If you're using one of the available exit point program software products they may already have this available.
https://www.fortra.com/products/intrusion-prevention-and-detection-software-ibm-i
https://www.precisely.com/resource-center/whitepapers/four-powerful-ways-to-use-exit-points-for-securing-ibm-i-access
https://seasoft.com/products/solutions-for-ibm-i/intrusion-detection-and-prevention/isecurity-firewall
------------------------------
Robert Berendt IBMChampion
------------------------------
Original Message:
Sent: Tue August 08, 2023 03:37 PM
From: Steven Riedmueller
Subject: IBM Idea: object-based authority collection for *USRPRF objects
Thanks a lot Robert, that's a great option and great idea! I'm not much of a developer but this would be exactly what I'd need if I were going to do this with an exit program.
------------------------------
Steven Riedmueller
Certified IBM i Admin
Speaker, Mentor, and Advocate
Original Message:
Sent: Tue August 08, 2023 03:25 PM
From: Robert Berendt
Subject: IBM Idea: object-based authority collection for *USRPRF objects
For an alternative see the following:
https://www.ibm.com/docs/en/i/7.5?topic=ssw_ibm_i_75/apis/xsbmjob.html
Job user
Submitted for job - qualified
I'm not faulting your idea, just giving you something to work with for now.
I've written a few exit point programs.
------------------------------
Robert Berendt IBMChampion
Original Message:
Sent: Tue August 08, 2023 01:34 PM
From: Steven Riedmueller
Subject: IBM Idea: object-based authority collection for *USRPRF objects
Note: this is not about STRAUTCOL TYPE(*USRPRF) - which runs an authority collection for a specific user
I raised this Idea and wondering if others agree. IBM Ideas
This would be very useful in locking down *USRPRF objects that are configured with *PUBLIC *USE. For example ACCOUNTA might be set with *PUBLIC *USE, allowing anyone to submit jobs to run under ACCOUNTA. We want to figure out which other user profiles actually NEED to have *USE authority to ACCOUNTA so we can lock it down appropriately, without breaking anything. Unfortunately you can't currently use CHGAUTCOL to turn on an authority collection for a user profile object, in the same way that you can turn on authority collection for a file or a program.
------------------------------
Steven Riedmueller
Certified IBM i Admin
Speaker, Mentor, and Advocate
------------------------------