$UsrPriv - Revision history

JAL: minor word change

2018-01-03T19:54:30Z

minor word change

← Older revision		Revision as of 19:54, 3 January 2018
Line 7:		Line 7:
	<p class="syntax">$UsrPriv(<span class="term">privilege</span>, <span class="term">logging-option</span>)		<p class="syntax">$UsrPriv(<span class="term">privilege</span>, <span class="term">logging-option</span>)
	</p>		</p>
	<p>Where:</p>		<p>
			Where:</p>
	<ul>		<ul>
	<li><var class="term">privilege</var> is the privilege that is to be validated. Privilege can be one of the following values:		<li><var class="term">privilege</var> is the privilege that is to be validated. Privilege can be one of the following values:
Line 13:		Line 14:
	<li>ANY_ADMINISTRATOR		<li>ANY_ADMINISTRATOR
	<p>		<p>
	The ANY_ADMINISTRATOR privilege test verifies that the user is ~~user zero~~ or a system manager.</p></li>		The ANY_ADMINISTRATOR privilege test verifies that the user is User 0 or a system manager.</p></li>

	<li>CHANGE_FILE_PASSWORD</li>		<li>CHANGE_FILE_PASSWORD</li>

JAL: misc cleanup

2015-07-22T14:58:12Z

misc cleanup

← Older revision		Revision as of 14:58, 22 July 2015
Line 1:		Line 1:
	<p>The $~~USRPRIV~~ function is used to test whether a user ID has been granted specific <var class="product">Model 204</var> privileges. </p>		<p>
	~~<b>~~Syntax~~</b>~~		The <var>$UsrPriv</var> function is used to test whether a user ID has been granted specific <var class="product">Model 204</var> privileges. </p>
	<p>The format of the $~~USRPRIV~~ function is:</p>
	<p class="~~code~~">$~~USRPRIV~~(privilege,logging option)		==Syntax==
			<p>
			The format of the <var>$UsrPriv</var> function is:</p>
			<p class="syntax">$UsrPriv(<span class="term">privilege</span>, <span class="term">logging-option</span>)
	</p>		</p>
	<p>~~where~~:</p>		<p>Where:</p>
	<ul>		<ul>
	<li> privilege is the privilege that is to be validated. Privilege can be one of the following values:</li>		<li><var class="term">privilege</var> is the privilege that is to be validated. Privilege can be one of the following values:
	</li>		<ul>
			<li>ANY_ADMINISTRATOR
			<p>
			The ANY_ADMINISTRATOR privilege test verifies that the user is user zero or a system manager.</p></li>

			<li>CHANGE_FILE_PASSWORD</li>

			<li>CHANGE_LOGIN_PASSWORD </li>

			<li>OVERRIDE_RECORD_SECURITY</li>

			<li>SUPER_USER</li>

			<li>SYSTEM_ADMINISTRATOR</li>

			<li>SYSTEM_MANAGER</li>
			</ul></li>

			<li><var class="term">logging-option</var> specifies whether <var class="product">Model 204</var> should indicate that an error message should be issued for security violations:
			<ul>
			<li>LOG indicates that any privilege violation is logged.</li>

			<li>NOLOG indicates that the privileges should be determined but any violation found is not logged. </li>
	</ul>		</ul>
	<~~p>ANY_ADMINISTRATOR</~~p>		<p>
	~~<p>The ANY_ADMINISTRATOR privilege test verifies that~~ the ~~user is user zero~~ or ~~a system manager~~.~~</p>~~		Currently, the logging option affects only the Security Server (formerly RACF) or Top Secret interface. The option has no effect on <var class="product">Model 204</var>; the ACF2 Interface always logs a security violation regardless of the logging option.</p>
	~~<p>CHANGE_FILE_PASSWORD</p>~~		<p>LOG is the default if a logging option is not specified. </p>
	~~<p>CHANGE_LOGIN_PASSWORD </p>~~
	~~<p>OVERRIDE_RECORD_SECURITY</p>~~
	~~<p>SUPER_USER</p>~~
	~~<p>SYSTEM_ADMINISTRATOR</p>~~
	~~<p>SYSTEM_MANAGER</p>~~
	~~<ul>~~
	~~<li>logging~~ option ~~specifies whether~~ <var class="product">Model 204</var> ~~should indicate that an error message should be issued for~~ security ~~violations:~~</li>
	</li>		</li>
	</ul>		</ul>
	<p>~~LOG indicates that any privilege violation is logged.</p>~~		<p><var>$UsrPriv</var> returns a numeric true/false value indicating the result of the authorization check, as follows: </p>
	~~<p>NOLOG indicates that the privileges should be determined but any violation found is not logged. </p>~~
	~~<p>Currently, the logging option affects only the Security Server (formerly RACF) or Top Secret interface. The option has no effect on~~ <var ~~class="product"~~>~~Model 204~~</var>~~; the ACF2 Interface always logs a security violation regardless of the logging option.</p>~~
	~~<p>LOG is the default if a logging option is not specified. </p>~~
	~~<p>$USRPRIV~~ returns a numeric true/false value indicating the result of the authorization check as follows: </p>
	<table>		<table>
	<tr class="head">		<tr class="head">
	<th>Value</th>		<th>Value</th>
	<th>User is...</th>		<th>User is...</th></tr>
	</tr>
	<tr>		<tr><td>0</td>
	<td ~~align="right"~~>0</td>		<td>Not authorized for the privilege or an unknown privilege name is specified.</td></tr>
	<td>Not authorized for the privilege or an unknown privilege name is specified.</td>
	</tr>		<tr><td>1</td>
	<tr>		<td>Authorized for the specified privilege. </td></tr>
	<td ~~align="right"~~>1</td>
	<td>Authorized for the specified privilege. </td>
	</tr>
	</table>		</table>
	~~<b>~~Example~~</b>~~
	<p>The following statement could be used to test if the current user ID is authorized as a system manager.</p>		==Example==
			<p>
			The following statement could be used to test if the current user ID is authorized as a system manager.</p>
	<p class="code">IF $USRPRIV('SYSTEM_MANAGER','NOLOG') THEN		<p class="code">IF $USRPRIV('SYSTEM_MANAGER','NOLOG') THEN
	.		.
Line 50:		Line 64:
	<b></b>* ELSE UNAUTHORIZED FOR SYSTEM MANAGER FUNCTIONS		<b></b>* ELSE UNAUTHORIZED FOR SYSTEM MANAGER FUNCTIONS
	</p>		</p>
	~~<b>~~$~~USRPRIV~~ and ~~apsys</b>~~
	<p>Generally speaking, $~~USRPRIV~~ will return a value based upon the user's privileges. However, if $~~USRPRIV~~ is called from within ~~apsy~~ code, then ~~apsy~~ privileges may override ~~stanadard~~ user privileges, as follows..</p>		==$UsrPriv and application subsystems==
			<p>
			Generally speaking, <var>$UsrPriv</var> will return a value based upon the user's privileges. However, if <var>$UsrPriv</var> is called from within [[Application Subsystem development\|application subsystem (APSY)]] code, then subsystem privileges may override standard user privileges, as follows:</p>
	<ul>		<ul>
	<li>If ~~apsy~~ privileges have been set, ~~then~~ $~~USRPRIV will return~~ a value based upon the ~~apsy~~ privileges , rather than the user's privileges</li>		<li>If APSY privileges have been set, <var>$UsrPriv</var> returns a value based upon the subsystem privileges rather than the user's privileges.</li>
	<li>If start login privileges have been set for the ~~apsy~~, and $~~USRPRIV~~ is called from within the ~~apsy~~ initialization procedure, ~~then it will return~~ a value based upon the start login privileges.</li>
	<li>If the user's sclass has privileges set, ~~then these will~~ override standard ~~apsy~~ privileges for the user, and $~~USRPRIV will return~~ a value based upon the sclass privileges.</li>		<li>If start login privileges have been set for the subsystem, and <var>$UsrPriv</var> is called from within the subsystem initialization procedure, <var>$UsrPriv</var> returns a value based upon the start login privileges.</li>

			<li>If the user's sclass has privileges set, they override standard subsystem privileges for the user, and <var>$UsrPriv</var> returns a value based upon the sclass privileges.</li>
	</ul>		</ul>

	[[Category:SOUL $functions]]		[[Category:SOUL $functions]]

DCameron at 12:03, 20 July 2015

2015-07-20T12:03:38Z

← Older revision		Revision as of 12:03, 20 July 2015
Line 54:		Line 54:
	<ul>		<ul>
	<li>If apsy privileges have been set, then $USRPRIV will return a value based upon the apsy privileges , rather than the user's privileges</li>		<li>If apsy privileges have been set, then $USRPRIV will return a value based upon the apsy privileges , rather than the user's privileges</li>
	<li>If start login privileges have been set for the apsy, and USRPRIV is called from within the apsy initialization procedure, then it will return a value based upon the start login ~~priviliges~~.</li>		<li>If start login privileges have been set for the apsy, and $USRPRIV is called from within the apsy initialization procedure, then it will return a value based upon the start login privileges.</li>
	<li>If the user's sclass has privileges set, then these will override standard apsy privileges for the user, and $USRPRIV will return a value based upon the sclass privileges.</li>		<li>If the user's sclass has privileges set, then these will override standard apsy privileges for the user, and $USRPRIV will return a value based upon the sclass privileges.</li>
	</ul>		</ul>
	[[Category:SOUL $functions]]		[[Category:SOUL $functions]]

DCameron at 12:02, 20 July 2015

2015-07-20T12:02:41Z

← Older revision		Revision as of 12:02, 20 July 2015
Line 54:		Line 54:
	<ul>		<ul>
	<li>If apsy privileges have been set, then $USRPRIV will return a value based upon the apsy privileges , rather than the user's privileges</li>		<li>If apsy privileges have been set, then $USRPRIV will return a value based upon the apsy privileges , rather than the user's privileges</li>
			<li>If start login privileges have been set for the apsy, and USRPRIV is called from within the apsy initialization procedure, then it will return a value based upon the start login priviliges.</li>
			<li>If the user's sclass has privileges set, then these will override standard apsy privileges for the user, and $USRPRIV will return a value based upon the sclass privileges.</li>
	</ul>		</ul>
	[[Category:SOUL $functions]]		[[Category:SOUL $functions]]

DCameron at 11:58, 20 July 2015

2015-07-20T11:58:59Z

← Older revision		Revision as of 11:58, 20 July 2015
Line 52:		Line 52:
	<b>$USRPRIV and apsys</b>		<b>$USRPRIV and apsys</b>
	<p>Generally speaking, $USRPRIV will return a value based upon the user's privileges. However, if $USRPRIV is called from within apsy code, then apsy privileges may override stanadard user privileges, as follows..</p>		<p>Generally speaking, $USRPRIV will return a value based upon the user's privileges. However, if $USRPRIV is called from within apsy code, then apsy privileges may override stanadard user privileges, as follows..</p>
			<ul>
			<li>If apsy privileges have been set, then $USRPRIV will return a value based upon the apsy privileges , rather than the user's privileges</li>
			</ul>
	[[Category:SOUL $functions]]		[[Category:SOUL $functions]]

DCameron at 11:55, 20 July 2015

2015-07-20T11:55:15Z

← Older revision		Revision as of 11:55, 20 July 2015
Line 51:		Line 51:
	</p>		</p>
	<b>$USRPRIV and apsys</b>		<b>$USRPRIV and apsys</b>
			<p>Generally speaking, $USRPRIV will return a value based upon the user's privileges. However, if $USRPRIV is called from within apsy code, then apsy privileges may override stanadard user privileges, as follows..</p>
	[[Category:SOUL $functions]]		[[Category:SOUL $functions]]

DCameron at 11:52, 20 July 2015

2015-07-20T11:52:10Z

← Older revision		Revision as of 11:52, 20 July 2015
Line 50:		Line 50:
	<b></b>* ELSE UNAUTHORIZED FOR SYSTEM MANAGER FUNCTIONS		<b></b>* ELSE UNAUTHORIZED FOR SYSTEM MANAGER FUNCTIONS
	</p>		</p>
			<b>$USRPRIV and apsys</b>
	[[Category:SOUL $functions]]		[[Category:SOUL $functions]]

Mlarocca: Mlarocca moved page $UsrPrive to $UsrPriv: Lower case change

2014-07-31T18:08:40Z

Mlarocca moved page $UsrPrive to $UsrPriv: Lower case change

← Older revision	Revision as of 18:08, 31 July 2014
(No difference)

Mlarocca: Mlarocca moved page $USRPRIV to $UsrPrive: Lower case change

2014-07-31T18:06:21Z

Mlarocca moved page $USRPRIV to $UsrPrive: Lower case change

← Older revision	Revision as of 18:06, 31 July 2014
(No difference)

Alex: Automatically generated page update

2013-04-20T13:18:34Z

Automatically generated page update

New page

The $USRPRIV function is used to test whether a user ID has been granted specific <var class="product">Model 204</var> privileges. 
Syntax
The format of the $USRPRIV function is:
$USRPRIV(privilege,logging option)

where:
<ul>
<li> privilege is the privilege that is to be validated. Privilege can be one of the following values:</li>
</li>
</ul>
ANY_ADMINISTRATOR
The ANY_ADMINISTRATOR privilege test verifies that the user is user zero or a system manager.
CHANGE_FILE_PASSWORD
CHANGE_LOGIN_PASSWORD 
OVERRIDE_RECORD_SECURITY
SUPER_USER
SYSTEM_ADMINISTRATOR
SYSTEM_MANAGER
<ul>
<li>logging option specifies whether <var class="product">Model 204</var> should indicate that an error message should be issued for security violations:</li>
</li>
</ul>
LOG indicates that any privilege violation is logged.
NOLOG indicates that the privileges should be determined but any violation found is not logged. 
Currently, the logging option affects only the Security Server (formerly RACF) or Top Secret interface. The option has no effect on <var class="product">Model 204</var>; the ACF2 Interface always logs a security violation regardless of the logging option.
LOG is the default if a logging option is not specified. 
$USRPRIV returns a numeric true/false value indicating the result of the authorization check as follows: 
<table>
<tr class="head">
<th>Value</th>
<th>User is...</th>
</tr>
<tr>
<td align="right">0</td>
<td>Not authorized for the privilege or an unknown privilege name is specified.</td>
</tr>
<tr>
<td align="right">1</td>
<td>Authorized for the specified privilege. </td>
</tr>
</table>
Example
The following statement could be used to test if the current user ID is authorized as a system manager.
IF $USRPRIV('SYSTEM_MANAGER','NOLOG') THEN
.
.
.
* PERFORM SYSTEM MANAGER AUTHORIZED CODE
END IF
* ELSE UNAUTHORIZED FOR SYSTEM MANAGER FUNCTIONS

[[Category:SOUL $functions]]