Specifying public authority

Public authority is given to users who do not have any specific authority to an object, who are not on the authorization list of the object, or whose group profile has no specific authority to the object. When you create a file, you can specify and grant public authority.

You can specify public authority through the AUT parameter on the Create Physical File (CRTPF) or Create Source Physical File (CRTSRCPF) command. Public authority is the last authority check made. That is, if the user has specific authority to a file or the user is a member of a group with specific authority, then the public authority is not checked. Public authority can be specified as:
  • *LIBCRTAUT. The library in which the file is created is checked to determine the public authority of the file when the file is created. An authority is associated with each library. This authority is specified when the library is created, and all files created into the library are given this public authority if the *LIBCRTAUT value is specified for the AUT parameter of the Create File (CRTLF, CRTPF, and CRTSRCPF) commands. The *LIBCRTAUT value is the default public authority.
  • *CHANGE. All users that do not have specific user or group authority to the file have authority to change data in the file.
  • *USE. All users that do not have specific user or group authority to the file have authority to read data in the file.
  • *EXCLUDE. Only the owner, security officer, users with specific authority, or users who are members of a group with specific authority can use the file.
  • *ALL. All users that do not have specific user or group authority to the file have all data authorities along with object operational, object management, and object existence authorities.
  • Authorization list name. The authorization list is a list of users and their authorities. The list allows users and their different authorities to be grouped together.
Note: When you create a logical file, no data authorities are granted. Consequently, *CHANGE is the same as *USE, and *ALL does not grant any data authority.
You can grant public authority in the following ways:
  • Define public authority using System i® Navigator.
  • Use the Edit Object Authority (EDTOBJAUT), Grant Object Authority (GRTOBJAUT), or Revoke Object Authority (RVKOBJAUT) command to grant or revoke the public authority of a file.

You can also use System i Navigator to set default public authority for a new file.