In the past many of us have created shortcut commands for operations like WRKACTJOB(Work with Active Jobs), or WRKSBMJOB(Work with Submitted Jobs). For WRKACTJOB, maybe the shortcut command was WA, for WRKSBMJOB, maybe WS. I've seen a lot of SO commands that are used to be a shortcut to SIGNOFF.

When we created those commands in the past, we typically used CRTDUPOBJ(Create Duplicate Object), or maybe even used source code to create a Command Definition Object(*CMD) that called a CL program that in turn ran the command. You may have used a different method, but most of us created some type of shortcut commands.

In some cases, depending on the way we created the shortcuts, we discovered that our shortcut commands would not run at QSECURITY level 40, since we were calling IBM internal programs without going through a sanctioned IBM APIs. In helping customers move from QSECURITY level 30 to 40, I have seen this problem a few times.

Well, there is a better way of creating our shortcut commands. In fact, I would suggest replacing your existing shortcuts with the better method of using proxy commands. A proxy command is a *CMD type object that is easy to create, and has a definite advantage over any of the other methods we have used in the past.

In the past, our duplicate commands may not have had the same security restrictions that were placed on the original version of the command. For example, an IBM supplied command may have been shipped with *PUBLIC AUT(*EXCLUDE), while our duplicate version may have been assigned an authority of *PUBLIC AUT(*ALL). And again, depending on how we created these shortcut commands, we may have introduced new exposures.

A proxy command for WRKACTJOB may be created as simply as:

CRTPRXCMD CMD(QGPL/WA) TGTCMD(WRKACTJOB)

The WA proxy command created here is a *CMD object that may be assigned a different authority than WRKACTJOB, but, in order to run the command the user needs *USE authority to both the proxy command and the original command.

IBM has made extensive use of Proxy commands in V5R4. For example, the IBM PDM(Program Development Manager) commands live in the IBM library QPDA. But, IBM has created proxy commands in library QSYS, so that you do not need to add QPDA to your library list in order to access PDM functions.

When you prompt a proxy command with F4=Prompt, the original command is prompted. If the original command contains a PRODLIB value, that library will be added to the library list when the proxy command is run. In effect, the proxy command is a pointer to the original command, and is not independently executable. It just points to the original command for almost all operations, except operations like MOVOBJ, DLTCMD, etc.

To learn more about proxy commands, and the benefits, refer to the IBM information Center documentation for CRTPRXCMD(Create Proxy Command) and information on the CL Syntax used for CRTPRXCMD.