We have a service account--ABCGEODB--used from an external server to pull from qsys2.user_Info. Recently, we have noticed that newly created user profiles are not on the list.  When someone with *ALLOBJ ran the query from the IBM i--THISSERVER--all expected records were on the list.  When I ran the query with my more limited access, I was missing two users. When I tried to display one of them from a command line, I saw Not authorized to user profile ABCTDUNC. We believe we simply need to add some special authority to the service account, which we can test with my account.  We are at a loss as to which special authority to add. 

Thank you for your input. 

select * from qsys2.user_Info 
where authorization_name like '%ABC%' 
and supplemental_group_List like '%DEFGHIJ%' 
order by 1 
;

We have a service account--ABCGEODB--used from an external server to pull from qsys2.user_Info. Recently, we have noticed that newly created user profiles are not on the list.  When someone with *ALLOBJ ran the query from the IBM i--THISSERVER--all expected records were on the list.  When I ran the query with my more limited access, I was missing two users. When I tried to display one of them from a command line, I saw Not authorized to user profile ABCTDUNC. We believe we simply need to add some special authority to the service account, which we can test with my account.  We are at a loss as to which special authority to add. 

Thank you for your input. 

select * from qsys2.user_Info 
where authorization_name like '%ABC%' 
and supplemental_group_List like '%DEFGHIJ%' 
order by 1 
;

------------------------------
David Taylor
------------------------------

We have a service account--ABCGEODB--used from an external server to pull from qsys2.user_Info. Recently, we have noticed that newly created user profiles are not on the list.  When someone with *ALLOBJ ran the query from the IBM i--THISSERVER--all expected records were on the list.  When I ran the query with my more limited access, I was missing two users. When I tried to display one of them from a command line, I saw Not authorized to user profile ABCTDUNC. We believe we simply need to add some special authority to the service account, which we can test with my account.  We are at a loss as to which special authority to add. 

Thank you for your input. 

select * from qsys2.user_Info 
where authorization_name like '%ABC%' 
and supplemental_group_List like '%DEFGHIJ%' 
order by 1 
;

We have a service account--ABCGEODB--used from an external server to pull from qsys2.user_Info. Recently, we have noticed that newly created user profiles are not on the list.  When someone with *ALLOBJ ran the query from the IBM i--THISSERVER--all expected records were on the list.  When I ran the query with my more limited access, I was missing two users. When I tried to display one of them from a command line, I saw Not authorized to user profile ABCTDUNC. We believe we simply need to add some special authority to the service account, which we can test with my account.  We are at a loss as to which special authority to add. 

Thank you for your input. 

select * from qsys2.user_Info 
where authorization_name like '%ABC%' 
and supplemental_group_List like '%DEFGHIJ%' 
order by 1 
;

By this time this question was reviewed and posted, another group where I posted the question recommended looking at the user profile object authority.  We found that indeed the working profiles had one set of object authorities assign and the failing profiles were missing one or two of the authorities.  We used the grant object authority from the service account to the failing accounts and resolved the problem. Thanks for the input. 

GRTOBJAUT OBJ(ABCTDUNC) OBJTYPE(*USRPRF) REFOBJ(ABCGEODB) REFOBJTYPE(*USRPRF)     

We have a service account--ABCGEODB--used from an external server to pull from qsys2.user_Info. Recently, we have noticed that newly created user profiles are not on the list.  When someone with *ALLOBJ ran the query from the IBM i--THISSERVER--all expected records were on the list.  When I ran the query with my more limited access, I was missing two users. When I tried to display one of them from a command line, I saw Not authorized to user profile ABCTDUNC. We believe we simply need to add some special authority to the service account, which we can test with my account.  We are at a loss as to which special authority to add. 

Thank you for your input. 

select * from qsys2.user_Info 
where authorization_name like '%ABC%' 
and supplemental_group_List like '%DEFGHIJ%' 
order by 1 
;

By this time this question was reviewed and posted, another group where I posted the question recommended looking at the user profile object authority.  We found that indeed the working profiles had one set of object authorities assign and the failing profiles were missing one or two of the authorities.  We used the grant object authority from the service account to the failing accounts and resolved the problem. Thanks for the input. 

GRTOBJAUT OBJ(ABCTDUNC) OBJTYPE(*USRPRF) REFOBJ(ABCGEODB) REFOBJTYPE(*USRPRF)     

We have a service account--ABCGEODB--used from an external server to pull from qsys2.user_Info. Recently, we have noticed that newly created user profiles are not on the list.  When someone with *ALLOBJ ran the query from the IBM i--THISSERVER--all expected records were on the list.  When I ran the query with my more limited access, I was missing two users. When I tried to display one of them from a command line, I saw Not authorized to user profile ABCTDUNC. We believe we simply need to add some special authority to the service account, which we can test with my account.  We are at a loss as to which special authority to add. 

Thank you for your input. 

select * from qsys2.user_Info 
where authorization_name like '%ABC%' 
and supplemental_group_List like '%DEFGHIJ%' 
order by 1 
;

We have a service account--ABCGEODB--used from an external server to pull from qsys2.user_Info. Recently, we have noticed that newly created user profiles are not on the list.  When someone with *ALLOBJ ran the query from the IBM i--THISSERVER--all expected records were on the list.  When I ran the query with my more limited access, I was missing two users. When I tried to display one of them from a command line, I saw Not authorized to user profile ABCTDUNC. We believe we simply need to add some special authority to the service account, which we can test with my account.  We are at a loss as to which special authority to add. 

Thank you for your input. 

select * from qsys2.user_Info 
where authorization_name like '%ABC%' 
and supplemental_group_List like '%DEFGHIJ%' 
order by 1 
;