topic UAF> show/identifier question in Operating System - OpenVMS

UAF> show/identifier question

Art Wiens — Fri, 04 Jun 2004 17:06:28 GMT

I'm trying to check that some group identifiers are setup, and I came across a "problem" that I've seen before (but never had such a knowledgable group at my disposal to ask ;-).

Why can't I do this:

UAF> show/identifier/value=uic:[5651,177777]
%UAF-E-UICERR, error in UIC specification \[5651,177777]\

but I can do this:

UAF> show/identifier/value=uic:[5651,*]
Name Value Attributes
VINADV [005651,177777]

Ok, so then theoretically if wildcards work, I should be able to do this and get a list of all my group identifiers:

UAF> show/identifier/value=uic:[*,*]
%UAF-E-SHOWERR, unable to complete SHOW command
-SYSTEM-F-NOSUCHID, unknown rights identifier

Inconsistent, no?

Art

Re: UAF> show/identifier question

John Gillings — Fri, 04 Jun 2004 19:31:47 GMT

Art,

Yes it's inconsistent.

UAF> show/identifier/value=uic:[5651,*]

In this context, the "*" isn't a wildcard, it's a special token used to identify the group identifier.

Your "value=uic:[5651,177777]" fails because it IS an invalid UIC, the member number is outside the permitted range. Both group and member numbers must be in the range 0 through %o77777 (decimal 32767).

That's because it isn't a UIC, it's a group identifier. Yes, SHOW/IDENT displays it as if it were a UIC, but it isn't.

The real inconsistency is that elsewhere, the string "[5651,*]" really IS a wildcard:

UAF> SHOW/BRIEF [5651,*]

will display the UAF records for all the members of group 5651.

Note that SHOW/IDENT has other inconsistencies in the way it displays and accepts values:

UAF> SHOW/IDENT INTERACTIVE
Name Value Attributes
INTERACTIVE %X80000003

UAF> SHOW/IDENT/VALUE=IDENT=%X80000003
%UAF-E-BADVALUE, error in value specification \-2147483645\

UAF> SHOW/IDENT/VALUE=IDENT=%X3
Name Value Attributes
INTERACTIVE %X80000003

So, you need to know that the leading bit in the identifer value is actually a flag to distinguish between UIC identifiers and general identifiers (similarly bit 15 is used to flag group identifiers).

Bottom line - SHOW/IDENT is inconsistent in the way it accepts and displays identifier values. But, it's been like that since identifiers were introduced in VMS V4.0, released more than 20 years ago. It's very unlikely it will be changed now. Although it's confusing at first, it does have some value in that it shows you exactly what values you'd be dealing with if you were playing with identifiers using system services.

To your original problem. I don't think there is a simple way from within AUTHORIZE to say "show me all group identifiers". If you want to do that, use PIPE:

$ PIPE MCR AUTHORIZE SHOW/IDENT * | SEARCH SYS$PIPE ",177777]"

Re: UAF> show/identifier question

Willem Grooters — Sat, 05 Jun 2004 14:03:49 GMT

Not entirely.
it IS an identifier but is cannot be accessed as a UIC

From authorize HELP MOD /UIC:

/UIC=value

Specifies the user identification code (UIC). The UIC value is
a group number in the range from 1 to 37776 (octal) and a member
number in the range from 0 to 177776 (octal), which are separated
by a comma and enclosed in brackets. HP reserves group 1 and
groups 300-377 for its own use.

Each user must have a unique UIC. By default, the UIC value is
[200,200].

Mind the member number: 177776 (oct).
177777 (oct) = FFFF (hex) = groupname. I guess Authorize will filter this off...

Willem