Security on role selection on logon screen

We are running 8.12 on 8.97 and currently have multiple roles assigned to users. However, we would like to restrict them to only being able to access certain roles through role chooser, primarily *ALL or an enquiry role and are trying to avoid having more than one logon account for users.

My question is - can you assign security to the initial list of roles that are visible on the logon screen as row security on the F95921 does not work at that point.

Just to clarify, if USER01 has roles ROLE_A, ROLE_B, ROLE_C and ROLE_ENQ, if they use role chooser we would only like them to have be able to select *ALL or ROLE_ENQ and not be given the option for the other roles. Any help on this would be appreciated.

There's a JAS.INI setting you can use to force users to select *ALL. I don't recall the exact parameter and value right now.

If you want users to select only a specific role then you will need to setup only one of their roles to be included in *ALL and then have the rest of their assigned roles not be included in *ALL. This will force them to log in as a specific role then.

However, you can't enforce both scenarios above since the JAS.INI setting will allow them to only select *ALL.

Based on my understanding…
1) User has Roles: *ALL, A, B, C, Q
2) User needs to only login with *ALL or Q
You cannot satisfy the requirement vanilla.