How-toInfor XA (IBM i)Security / User Administration

Infor XA User List Report: Users, Status and Access for an Audit

Question
infor xa user list report

Also searched as

  • infor xa list of users and authorities
  • infor xa user access report for audit
  • ibm i user profile report for xa audit

Short answer

Infor XA runs on IBM i, so a complete user list is built from two layers: the IBM i user profiles (who can sign on, status, last sign-on, group profiles, special authorities) and the XA application security tables (which menus, functions and facilities each user may run). Export the first with DSPUSRPRF or the QSYS2.USER_INFO view, add the second from your XA security setup, and join them by user ID.

Applies to: Infor XA (formerly MAPICS XA) on IBM i. Commands apply to any supported IBM i release; the QSYS2.USER_INFO view needs IBM i 7.2 or later.

Produce the user list and access report

  1. 1Sign on to the IBM i partition with a profile that has *ALLOBJ or *SECADM authority (or delegated audit authority) so every profile is visible.
  2. 2Export all profiles to a file: DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*OUTFILE) OUTFILE(QTEMP/XAUSERS). This gives status, last sign-on, password-expired flag, group profile, user class and special authorities.
  3. 3Alternatively query the view from STRSQL or a SQL client: SELECT AUTHORIZATION_NAME, STATUS, LAST_SIGNON_DATE, USER_CLASS_NAME, GROUP_PROFILE_NAME FROM QSYS2.USER_INFO ORDER BY AUTHORIZATION_NAME.
  4. 4Filter to the XA population: keep only profiles that belong to your XA user group or that have authority to the XA production libraries (use DSPOBJAUT or the AUTHORIZATION_LIST views for the libraries).
  5. 5Pull the XA-side access: export the XA user-to-function or user-to-menu security setup from the XA security maintenance tables in your environment, and join to the profile list by user ID.
  6. 6Flag exceptions: *DISABLED profiles still holding XA access, profiles with no sign-on in 90 days, profiles with *ALLOBJ, and shared or generic IDs.
  7. 7Save the output to Excel or CSV with the run date, system name and who ran it, and keep it with the audit evidence.

Why two layers of access exist

An auditor asking for the XA user list usually wants proof of who can do what in the ERP. On IBM i that answer lives in two places. The operating system decides who can sign on and which objects (libraries, files, programs) a profile can touch. XA then decides which application functions a signed-on user can run.

If you only report the IBM i layer you show who exists, not what they can do in order entry, purchasing or the general ledger. If you only report the XA layer you miss users with broad object authority who could bypass the application entirely. A credible report covers both and states which version of each it reflects.

IBM i side: commands and SQL

DSPUSRPRF with OUTPUT(*OUTFILE) writes a database file you can query or download, which is more useful for an audit than a printed spool. DSPAUTUSR gives a compact list of profiles with their group and password status and also supports an outfile.

On IBM i 7.2 and later the QSYS2.USER_INFO view returns the same information in SQL, including last sign-on date and whether the profile is enabled, so you can run it from ACS Run SQL Scripts and export directly. Use it for repeatable quarterly reviews instead of ad hoc green-screen output.

DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*OUTFILE) OUTFILE(QTEMP/XAUSERS)
SELECT AUTHORIZATION_NAME, STATUS, LAST_SIGNON_DATE, USER_CLASS_NAME,
       GROUP_PROFILE_NAME, TEXT_DESCRIPTION
FROM QSYS2.USER_INFO
WHERE STATUS = '*ENABLED'
ORDER BY LAST_SIGNON_DATE

XA application security side

XA maintains its own security definitions for menus and functions, set up through the XA security and user maintenance functions. The exact tables and screens depend on your XA release and whether you use the older menu-level security or finer function-level settings, so confirm with your XA administrator or the vendor documentation before promising an auditor a specific file name.

Treat the XA export as a join target: one row per user and function, then summarise to roles or groups for readability. Segregation-of-duties checks (same user can create and approve a purchase order, or enter and release a payment) are the findings auditors care most about.

Try it here, free

Infor XA (MAPICS) User Access Review Worksheet

Open full tool

Review each user profile, last sign-on, role and conflicting duties, with a days inactive figure and review decision.

Common pitfalls

  • !Reporting only IBM i profiles and calling it an application access report.
  • !Leaving former employees *ENABLED because the XA side was cleaned up but the operating system profile was not.
  • !Missing group profile inheritance: a user can gain object authority through a group profile that never shows on their own record.
  • !Running the report without *ALLOBJ or audit authority and silently getting an incomplete list.
  • !Treating generic or shared IDs (such as a shop floor terminal profile) as normal users instead of listing them as exceptions with a named owner.

How an ERP-grounded AI assistant handles this

An assistant grounded in your IBM i and XA data can answer the audit question directly, such as which enabled users have not signed on in 90 days and still hold purchasing approval, by running read-only queries over the profile and security files and showing the query it used. Netray's private AI layer runs on-prem next to the IBM i partition, so user and authority data never leaves your network.

See ERPray

Frequently asked questions

How do I list all users in Infor XA?

Start at the IBM i layer: DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*OUTFILE) or the QSYS2.USER_INFO view lists every profile with status and last sign-on. Then add XA application security data and join by user ID so the report also shows which functions each user can run.

Can I see when an XA user last signed on?

Yes at the operating system level. Both DSPUSRPRF and QSYS2.USER_INFO show the last sign-on date for each profile. That is system sign-on, not necessarily the last time the user ran a specific XA function, which would need job logs or journal data.

What do auditors usually ask for besides the user list?

Typically the approval process for new and changed access, evidence that terminated users were disabled promptly, a list of users with powerful special authorities, and a segregation-of-duties review of finance and purchasing functions. Keep dated exports as evidence.

Do I need a special tool to produce this?

No. Native IBM i commands and SQL are enough for the profile layer, and Excel handles the join and filtering. Third-party IBM i security tools add scheduling and richer reports, but they are not required for a basic audit extract.

Related

How-to

Infor XA REST API: expose XA through IBM i Integrated Web Services or ION

Infor XA has no single built-in REST API. Practical routes are IBM i Integrated Web Services (IWS), which turns RPG or SQL routines into REST endpoints on the same machine, and Infor ION where your environment supports it. For reads, SQL-backed services are straightforward. For writes, call XA's own programs so business rules run.

How-to

Infor XA Net.Link: what it is, how it is configured and common issues

Net.Link is the web access layer associated with Infor XA (formerly MAPICS XA) that exposes XA functions through a browser, running on an IBM i web application server. It depends on the IBM i version, the web server profile and Java runtime, so most problems after changes trace to those components. Details vary by XA release, so confirm against your installation guide.

How-to

Infor XA costing: cost types, roll-up and standard cost setup

Product costing in Infor XA builds an item's cost from its material, labor, and overhead using the bill of material and routing. Standard cost is the frozen planning cost used to value inventory and measure variance, while other cost sets are used for current or simulated views. A cost roll-up calculates costs from the lowest BOM level upward. Exact program names and options vary by release.

Advanced

Infor XA PowerLink (Power Link), SIWA and Net-Link: What Each Does and Your Options

Infor XA runs on IBM i with a 5250 green-screen core. PowerLink (also written Power Link) and Net-Link are the interface layers Infor offered to put a more modern or web face on that core, and SIWA is another piece of XA's interface and integration tooling. Because naming and packaging changed across releases, confirm exactly what is installed before planning any change.

How-to

Infor XA Factory Track: What It Does and How to Plan Shop Floor Data Collection

Factory Track is the shop floor data collection offering associated with Infor XA. It captures labor, job and material transactions at the work centre, often with bar code terminals, and posts them to XA production control so that job status, costs and inventory stay current without re-keying. Details differ by release, so check your documentation before configuring anything.

Advanced

How to add a private AI layer to Infor XA on-prem

Infor XA keeps its data in Db2 for i on IBM i, so the safest way to add AI is a read-only reporting copy or logical-file access over JDBC or ODBC, a retrieval index over documents, a small tool server that exposes approved queries, and an open-weight model served on local GPUs. Nothing has to leave the building, and any write-back goes through the supported XA transaction programs after a person approves it.

AI for ERP

AI for Infor XA on IBM i: On-Prem, No Replatforming Required

Add AI to Infor XA on IBM i (AS/400) without a migration project. Read DB2 for i directly, ground answers in live XA data, keep everything on-prem.

AI for ERP

A Private LLM Grounded on Your ERP Data

How a private LLM answers questions on your ERP data: RAG plus text-to-SQL, role-based permissions inherited from the ERP, and where each fits.

Stuck on Infor XA (IBM i)?

Talk to engineers who work inside Infor XA (IBM i) every week, and who build private AI that answers these questions from your own ERP data.

Talk to an ERP engineerBrowse ERP Help
All ERP Help articles

Keep exploring

Free tools

ERP fixes and how-tos

Guides

AI on your ERP

Integrations

Software

TermsSegregation of Duties (SoD)