Solved

IBM iseries i5 web server authority issue

Posted on 2009-07-08
9
812 Views
Last Modified: 2013-12-06
On an IBM AS400 iSeries I am using Apache and PHP to issue system commands.  I am running into some authority issues.  If I do a "WRKJOBSCDE OUTPUT(*PRINT) PRTFMT(*FULL)" interactively using my login it works great and shows me all data.  If I do the same from within my PHP (via the Apache server) I get "CPF1630: Not authorized to job schedule entry" errors and some of the job entry information is missing from the output.  My Apache server is using username "QTMHHTTP".  Does anyone know of a way to give Apache the authority to do this and other commands without possibly sacrificing security?  Thank you!
0
Comment
Question by:richard_crist
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 3
9 Comments
 
LVL 35

Accepted Solution

by:
Gary Patterson earned 500 total points
ID: 24809002
Well, it not the best practice to grant a bunch of authority to QTMHHTTP.  

One alternative is to start an instance of Apache that runs under a different profile, but this can be risky, too.

A method that I prefer is to create (CL generally) programs containing the commands that you want to run, creating them with adopted authority of a profile that is authorized to run the required commands.  Grant *USE rights to QTMHHTTP to the CL programs that you create, and you are in business (securely!).

CHGOBJOWN of the CL to the user with rights to run the command and then CHGPGM USER(*OWNER) to set the program to use adopted authority.
  Alternately, compile under the user with elevated rights, and specify USER(*OWNER) on CRTCLPGM.  Some profiles are configured to set object ownership to a group profile instead if the individual profile (the group is probably what you should use anyway), so check ownership and USER parameters before testing.

- Gary Patterson
0
 
LVL 3

Author Comment

by:richard_crist
ID: 24809201
Gary,

Thank you!  I am compiling with the *OWNER option.  I will let you know tomorrow how it goes.  Thanks for all your help today!
0
 
LVL 3

Author Comment

by:richard_crist
ID: 24823863
Gary,

I am still working on it.  I have tried compiling with *OWNER as well as CHGPGM to *OWNER but I have not got it to work yet.  Probably something I am doing.  When I have time I will provide details to see if you can find what I am doing wrong.

Thank you!
0
WordPress Tutorial 4: Recommended Plugins

Now that you have WordPress installed, understand the interface, and know how to install new parts, let’s take a look at our recommended plugins.

 
LVL 35

Assisted Solution

by:Gary Patterson
Gary Patterson earned 500 total points
ID: 24824611
Try using CHGOBJOWN first to make sure the object is owned by the correct profile, then use CHGPGM to change to USER(*OWNER).  If you are successful DSPPGM will show OWNER .... (desired target profile) and Use Adopted Authority .... *YES.

Of course the Owner profile neds to have adequate authority to run the desired commands.

- Gary Patterson
0
 
LVL 3

Author Comment

by:richard_crist
ID: 24925642
Please accept my apology for not updating this question in a timely manner.  I have been sidetracked with other stuff at work.  I am going to try these suggestions as soon as I can.  Thank you!
0
 
LVL 3

Author Comment

by:richard_crist
ID: 24979784
Gary,

I'm going to close this question and give you the points for helping me.  I just haven't been able to work on this particular issue at work yet.  I believe your answer is correct and I just need to make it work.  Thank you for your help with this question and other in the past.   :)
0
 
LVL 3

Author Closing Comment

by:richard_crist
ID: 31601348
Thanks for the help!   :)
0
 
LVL 35

Expert Comment

by:Gary Patterson
ID: 24980910
I'll continue to monitor the question in case you hit a snag.
0
 
LVL 3

Author Comment

by:richard_crist
ID: 24983788
Thank you!   :)
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
Many old projects have bad code, but the budget doesn't exist to rewrite the codebase. You can update this code to be safer by introducing contemporary input validation, sanitation, and safer database queries.
The viewer will learn how to dynamically set the form action using jQuery.
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.

628 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question