read only access using authorize ?

[Thomas Ritter]

Is it possible to provide read only access for a non-priviledged user to run authorize.
Running $mcr authorize implys read+write access.
Can this be changed ?

Thanks in advance
Tom

[Steven Schweda]

I see no easy way. You could, perhaps,
install AUTHORIZE.EXE with more privileges.
(AUTHORIZE HELP Files_Used suggests SYSPRV.)
I assume that this would open up some
horrible security holes.

It might make more sense to write a more
limited program to read the SYSUAF, and then
install that program with the required
privilege(s), subsystem identifier(s), or
whatever.

What problem are you trying to solve?

[Thomas Ritter]

Steve, the systems are being locked down. A number of groups have work habits whereby they check user records for such items as quotas, last login times and even if the account is enabled. Can be useful.
I like your idea of a simple replacement program which show one complete user listing. But I would like to avoid the work.

[Steven Schweda]

All I know is what's in the
freeware_readme.txt, but perhaps DIX could be
useful:

http://h71000.www7.hp.com/freeware/freeware70/dix/

[Volker Halle]

Tom,

would creating a SYSUAF.LIS file (UAF> LIST */FULL) from a repeating batch job satisfy the need of looking up some user account information from time to time ?

Volker.

[Antoniov.]

Thomas,
if your user group need individual information can simply use f$getjpi lex function.
I saw dix, there is a good information about sysuaf inside it.

Antonio
http://it.openvms.org

[Phil.Howell]

The vms_check tool includes a brief UAF listing in HTML table format, I'm sure you could adapt it to include quota information
Phil
http://h71000.www7.hp.com/openvms/journal/v7/vms_check_tool.html

[Hein van den Heuvel]

Sounds like you have an existing application that you want to disturb as little as possible, whether that application usage of the system makes much sense or not. (It doesn't make much send imho :-).

1) Things like account quota's don't change too often.
2) AUTHORIZE will follow USER mode logicals, but LOGINOUT will (obviously) only follow trusted logicals.

So perhaps a solution is to point a user mode logical for "sysuaf" to a reasonably up to date copy of the sysuaf file. Just copy (convert/share !) the file daily, or whenever significant changes are known to have been made.

hth,
Hein.

[Joseph Huber_1]

There is the $GETUAI system service, and there is freeware GETUAI utility to get individual fields and users from sysuaf using $GETUAI.

Could the habit of using authorize not be changed to use getuai, which could be installed with privilege without opening a security hole (at least not too wide) ?

[Jan van den Ende]

Well,

to add to (or just explain) the answer by Joseph:
$GETUAI needs SYSPRV, so that is no immediate answer, but the freeware GETUAI has already nicely implemented it. Installing THAT with sysprv pretty much gives what you want, and perhaps you could/should restrict of THAT by suitable identifiers.

hth

Proost.

Have one on me (maybe in Nashua?).

jpe