pop modify

Modifies protected object policies.

Requires authentication (administrator ID and password) to use.

pop modify pop_name delete attribute attribute_name [attribute_value]

pop modify pop_name set attribute attribute_name attribute_value

pop modify pop_name set audit-level {all|none|audit_level_list}

pop modify pop_name set description description

pop modify pop_name set ipauth add network netmask level

pop modify pop_name set ipauth anyothernw level

pop modify pop_name set ipauth remove network netmask

pop modify pop_name set qop {none|integrity|privacy}

pop modify pop_name set tod-access {anyday|weekday|day_list}:{anytime|time_spec-time_spec}[:{utc|local}]

pop modify pop_name set warning {yes|no}

The pop modify command modifies a protected object policy (POP). When we use the set ipauth add or set ipauth remove options, we can specify the IP addresses. The values for the network and netmask options are TCP/IP addresses. These IP addresses can be specified by using either version 4 (IPv4) or version 6 (IPv6) notation. Both the network and netmask options must be specified in the same IP version. When we use IPv6 notation, do not use prefix notation when we specify IP addresses. When we specify IP addresses, be aware of the following restrictions:

For an IPv6 address to be accepted (commands, C APIs, and Java methods), the server must be IPv6. We cannot provide an IPv6 address to an IPv4 server.

The operating system functions that are provided to ISAM have certain limitations. Regardless of C or Java clients, IPv4 addresses must be in IPv4 format when we add addresses to a POP.

Options

pop_name
Name of the protected object policy to be modified. The POP must exist, or an error is displayed.

set attribute attribute_name attribute_value
Set or modifies the specified value from the specified extended attribute key in the specified POP. If the attribute exists, the attribute value is added as an additional value if the same value does not exist for this attribute. If the same value exists for this attribute, it does not get added again (duplicate values are not allowed), and no error is returned.

The attribute_value sets the specified value from the specified extended attribute key in the specified POP.

Example: "Credit Card"

set audit-level {all|none|audit_level_list}
Set the audit level for the specified POP. The format of an audit_level_list is a comma-separated list that contains one or more of these audit levels: permit,deny,error,admin.

set description description
Set the description of the specified POP.

A valid description is an alphanumeric string that is not case-sensitive. String values are expected to be characters that are part of the local code set. If the description contains a space, enclose the description in double quotation marks. We can specify an empty string ("") to clear an existing description.

Example of description: "Policies of Jenson Corp."

set ipauth add network netmask level
Set the IP endpoint authentication settings in the specified POP. The values for the network and netmask options are TCP/IP addresses. These IP addresses can be specified by using either version 4 (IPv4) or version 6 (IPv6) addresses. Both the network and netmask options must be specified in the same IP version. The following values are supported for level:

    forbidden
    A value that prohibits object access.

    integer_values
    Application-specific integer values that define the step-up authentication levels. All integer values, except 1000, are supported. For information about step-up authentication, see the Administering topics in the IBM Knowledge Center.

set ipauth anyothernw level
Set the anyothernw (any other network setting) for the IP authentication level in the specified POP. If controlling access by IP address is not important, use the anyothernw option to set the authentication level for:

  • All IP addresses, and
  • IP address ranges not listed explicitly in the POP.

The following values are supported for level:

    forbidden
    A value that prohibits object access.

    integer_values
    Application-specific integer values that define the step-up authentication levels. All integer values, except 1000, are supported. For information about step-up authentication, see the Administering topics in the IBM Knowledge Center.

set ipauth remove network netmask
Removes the IP endpoint authentication settings from the specified POP. The values for the network and netmask options are TCP/IP addresses. These IP addresses can be specified by using either version 4 (IPv4) or version 6 (IPv6) notation. Both the network and netmask options must be specified in the same IP version.

set qop {none|integrity|privacy}
Sets the quality of protection level for the specified POP. The following string values are supported:

  • none
  • integrity
  • privacy

set tod-access {anyday|weekday|day_list}:{anytime|time_spec-time_spec}[:{utc|local}]
Set the time of day range for the specified protected object policy.

The day_list is a comma-separated list of days of the week, each of which is represented by a three-character value (for example, mon,wed,fri). The day_list specifies which days of the week the object can be accessed. To list every day of the week, specify anyday; if we do not want to include the weekend days, specify weekday.

The time_spec format is specified as hhmm and is expressed using a 24-hour clock (for example, 0900 for 9 a.m. or 1430 for 2:30 p.m.). Default is not defined, and the optional time zone is local by default. The time_spec value and time zone specify the time of day the object can be accessed. utc=GMT

set warning {yes|no}
Set the warning mode for the specified protected object policy. Valid values are yes or no.

Return codes

Examples

  • This example shows how to turn on the warning mode for the POP named test: 
    pdadmin sec_master> pop modify test set warning yes

  • This example shows how to set the audit level to audit all requests on a protected object that result in successful:

    • Access by using permit.
    • Denial of access by using deny.

  • This example shows how to set an attribute named attr1 with a value of valueA for the POP named pop1: 
    pdadmin sec_master> pop modify pop1 set attribute attr1 valueA

    See also

    pop attach
    pop create

    Parent topic: pdadmin commands