Feature Article

Using Adopted Authority for Password Resets

By Dan Riehl - SecureMyi.com

Sometimes powerful IBM i Special Authorities are required by users which are not system administrators or security officers. For example, when users forget their passwords or disable their profiles through excessive failed attempts to log in, Help Desk personnel or the Operations staff need the ability to reset the password and re-enable the user account. The Special Authority required to perform these sensitive User Profile functions is called Security Administrator (*SECADM) Special Authority. In practice, All Object (*ALLOBJ) Special Authority is also needed to be able to perform these password resets. *ALLOBJ Special Authority is needed to ensure that the Help Desk or Operations Staff have enough authority to the User Profiles that they need to reset. Normally, User Profiles are created with a *PUBLIC authority of *Exclude, allowing changes only by very powerful system administrators which have *ALLOBJ and *SECADM special authority inherent in their user profiles.

The simple solution is to just give all these Help Desk and Operations users *SECADM and *ALLOBJ special authority. However, *SECADM and *ALLOBJ special authority also lets users create and change other attributes of user profiles, and *ALLOBJ provides unrestricted access to all files, libraries, programs, etc. You do not want to give these users carte blanche to create and change user profiles at will, and you really do NOT want to give them full access to all *SECADM and *ALLOBJ special authority full time. You want to give them only the ability to reset passwords and status for selected user profiles. After all, you don't want to give the Help Desk and Operations staff the ability to reset the passwords for QSECOFR and other powerful profiles. You also do not want them to have the *ALLOBJ authority, to be able to change payroll amounts or view/change other sensitive data. This article discusses a very good method to allow a user to 'borrow' the *SECADM and *ALLOBJ authority required to reset a user profile, but then return that borrowed authority as soon as that distinct task is completed. This method prevents the use of the borrowed authority to do tasks that are beyond the user's scope or responsibility.

Borrowing Special Authority

One of the best methods to provide temporary use of the *SECADM and *ALLOBJ special authority is to use the IBM i facility called Program Adoption of Authority(PAA). Adoption of authority provides for temporary use of an elevated level of authority to perform functions that the user is not normally authorized to do. Here we deal with adopting the *SECADM and *ALLOBJ special authority to allow a user to reset a user profile status and password.

The Big Picture

The adopted authority technique can be used to adopt any special authority, with an ultimate view of removing, as much as possible, the assignment of any User Special Authorities.

The RESETUSER Command

The purpose of the RESETUSER command is to give a help desk or operations user the temporary authority to reset the password and/or status of a user profile.

The command consists of two parts, the command definition and the CL program. In order to secure the command and program, and to configure the program adoption of authority correctly, there are instructions for creating the command and the program. These step by step instructions are found at the end of the article.

SafeGuards Built Into RESETUSER

We need to ensure that this command is not improperly used to reset the IBM-supplied user profiles like QSECOFR and QSYSOPR. You also want to ensure that the command cannot be used to reset the passwords for users who have powerful special authorities, such as *ALLOBJ, *SERVICE, *SAVSYS, *AUDIT, *IOSYSCFG and *SECADM. If these could be reset, it would provide a way for the user of the command to reset a password for the powerful profiles, sign on as that profile, and perform unauthorized activities.

Read More . .    and get the source code