inclusive security not working on APP servers

[pshearer]

Hello All,

We have a client we two seperate 8.11SP1 / 8.98.2.4 installs. Both installs are configured with "inclusive" security. Starting a few days ago batch processes began ingoring the inclusive row security and running wide open. Interactive application applied the row security properly.

In our non-production install APP servers apply the inclusive row security properly. We have tested copying the F00950 table from our PROD install to our non-PD install and tested. Non-PD continued to function properly.

We have verified that System and Server Map are both pointing the the same F00950 table. Whats really wierd is that if I create row security specifcally exclused data ranges that works. Its like the APP servers think they are set to 'EXCLUSIVE' security.

 

[lrh]

Hi,

Are you on the AS/400? If so have you checked your SQL packages?

Are you running on Fat or Web? If your on the Web have you cleared out the cache?

Can you disclose any details of what changed in your environment at the time this stopped working?

Thanks,

 

[pshearer]

Our problem was caused by duplicate role sequence numbers. Had to run a find dup query against the F00926 table and then determine which sequence number / role to delete. All is now well.

 

[Maria Pardo]

Hi
To troubleshoot row security you need to look at the SQL statements to see how the actual row security is applied within the ‘where’ clause. I learned from an alloutsecurity training course.

 

[LambrosG]

Hi all,
we had some issues with exclusive row security till we used the Alloutsecurity modules. By using Allout programs we had an automatic conversion from exclusive to inclusive row security with zero errors and no downtime at all. In addition using the 'Combiroles' program I managed to fix role conflicts or merge roles in minutes. Now,I'm about to go from 'open' to 'close' system using their module for 'Deny ALL'.
If you have any security issues I totally recommend Alloutsecurity programs.

 

[BPConnor]

Paul,
any idea what caused the dup role seq numbers? Good to know the cause and add it to the things to check list.