The Integrated File System for Intelligent People

February 9, 2005 Ted Holt

Recent e-mails from several faithful readers have reminded me that I should pay more attention to the fundamentals than I do. For that reason, I’ve delayed for one month the article that I was going to run this time and have instead written about the Integrated File System from the ground up. The IFS is too important to be ignored. Next month I will cover a more advanced topic that I hope many of you will find practical and of interest.

One of these recent e-mails was from a reader who thought that IFS was just a fancy name for

Limiting All-Object Authority

February 9, 2005 Hey, Wayne O.

Is there a way to minimize the access to a file that contains salaries, for the user profiles that have *ALLOBJ authority? Can we give them access to the object but not to the content (data)? Is our only option to audit these user profiles and the files containing the salaries?

–Marc-André

People frequently ask me how to block access to an object for users with *ALLOBJ special authority. When the system determines a user’s authority to an object, the first check made is whether the user has *ALLOBJ authority. If the answer is yes, the system allows the user

Running Query Without Adopted Authority

February 9, 2005 Hey, Ted

Because of the Sarbanes/Oxley Act, we are tightening our security. One problem we have is using AS/400 Query. Several of our menus include options that run the Work with Queries command. The problem is that a user who takes one of these options is running WRKQRY under adopted authority, and therefore has access to files that should from now on be secured. How can we change the WRKQRY command so that the user does not have adopted authority?

–Lin

You can’t change the command. You may be able to change the command-processing program, QSYS/QQUDA, but I don’t like to monkey