The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →An RPGLE program can sit inside an IBM i account-setup workflow so that approved, routine requests finish without an operator working a help-desk ticket. It can do that only if the program’s authority, its inputs and its outputs are controlled at least as tightly as the manual process it replaces. In this article, “zero-ticket” means an approved request completes without manual ticket handling. It does not mean that access is granted automatically, that privilege is raised, or that IBM i security checks are skipped.
The sequence described below is a design pattern built from IBM’s documented rules. It is not tested code, a vendor recipe or an IBM-certified integration. The IBM documents cited here establish the security prerequisites for creating user profiles. They do not provide a complete RPGLE invocation method for any particular IBM i release.
As an Amazon Associate I earn from qualifying purchases.
What “zero-ticket” covers and what it does not
- Covered: a routine request that matches an approved role, maps to a reviewed profile template and passes validation can complete without an operator handling a ticket.
- Not covered: granting an entitlement simply because it was requested, creating a profile with special authority beyond its template, or bypassing object-level authority checks.
- Still human: incomplete, conflicting or elevated requests go to a review queue rather than being resolved by the program.
What an IBM i user profile is and why it limits the design
An IBM i user profile is the system identity a user needs to sign on and to access authorized functions and objects. IBM states that every system user needs one and that a system administrator must create each profile (IBM Documentation, “User profiles for IBM i,” IBM i 7.6). Because a profile is the unit of access, anything that creates or changes one carries the same weight as a manual administrator action.
Authority required to create a profile
The Create User Profile command, CRTUSRPRF, requires *SECADM special authority. It also requires authority to the objects a new profile references and to any group profile it joins (IBM Documentation, “Create User Profile (CRTUSRPRF),” IBM i 7.5). The table below lists the requirements that shape the design.
#1 Best Overall
- Learn the role of CL in the IBM i environment
- Understand the IBM i user interface and programming tools
- Recognize the data types supported by CL and when to use them
- Use program variables-including pointer-based variables and data structures
- Use structured statements to organize CL processing and control workflow
| Requirement | What IBM documents | Design consequence |
|---|---|---|
| *SECADM special authority | Required to run CRTUSRPRF; *SECADM allows a user to create, change and delete profiles (IBM Documentation, “Creating user profiles,” IBM i 7.5) | The creating identity must hold the authority on the target release. A general-purpose account should not be given it for convenience. |
| Authority to referenced initial program, initial menu, job description, message queues, output queues and attention-key programs | Listed as needed authorities in the command reference | Templates should reference only reviewed objects, and each reference must be checked for the authority it needs. |
| *CHANGE and *OBJMGT on a specified group profile | Required by the command reference | Group membership is a privileged step. The creating identity must hold this authority directly. |
| *OBJMGT on a group profile from a program adopt | Stated as not available from a program-adopt operation in the command reference | An adopting program cannot be the route to this authority. |
| Authority ceiling | A profile cannot be created with more authorities or capabilities than the creating user has (IBM Documentation, “Creating user profiles,” IBM i 7.5) | A request that asks for more than the creator can grant must fail safely or be routed for review. |
| Self-authority on the new profile | The profile receives *CHANGE and *OBJMGT on itself, which IBM says should not be removed for normal operation | Automation must not strip these authorities in an attempt to tighten the profile. |
Can an RPG program create an IBM i user profile?
An RPG program can issue CRTUSRPRF, provided the program runs under an identity that meets the prerequisites above on the target release. The cited IBM documents do not establish a complete, release-specific RPGLE method for doing so, so the calling mechanism has to be verified locally before it is relied on.
Can adopted authority be used for CRTUSRPRF?
The cited IBM documents do not establish that adopted authority satisfies the CRTUSRPRF prerequisites on a given release. They do rule out one route: the command reference states that required *OBJMGT authority to a specified group profile cannot be supplied by a program-adopt operation. Adopted authority is therefore not a dependable way to meet every CRTUSRPRF requirement, and any configuration that appears to work should be treated as unverified until it has been checked on the target release and reviewed as a privileged path.
Why a broadly privileged service profile is the wrong shortcut
A service profile with broad authority is the easiest way to make a workflow succeed, and it is the wrong one. IBM’s special-authority guidance on IBM Support states: “Giving special authorities to users represents a security exposure. For each user, carefully evaluate the need for any special authorities.” (IBM Support, “Special Authorities,” modified 04 October 2024)
The same page explains that *ALLOBJ does not replace other special authorities: “A user with *ALLOBJ authority cannot directly perform operations that require another special authority. For example, *ALLOBJ special authority does not allow a user to create another user profile, because creating user profiles requires *SECADM special authority.” (IBM Support, “Special Authorities,” modified 04 October 2024)
The practical lesson is that the provisioning identity should hold only the specific authorities the workflow needs, reviewed periodically, and no more.
The provisioning pattern
The steps below are an editorial synthesis. They are organized by the job each step does in the workflow.
Intake and validation
Accept requests only from a trusted upstream identity or access-governance process. Each request should carry a stable requester and subject identity, an approved role, the target system, a request identifier, and any required expiry date or manager approval. Confirm that the subject exists in the authoritative source and that the requested role is approved. Reject arbitrary caller-supplied special authorities, group names, initial programs and command fragments. Validation should use an allowlist of approved values, not a blocklist of known bad ones.
Template mapping and execution
Map each approved role to a small set of reviewed profile templates. Templates should follow least privilege and use controlled group membership. A convenient initial menu is not an access boundary: IBM states that initial menus and programs do not completely restrict a user to specific tasks, and that object-level discretionary access control is still required (IBM Documentation, “User profiles for IBM i,” IBM i 7.6).
Pass only validated values through a fixed, protected IBM i operation. Escaping and parameter rules depend on the target release and must be confirmed there before deployment.
Repeat requests
Requests will be repeated, retried or sent twice. Before creating anything, the workflow should check whether the profile already exists. If it exists with the attributes the template would produce, the workflow should report completion without changing it. If it exists with different attributes, the workflow should stop and route the request for review. A profile that someone has changed independently must never be silently overwritten.
Audit trail
Record the request identifier, subject, selected template, operator or service identity, decision, result and time in an audit trail that is protected from ordinary users. Never log passwords or secret credentials. Which audit facilities are available depends on the target environment’s configuration, so the trail’s location and retention should be confirmed locally.
Free tools Windows power users keep installed
One-click scans. No signup required.
Notifications and exceptions
Send successful outcomes to the requester. Place incomplete, conflicting or elevated requests in a human review queue. This keeps exception handling in place even though ordinary cases avoid tickets.
Periodic review
Compare intended role mappings with the authorities users actually hold, and review them on a schedule. Treat adopted authority as a separate question where programs are involved, because it is not part of a simple profile-field check (see the effective-authority section below).
Where adopted authority fits
Adopted authority is a privileged program mechanism, not a general shortcut around authorization. A program that adopts its owner’s authority runs with that authority while it executes, and IBM calls for careful control over it (IBM Documentation, “Objects that adopt the owner’s authority,” IBM i 7.5). IBM specifically advises against adopting the authority of an IBM-supplied profile. It also notes that restoring an adopted-authority program in certain circumstances revokes its private and public authorities, as a security protection.
If a team considers a narrowly scoped, owned program as the privileged boundary for provisioning, the review should cover the program object, its owner, the adopted attributes, its callable interface, who holds authority to run it, input validation and logging. Adoption does not remove the need to authorize callers, and it does not make unrestricted account creation safe.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Effective authority: why profile creation is not the end of the review
Effective authority can come from private authorities, authorization lists, group profiles, adopted authority and IFS inheritance. IBM’s inventory method follows a documented precedence across direct user, authorization-list, group and public authority, but it explicitly excludes dynamically adopted authority (IBM Support, “IBM i Security Analysis: Determining a User’s Effective Authority,” IBM i 7.3 and later). A review that checks only a profile’s direct fields is therefore incomplete. Adopted authority needs its own check.
Best Value
- Use the described principles as a basis for architecting complex applications
- Build web services according to the best standards currently available
- Significantly reduce the time spent discovering and fixing code errors
- Design architectures that are testable and predictable
- Build secure applications by protecting yourself against most known attacks
Role-based and request-based models
IBM Verify Identity Governance documentation describes role-based and request-based access provisioning models (IBM Documentation, “Access provisioning models,” IBM Verify Identity Governance 11.0). The cited material does not establish a particular out-of-box RPGLE integration, or that these models create IBM i profiles directly in every deployment. The table compares the two approaches along the axes that matter for this pattern.
| Axis | Role-based automatic provisioning | Request-based provisioning |
|---|---|---|
| Trigger | Approved role assignment | An individual access request |
| Approval point | Policy is embodied in the role assignment | An explicit manager or administrator approval |
| Exception handling | Conflicting, elevated or incomplete cases must be paused for review | Conflicting, elevated or incomplete cases must be paused for review |
| Entitlement mapping | Roles translate to profiles, groups and resource authorities | The requested entitlement must be checked against the reviewed template before use |
| Reviewability | The organization must be able to reconstruct who requested, approved, assigned and reviewed access | The same reconstruction requirement applies |
What the evidence does and does not establish
- Established: the CRTUSRPRF authority prerequisites in the IBM i 7.5 command reference, the authority ceiling and self-authority rules in IBM’s profile-creation guide, IBM’s special-authority guidance (IBM Support page modified 04 October 2024), IBM’s cautions on adopted authority, and IBM’s effective-authority method.
- Not established: a complete RPGLE invocation of CRTUSRPRF or any other interface, command wrapping for a specific release, the target environment’s audit facilities, or a specific identity-governance integration.
- Not quantified: no ticket-reduction figure, error rate, adoption time or return on investment is cited here. Any such claim would need its own published source.
Treat the pattern as a set of controls to verify on your release, not as finished code.
IBM Support, “Special Authorities” and IBM Documentation, “Create User Profile (CRTUSRPRF)” are the primary references for the authority decisions described above.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
