topic Re: Unable to Grant Identifier in Operating System - OpenVMS

Unable to Grant Identifier

MJ26 — Mon, 16 Mar 2009 16:11:36 GMT

Hello, there was a similar issue in an older thread, but it did not help in my situation. So here is my problem:

I need to add a user to the system and grant them an identifier. The identifier exists on the system already and is used by many people on the system with no issues. When I try to create a user with a unique UIC, I receive the following error:

%UAF-I-ADDMSG, user record successfully added
%UAF-E-RDBADDERRU, unable to add U123456 value [000205,000515] to rights database
-SYSTEM-F-DUPLNAM, duplicate name

So you can see the user was successfully added. I can issue a MCR AUTHORIZE SHO U123456, and get information for that 1 user. I can also show MCR AUTHORIZE SHOW [205,515] and also get 1 user (same user). Do there are no duplicates. I have even tried to delete the account and readd using a new UIC (unique of course). Since the account was created, I also added the identifier to their account, MCR AUTHORIZE GRANT/IDENT VISTA$USER, and that said it was successful. HOwever when I look at their account, the Identifier does not show up, and when they log in, the identifier does not work correctly. If anyone has any suggestions to troubleshoot, I am completely open. Thanks!!!

Re: Unable to Grant Identifier

Hoff — Mon, 16 Mar 2009 16:50:46 GMT

Identifiers are confusing. There are several ranges of these. There are the identifiers associated with UICs, which is what you're looking at here. There are identifiers which are user-created and that are granted to users (or to subsystems). There are various other sorts and ranges, as well.

You won't see a UIC identifier granted to a user with a matching UIC, but the user (because of the UIC) matches; the access should be granted. (See if the alphanumeric identifier string shows in the UIC field of U123456, and run some basic tests with ACLs.)

You can and would see a user-created identifier granted (and I prefer to avoid using UIC identifiers for this purpose) to other users.

Personally, I'd look to move U123456 into a user-created identifier range, and leave the UICs for use as UICs.

I've posted up some acl_scrub.zip code a while back which might be worth a look for this stuff, too.

http://64.223.189.234/node/426

And do read the Security Manual here around identifiers and ACLs. This stuff can be massively confusing, and the manual (and a few of the presentations around) do a reasonable job of describing what you're dealing with.

Re: Unable to Grant Identifier

EdgarZamora — Mon, 16 Mar 2009 16:52:27 GMT

The identifier U123456 is already in use (most likely assigned to a different UIC). To check what UIC it's assigned to, do a:

UAF> SHOW /ID U123456

You have two choices... use another "user name" for the UIC [205,515], or remove the identifier U123456 from its currently assigned UIC (REMOVE/IDENTIFIER) then add that identifier to the UIC [205,515] using ADD/IDENTIFER/VALUE=UIC:[205,515] U123456.

Re: Unable to Grant Identifier

MJ26 — Mon, 16 Mar 2009 17:49:09 GMT

Hoff, thanks for the great information. I will definately read up more on what you have.

EdgarZamora - Your answer successfully solved my issue.

I am closing this thread.