Getting Past *ALLOBJ Authority

Hey, Ted:

As you know, a user who is granted *ALLOBJ authority has access to all objects in the system.

How can I exclude the access to an object for those users?

-- Sam

There is no foolproof way to keep a user with *ALLOBJ authority from accessing an object.

Sam, here is one method that works in certain situations.

Do not grant *ALLOBJ authority directly to the user.

Instead, grant *ALLOBJ authority to a group profile.

CRTUSRPRF USRPRF(somegroup) SPCAUT(*ALLOBJ)

Make the user part of the group.

CHGUSRPRF USRPRF(someuser) GRPPRF(somegroup)

Revoke the user's authority to access the object.

GRTOBJAUT OBJ(mylib) OBJTYPE(*FILE) +
   USER(someuser) AUT(*EXCLUDE)

The individual authorities of a user profile take precedence over group authorities, so the user is forbidden to access the object.

However, be aware that a skilled user with access to a command line can regain the authority you took away from their profile by submitting a batch job under the group profile.

I recommend that you audit access to the objects that you are trying to protect.

-- Ted