Switching Profiles

After a switch pair has been configured, the user will be required to do the following in order to switch to the 'Switch To' profile.

  1. Enter the command LSWPPRF. The Switch Options for System User screen appears.

  2. Enter a reason for the switch in the Reason for Switching field. This is a required field. Examples might be "I need elevated authority to reset the DST password" or "Using higher authority account to modify value in payroll file at HR's request".
  3. Enter a Call Ticket number if requested to do so by your organization.
  4. Enter 1 next to the profile you would like to switch to and press Enter.

Swapping and releasing in batch jobs works the same as in interactive jobs, except:

  • Using a switch definition in batch is only possible if the batch environment is enabled on that switch definition.
  • When the LSWPPRF command is run, in an interactive environment, you will normally be prompted to provide input. In a batch environment, the batch program has to provide the switch profile and any other info, such as the ticket #, as command argument.
  • There are no screencaps.

Effects of Switching Profiles

Switching Profiles provides a method of conferring more, or less, authority to an active job. As with any object, authority is checked when it is used. When a profile switch occurs, any open files and objects allocated by the original profile are accessible to the new profile. Any objects newly accessed will use the new profile's authority.

The switching process only changes the authority of the current job to run under the authority of the new profile. Other jobs that the user is signed onto at the same time are not affected. Switching profile does not affect current job attributes such as Accounting Code, Library List, Attention Program, etc. The one exception is that the user can select to change their default Output Queue when switching profiles.

To see this option, type the LSWPPRF command, and press F4, and then F10.

Any object created by the job while running under the new profile is owned by the new profile, or its group profile if so configured, because the user authorities have been switched.

It is important to note that IBM menus are determined at the beginning of the job, and are not changed once the user assumes new authority. So for example, if switching from a 'high' authority to a 'low' authority, the IBM menu will retain the 'high' authorities menu options. (For a detailed discussion on object authority and how it works see the IBM i Security Reference manual.)

Identifying the Current Profile

For a convenient reminder of you current profile, use the command LWHOAMI.

A message displays at the bottom of the screen confirming that the System User switched into the APMOD Switch Profile.

Releasing a Profile

Once a user has completed their necessary tasks using a profile with higher authority, they should switch back to their original profile. This process is called "releasing the profile."

To release the current profile, enter the command LRLSPRF.

The message "[Swapped Profile] Authority has been released" displays at the bottom of the screen, confirming that the authority has been released.

NOTE: System Users can switch from one profile to another, and then into another profile, provided that they are not timed swaps. The switch pair setup must be configured for both of the swapped users in advance to allow each swap (e.g. Frank swaps into SYSADM and then, from there, into QSECOFR).

Authority Broker automatically does a release each time you swap into a new profile when it is a NON-TIMED swap.

See also Calling Authority Broker from a Program.

 

Previous - Configuring Switch Pairs Next - Working with Screen Captures