Authorization needed to run debug command in AS400

Hi Readers,

Today, I got a call from our developer who went on a long vacation. She returned back today and was unable to debug certain programs that she had created long back. In the meanwhile, we had a major hardware and software upgrade of our system.

So, when I heard this, my first quest was may be the default Authorization list that was created before, has been changed. Might be she has been removed from one of the authorization list. When I explored I did not find any changes and she had same level of authorization as her other team mates. Then I checked for the command she was running, I found her user profile missing in authorization list created to use STRDBG command. Here, is a list of authority that a user needs to be able to run Start Debug command.

• *USE authority to the Start Debug (STRDBG) command.
• *USE authority to the End Debug (ENDDBG) command.
• *USE authority to the Start Service Job (STRSRVJOB) command.
• *USE authority to the End Service Job (ENDSRVJOB) command.
• Either *CHANGE authority to the program or Java class being debugged, or *USE authority to the program being debugged and *SERVICE special authority.

If the job that you are debugging is running under a different user profile than the user profile you use to sign on to the iSeries system from the debugger, the user profile that you use to sign on to the iSeries system from the debugger must have the following authorities:

• *USE authority to the user profile that the job you are debugging is running under.
• *JOBCTL special authority if you do not explicitly use fully qualified program names (library/program). In other words, if you use *CURLIB or *LIBL or you do not specify a library name, you need to have *JOBCTL special authority.

The group profile QPGMR gives you the correct authority to the STRDBG, ENDDBG, STRSRVJOB, and ENDSRVJOB commands and *JOBCTL special authority.

Deleting Authorization list

In order to delete an Authorization list that has objects that are secured and users which are secured by this Authorization list, you need to follow the below procedure.

First, you have to revoke authority on the objects that are secured by this Authorization list. If you remember the previous topic on Authorization list where, I had created an Authorization list called JOBSC. I had secured one object CRTAUTL command using this Authorization list. And this Authorization list ensured HSDRB user profile had *EXCLUDE authority and *PUBLIC had *USE authority. 

Now, lets delete this Authorization list.

If you press 4 next to this authorization list and press enter. It would not delete this Authorization list, since there is a Object that is secured using this Authorization list. So, at first we need to revoke Authority on this Object i.e. CRTAUTL command.

The command would be  

RVKOBJAUT OBJ(QSYS/CRTAUTL) OBJTYPE(*CMD) AUTL(JOBSC)  

The important parameters are OBJECT , OBJECT TYPE and AUTHORIZATION LIST.

You can also specify USER, but if you use USER and AUTL parameter together, it will not be processed by AS400. Similarly, parameter AUT and AUTL can not be used simultaneously.

After, the authority is revoked. You can check using option 8 next to the Authorization list ( Display objects in list). The screen would be blank in this case as I used only one object. You have to follow this until all the objects secured by the Authorization list are revoked.  When you do not see any objects in the list. You can proceed further.

Now delete the Authorization list.

You can use DLTAUTL AUTL(JOBSC) command or press option 4 next to the Authorization list to delete the same. 

Adding user profiles to authorization list

After, you create an user profile in AS400, it is required for Admin to ensure this user profile has been added to relevant authorization list.

What is Authorization list and how is it useful?
An Authorization list is a special system level object that resides in QSYS library with object type *AUTL. It simply defines user authority for objects belong to the list. Instead of providing individual private authority to an object when it is created, it is better to associate an object with appropriate Authorization list. The list will control individual and *PUBLIC authority of the object in the list.

It is beneficial in following way:-

1- Individual size of user profile is kept much lower by using Authorization list.
2- System performance is improved when running SAVSYS backup and saving security information by using SAVSECDTA.
3- Security changes can be made to object when the list are open and active. Only objects with private authority needs to be used when not in use.

How to create Authorization list?

Use command CRTAUTL  to create a new Authorization list.
Set *PUBLIC authority level using AUT parameter.

Once this is created you can work on it using EDTAUTL command.

You can grant object authority by GRTOBJAUT command or by adding objects to the list by ADDAUTLE.

Steps to create authorization list and add users is listed below.

1- Create authorization list, example

CRTAUTL AUTL(JOBSC) TEXT('job scheduler job')

When you do this the *PUBLIC authority will get the authority that you have selected, I have selected *CHANGE

Your ID will be added to this authorization list as you are the owner.


2- Add the objects that you want to secure using this AUTL.

The objects that you want to secure needs to be added to this AUTL. This can be done by EDTAUTL command. Here I want to secure CRTAUTL command access. So, I did the following

You can check the objects by taking F15 after entering the AUTL list.

3- Add other users that you want to secure via this authorization list.

ADDAUTLE command would do this

You can check the users added to this AUTL by taking option 5 next to the AUTL.

You can delete the authorization list by DLTAUTL command.