IBM i Global

 View Only
Expand all | Collapse all

Retrieving the Various User Profiles for a running Job on IBM i

  • 1.  Retrieving the Various User Profiles for a running Job on IBM i

    Posted Fri March 22, 2024 12:53 PM

    I need to retrieve the up to 4 user Profiles for a given job during runtime.

    I know how to get the Job's User and the Current User. The job User is the User who started the job. The Current user is the user that a SWAP USRPRF API was run and is now the current user. But I also need the user profile when the job has run a program that has Adopt authority passed on. So if a (for example) CL program was compiled with OWNER(QPGMR) and USRPRF(*OWNER) it is running at both the current User and the Adopted User (i.e., the owner of the program. I can't find a way to locate that last user. Does anyone know which API it is supposed to return it? I don't think there is one. 

    For the record, I'm trying to get all 4 of the following:

    1. User that started the job
    2. User under which the job is currently running when a SWAP User Profile is done
    3. User the Job is Adopting Authority from (i.e., the Owner of a *PGM that has USRPRF(*OWNER) for the "run as" attribute.
    4. User ID for a Client Job running


    ------------------------------
    Robert Cozzi
    ------------------------------


  • 2.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    Posted Mon March 25, 2024 08:58 AM

    i looked and did not see anything for #4 either. would be interested in seeing if you found anything

    I could only think about looking at the called/to be called program attributes. 


    for #1 are you interested in the just the user running the job or the user that submitted the job.  They are not necessarily the same.



    ------------------------------
    Bryan Dietz
    ------------------------------



  • 3.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    Posted 30 days ago

    The Client User (#4) is available in an SQL View that IBM ships. Not sure if its on an earlier release or just V7R4 and later... So I can't use it.

    But I could have sworn I saw that info in an API that I used in my old COZTOOLS package "20 years ago" but I just don't see it today. 



    ------------------------------
    Robert Cozzi
    ------------------------------



  • 4.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    Posted 30 days ago

    Yes, obtaining the Submitted By Job's User Profile is easy with QUSRJOBI. The Job User and Current User are also in there. 

    The really tough one is the User that Owns the program I'm in or that was up the call stack and that program is ADOPT(*YES) and USRPRF(*OWNER).

    The SQL register USER returns that "Adopted user profile impacting the job" value in testing, but to-date, I cannot find an API or MI instruction to materialize that value. In the "old days" I would just ask my contacts at IBM but today I often get redirected to these forums by the IBMers. So here I am asking about it. :) 



    ------------------------------
    Robert Cozzi
    ------------------------------



  • 5.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    IBM Champion
    Posted Mon March 25, 2024 09:06 AM

    For #3, you can check the QAUDJRN audit journal for entries with Code: "T" and Type: "AP".  It looks like an entry is written whenever a program is called which adopts *OWNER.  You could look for the audit journal entries for the job of interest, and the entry data itself includes the program and the actual owner from whom authority is adopted.  There could be multiple different user profiles from whom authority is adopted over the course of that job running.



    ------------------------------
    Steven Riedmueller
    Certified IBM i Admin
    Speaker, Mentor, and Advocate
    ------------------------------



  • 6.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    IBM Champion
    Posted Mon March 25, 2024 10:48 AM

    Cehck also this page to know the needs regarding QAUDLVL system value:

     

    https://www.ibm.com/docs/en/i/7.2?topic=actions-security-auditing-journal-entries

     

    Best Regards

     

    -------------------------

    Andreu Rul

    CTO

    Telf: +34 663 817 144

     

    Interfaz de usuario gráfica, Aplicación  Descripción generada automáticamente

     

    signature_256849821

     






  • 7.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    Posted Tue March 26, 2024 08:08 AM
    Edited by Patrick Kelly Tue March 26, 2024 08:12 AM

    PROGRAM_INFO View:

    https://www.ibm.com/docs/en/i/7.5?topic=services-program-info-view

    Or:

    Retrieve Program Information (QCLRPGMI) API

    https://www.ibm.com/docs/api/v1/content/ssw_ibm_i_75/apis/qclrpgmi.htm



    ------------------------------
    Patrick Kelly
    ------------------------------



  • 8.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    IBM Champion
    Posted Tue March 26, 2024 01:30 PM

    Here's an odd thing...

    EDTF FILE(ROB/QPGMSRC) MBR(DELETEME)
    pgm                                   
    DSPOBJAUT OBJ(ROB/TEST) OBJTYPE(*FILE)
    endpgm                                
     
    CRTCLPGM PGM(ROB/DELETEME) SRCFILE(ROB/QPGMSRC) 
    CHGPGM PGM(ROB/DELETEME) USRPRF(*OWNER)
    CHGOBJOWN OBJ(ROB/DELETEME) OBJTYPE(*PGM) NEWOWN(ADOPT)
    CRTUSRPRF USRPRF(DUMMY) PASSWORD(redacted) -- On supported versions of the os password defaults to *none
     
    Sign on as DUMMY
    CALL ROB/DELETEME
    Object . . . . . . . :   TEST    
      Library  . . . . . :     ROB   
    Object type  . . . . :   *FILE   
                                     
    Object secured by authorization l
                                     
                             Object  
    User        Group       Authority
    *ADOPT                  *ALL     
    *PUBLIC                 *EXCLUDE 
    PROGRAMMER              *ALL     
    ADOPT                   *ALL     
                                     
    See that *ADOPT?  IDK if there's some way to programmatically determine that. 
    Some of this stuff is available in authority collection like
    https://www.ibm.com/docs/en/i/7.5?topic=collection-authority-views


    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------



  • 9.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    IBM Champion
    Posted Tue March 26, 2024 02:19 PM

    I think the *ADOPT only shows up because your job is running under adopted authority which is the source of your *ALL authority on the file.  Similar thing happens with *GROUP whenever your authority to an object is the result of your membership in a group.  I still think the audit journal has the details that you're looking for.



    ------------------------------
    Steven Riedmueller
    Certified IBM i Admin
    Speaker, Mentor, and Advocate
    ------------------------------



  • 10.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    IBM Champion
    Posted Tue March 26, 2024 03:59 PM

    Well, Bob's looking for the 4 user profiles for a given job during it's runtime.

    I'm not saying that the audit journal isn't a possibility.  The problem with that is the timing.  You have to look for an entry that it is running under adopted authority and ensure there is no matching record that it is no longer running under adopted authority.  Some call stacks can be really fluid as to that adopted authority.

    Joining the stack_info with the program info from each entry in the stack can be laborious also.



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------



  • 11.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    IBM Champion
    Posted Tue March 26, 2024 07:26 PM

    Oh yeah, its definitely not going to be easy!  An authority collection captures a lot of details, but you have to run it either against a user profile (so which ones?) or against objects.  It's an interesting requirement.



    ------------------------------
    Steven Riedmueller
    Certified IBM i Admin
    Speaker, Mentor, and Advocate
    ------------------------------



  • 12.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    IBM Champion
    Posted Wed March 27, 2024 02:30 AM

    The information for 1-3 can be got by the special registers:

    • Session_User
    • User / System_User
    • Current_User

    ... for the 4th you may check the CURRENT CLIENT_USERID special register



    ------------------------------
    Birgitta Hauser
    Database and Software Engineer
    Selfemployed - Modernization-Education-Consulting on IBM i
    Kaufering
    +49 170 5269964
    ------------------------------



  • 13.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    Posted 30 days ago

    Yes, Birgitta, I already know that 3 of the 4 are Special Registers in SQL. They even show the Adopted User Profile which is what I'm looking for. Problem is, the various apps are NOT SQL so I was looking for the interface that SQL uses to extract that piece of info. Thanks.



    ------------------------------
    Robert Cozzi
    ------------------------------



  • 14.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    IBM Champion
    Posted 29 days ago

    Tried to find a REGISTERS view or table in the system catalog and I could not.  Sometimes that can be used to see the source used to create the object.

    IDK if TRCJOB prior to an execution of VALUES CURRENT_USER would help.

    Often IBM comes up with new APIs for their SQL functions.  While some may users write their own based on their knowledge of IBM APIs, IBM often determines that particular functions would either be faster, easier or even simply possible if they created a new undocumented API as a basis for the sql object.  I have looked at some of the stuff in those system catalogs and elsewhere and have often found this to be the case.

    Any chance you can work around this by just use the function by either calling a SQLRPGLE program which retrieve this or by using the sql call api if you don't have the sql precompier?  The register has been around since at least 7.1



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------



  • 15.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    Posted 27 days ago

    Is this not what you are looking for?

    Retrieve Program Information (QCLRPGMI) API

    https://www.ibm.com/docs/api/v1/content/ssw_ibm_i_75/apis/qclrpgmi.htm



    ------------------------------
    Patrick Kelly
    ------------------------------



  • 16.  RE: Retrieving the Various User Profiles for a running Job on IBM i

    IBM Champion
    Posted Wed March 27, 2024 08:51 AM

    Also keep in mind that if

    PGM1 owned by ADOPT with USRPRF(*OWNER) calls

    PGM2 owned by QUSER with USRPRF(*USER) and USEADPAUT(*YES) calls

    PGM3 owned by QUSER with USRPRF(*USER) and USEADPAUT(*YES)

    then PGM3 will still be running with the adopted authority of PGM1.

    Infor has their LX (formerly BPCS) software set up this way.  If you wanted to, you could change the data to have *public *exclude and give only the profile in the top level program access to the data.  This would stop any need for playing whack-a-mole with removing tools from people, executing the SPENDMONEY command for exit point software, etc.

    The problem is when you break the chain.  For example, submitting a job.

    The reason I bring this up is in case you decide to analyze the program stack.



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------