iseries user account reset using vbscript or an api

[passinsd517]

I am attempting to develop and program preferably with vb to allow our helpdesk to reset disabled iseries user accounts without having user interface access to the company as400.

Can anyone point me in the right direction?

[jamief]

Re: iseries user account reset using vbscript or an api

bump bump bump

[bryce4president]

Re: iseries user account reset using vbscript or an api

You could make a web app to do it pretty easily Give them a text box to enter the username, make sure the user exists and that they are disabled, then use sql to do an update.

Thats how I would do it for the help desk people. Do you have an intranet set up?

[Mercury]

Re: iseries user account reset using vbscript or an api

Yes, I share Bryce's opinion : try CGIDEV2.

[jamief]

Re: iseries user account reset using vbscript or an api

you could on the green screen side dump the dsplog (QHST) into a file then load all
disabled to a iseries table.

DSPLOG PERIOD((*AVAIL *BEGIN)) OUTPUT(*PRINT) MSGID(CPF1393) 

load all the disabled profiles on a pretty web interface, when help desk clicks
on desired profile - use sql to update the file (delete) then the trigger
you added to that file........calls a program on the green screen side
that enables that profile.

[bryce4president]

Re: iseries user account reset using vbscript or an api

Jamie,
is the enabled/disabled value kept in more than one place?

If not then why not just directly update the file using sql, then no triggers = less work. Am I right? or am I missing something?

[jamief]

Re: iseries user account reset using vbscript or an api

its part of the change user profile command .......not in any table you
have access to...

CHGUSRPRF I dont know of anyway to access this without using the command.


jamie

[Mercury]

Re: iseries user account reset using vbscript or an api

CHGUSRPRF I dont know of anyway to access this without using the command.

API maybe ?

[bryce4president]

Re: iseries user account reset using vbscript or an api

well if that is the only way to change it then couldn't you just pass the right value to a CL program that does the CHGUSRPRF USRPRF(MYPROFILE) STATUS(*ENABLED)?

[gcraill]

Re: iseries user account reset using vbscript or an api

you could on the green screen side dump the dsplog (QHST) into a file then load all
disabled to a iseries table.

DSPLOG PERIOD((*AVAIL *BEGIN)) OUTPUT(*PRINT) MSGID(CPF1393) 

load all the disabled profiles on a pretty web interface, when help desk clicks
on desired profile - use sql to update the file (delete) then the trigger
you added to that file........calls a program on the green screen side
that enables that profile.

I'm paranoid, I'd change a counter on the record in your file Jamie to say it's now re-enabled 1 time instead of 0 times. That way you can set a limit to how many times a userid gets re-enabled without manual intervention from the security dept.

Also maybe the function not to allow the re-enablement of higher profiles (*ALLOBJ, *SECOFR, *SECADM etc).

The chances that helpdesk could misuse a enable function are minimal, but you know security types, never too many safeguards.

GC

[bryce4president]

Re: iseries user account reset using vbscript or an api

You could populate a combo box and then the help desk person would only be able to choose from a list populated by the IT dept. By not giving the user too many options you greatly reduce the room for error. Don't let them type anything. Force them to pick what YOU deem valid. If you don't inactivate or delete a profile that is no longer in use and you populate with higher profiles then its the programmer's fault and not the helpdesk people.

[gcraill]

Re: iseries user account reset using vbscript or an api

You could populate a combo box and then the help desk person would only be able to choose from a list populated by the IT dept. By not giving the user too many options you greatly reduce the room for error. Don't let them type anything. Force them to pick what YOU deem valid. If you don't inactivate or delete a profile that is no longer in use and you populate with higher profiles then its the programmer's fault and not the helpdesk people.

Yep - Bryce is on the money here, do the validation up front and only supply the allowed options. And of course log all uses to a log file/report for security heads . . .

GC