User Profiles, Groups and JOBD's

[MelissaG]

The security in our application has gotten so complicated over the past 20 years that I'm trying to help the Security and Compliance team clean it up. However, I'm a developer, not a security person! I've tried to research how the security in a profile works, but haven't been able to retain the hierarchy regarding user profiles and groups.

If anyone knows of a place (pref. online) where basic security is explained in plain English, I would appreciate the assist!

In the following examples, where would the user's library list come from? My answers are included so you can just say "RIGHT" or "WRONG, you idiot" if you prefer

Example 1
USER ID = GEORGE1
USER CLASS = *USER
INITIAL PROGRAM = *NONE
INITIAL MENU = *SIGNOFF
GROUP PROFILE = GROUP1
JOBD = QDFTJOBD

GROUP = GROUP1
USER CLASS = *USER
INITIAL UPROGRAM = *NONE
INITIAL MENU = *SIGNOFF
GROUP PROFILE = *NONE
JOBD = QDFTJOBD

Uh-oh, this user doesn't have the program and data libraries!


Example 2
USER ID = GEORGE2
USER CLASS = *USER
INITIAL PROGRAM = *NONE
INITIAL MENU = *SIGNOFF
GROUP PROFILE = GROUP2
JOBD = QDFTJOBD

GROUP = GROUP2
USER CLASS = *USER
INITIAL UPROGRAM = *NONE
INITIAL MENU = *SIGNOFF
GROUP PROFILE = *NONE
JOBD = MYJOBD (where the library list is defined)

This user's library list comes from the GROUP.


Example 2
USER ID = GEORGE3
USER CLASS = *USER
INITIAL PROGRAM = *NONE
INITIAL MENU = *SIGNOFF
GROUP PROFILE = GROUP3
JOBD = MYJOBD (where the library list is defined)

GROUP = GROUP3
USER CLASS = *USER
INITIAL UPROGRAM = *NONE
INITIAL MENU = *SIGNOFF
GROUP PROFILE = *NONE
JOBD = ANOTHERJOBD (where a different library list is defined)

This user's library list also comes from the GROUP, so they don't get the libraries that they need


For everyone who celebrates, Happy Thanksgiving - stay safe!

[jtaylor___]

The system verifies a user's authority to an object in the following order:

• Object's authority - fast path
• User's *ALLOBJ special authority
• User's specific authority to the object
• User's authority on the authorization list securing the object
• Groups' *ALLOBJ special authority
• Groups' authority to the object
• Groups' authority on the authorization list securing the object
• Public authority specified for the object or for the authorization list securing the object
• Program owner's authority, if adopted authority is used

https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_74/rzarl/rzarlchkaut.htm

[Brian Rusch]

Setting the library list for a job is a different thing than object security. The library list comes from the job description defined in the users profile, group profiles don't come into play for library lists unlike object security.