Skip to Main Content
IBM Power Ideas Portal

This portal is to open public enhancement requests against IBM Power Systems products, including IBM i. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (

Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas
  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.

Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal ( - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal ( - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM. - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.

Status Delivered
Workspace IBM i
Categories IBM i Access Family
Created by Guest
Created on Aug 29, 2016

Security for i Access Client Solutions

We need an option to setup the minimum Version of iAccess client Solutions (iACS) which is allowed to connect to a system i LPAR.

Additional we need to be able to restrict some functions / modules of iACS to be executed on a system i LPAR for default users and *ALLOBJ users.

Use Case:

In the earlier versions of iAccess Client Solutions (iACS) there was a security problem.

As iACS uses object based authority settings, but some even older applications running on the i using application based authority and additional security optiones to be setup as e.g. function usage.

Some of these security issues are fixed in later versions of iACS (e.g. allow/deny host prointing by using function usages since iACS

Some new features of iACS are dangerous (e.g. the integrated file system module)

In the integrated file system module a user without special athorities can change from his home directory to / (root) or to /qsys.lib/abc.lib and delete objects within this path. As mentioned the objects can't get a more restricted athorisation because our applictaion uses internal functions to allow the users to get access to the objects and it needs the object autorities as they are. Even if changing the autority would be possible within the libraries of our application we woudn't be able to set the *PUBLIC athority of / or /qsys.lib to *EXCLUDE. If we do so the OS is getting in trouble.

Customers are able to deploy a version of iACS where modules which aren't /shouldn't be used by the employees are removed. But this doesn't protect the data on the system.

Even if we deploy a version of iACS with less modules. Someone who wants to get access to our data only needs the full version of iACS. With this full version he will be able to use the modules we removed from the version of iACS we've deployed.

So deploying a restricted Version is some kind of client based security but we need host based security as we used to have with client access for windows before.

Even if new security features are implemented in newer versions of iACS. The old versions will get access to the data without using this security enhancements. Therefore we need a possibility to deny the access to the system with iACS Versions older than a specific one we want to use on our systems.

We also need the possibility to restrict the usage of the modules like
-data transfer
-5250 emulator
-integrated file system
-navigator on i
-printer output

-run SQL scripts
-SQL performance manager

for default users and *ALLOBJ user level on host level.

Idea priority Urgent
  • Guest
    Feb 17, 2017

    This support is available in the update delivered in January 2017. For additional information, see:

  • Guest
    Jan 18, 2017

    This support will be available in the update delivered in January 2017.

  • Guest
    Jan 12, 2017

    IBM has received this requirement and is evaluating it. A response will be provided when evaluation is complete.

  • Guest
    Aug 30, 2016

    Creating a new RFE based on Community RFE #93691 in product IBM i.