Creating a group profile??

[twiggins]

I know this doesn't exactly belong in this section but can someone tell me how when I create a group profile the system knows it's a group and not a user profile? thanks

[jamief]

Re: Creating a group profile??

Any old profile can be a group profile...just make the inital program to call on the profile *SIGNOFF

then on other profiles use the above mentioned profile as the group profile.

i found this article

Administering security on your iSeries system can be a daunting challenge. 
If you're a small shop with just a dozen users and one or two critical 
applications, then it is a manageable task. But if you're in a large 
shop with hundreds (or thousands) of user profiles, managing the 
security considerations can quickly become a mind boggling task. 
Fortunately, for those of us in this position, OS/400 includes some 
very nice tools that let you group your users together in homogeneous 
work related groups. Using this approach, each user can be classified 
according to the type of work they do and assigned to a group. Then, 
all you need to do is manage the group and not each and every 
individual user. 

To implement this, OS/400 provides the Group Profile and Supplemental Group
 Profile parameters on the user profile setup. The Group Profile is the user's
 primary group that their work will be associated with. The Supplemental Group
 Profile lets you also associate the user with up to 15 additional groups other
 than the primary group. 

Once the user's profile is set up this way, you no longer have to manage their
 individual user profile for granting security permission to use resources on your
 system. All you need to do then is manage the group profile setup. If you have
 100 users on your system, but they can be broken down into five work groups,
 then all you need to worry about are the five group profiles. As you can see, 
this will greatly simplify the work needed for security administration.

 

To implement group profiles, you should first design your groups. You should 
take into account the type of work performed and the software applications 
that will be used by users in each group. Remember that you can also use
 Supplemental Group Profiles if there are gray areas where this will help you
 subdivide application controls.


Supplemental Group Profiles can also be used for those users, such a 
supervisors, who need access to multiple group resources on your system.
 
Note: You cannot implement Supplemental Group Profiles without first 
assigning a primary Group Profile to a user.

Once you have your groups designed, then go ahead and create a user 
profile for each group. Since these profiles will not actually be logging on, 
you can set the profiles up with the password set to the special value 
of *NONE. This way, users cannot sign on using the group profile itself. 
I recommend that you create new profiles for groups and not use any 
existing groups, especially the IBM supplied Qxxxx profiles.

With these Group Profiles created, you can now work on assigning your 
existing users to their respective groups. This is done from the 
WRKUSRPRF command or you can perform the updated individually 
using the CHGUSRPRF command and setting the GRPPRF parameter 
for the primary group and the SUPGRPPRF parameter for any supplemental 
groups that you want to use. 

Last, but definitely not least, you will have to update your object 
security to reference the new group profiles rather than individual 
profiles. When this is all setup, the only complication will be properly 
grouping new users as they are added to your system. 
The setup can be complex, but the rewards in reduced security 
administration will be big.

[LAPO]

Re: Creating a group profile??

To Create A Group Profile Password = *none