Getting Started

Overview

IBM i (AS/400) is IBM’s midrange operating system. With the Britive Access Broker, you grant just-in-time access by creating a short-lived user profile at checkout and deleting it at checkin. The broker runs the same logic through one of three transports — IBM Access Client Solutions (ACS) as the primary path, with PowerShell-over-SSH and Bash-over-SSH as fallbacks.

What you’ll accomplish:

Prepare an automation service profile on the IBM i system
Create checkout/checkin permissions that add and remove user profiles
Verify a profile is created at checkout and removed at checkin

The upstream scripts are marked DRAFT in the source repo. Test them against a non-production LPAR and adapt to your environment before relying on them.

Before You Begin

The Access Broker is deployed and connected
An automation service profile on the IBM i system with *SECADM authority (and *ALLOBJ if broad grants are needed)
SSH enabled on the system: STRTCPSVR SERVER(*SSHD), and the automation profile allowed to log in via SSH
The automation profile able to run CRTUSRPRF, CHGUSRPRF, DLTUSRPRF, and GRTOBJAUT
On the broker host: PowerShell 7+ and an SSH client; for the ACS path, IBM Access Client Solutions with acslaunch_win-64.exe and the system command on PATH

Never hardcode the admin credentials. Inject AS400_ADMIN_USER and AS400_ADMIN_PASS as broker environment variables.

How It Works

Britive injects a single set of environment variables for both actions; the broker selects checkout or checkin via AS400_ACTION.

Variable	Description
`AS400_HOST`	Hostname or IP of the IBM i system
`AS400_ADMIN_USER`	Admin profile with authority to manage users
`AS400_ADMIN_PASS`	Admin password
`AS400_NEW_USER`	User ID to create or remove
`AS400_NEW_USER_DESC`	User profile description
`AS400_ACTION`	`checkout` or `checkin` — set automatically by Britive

checkout → CRTUSRPRF USRPRF(<new_user>) ... TEXT('<desc>')
checkin  → DLTUSRPRF USRPRF(<new_user>)

The three script variants run the same CL commands over different transports:

Script	Transport	Use when
`as400_acs.ps1`	IBM ACS `system` command	Primary — ACS installed on the broker
`as400_ssh.ps1`	PowerShell over SSH	ACS unavailable (Windows broker)
`as400_ssh.sh`	Bash over SSH	Linux/Mac broker host

Scripts

Full scripts: britive/access-broker-examples — IBMAS400/permissions

Bash + SSH (as400_ssh.sh) — representative logic:

IBMAS400/permissions/TemporaryUser/as400_ssh.sh

if [ "$AS400_ACTION" = "checkout" ]; then
  CMD="CRTUSRPRF USRPRF($AS400_NEW_USER) TEXT('$AS400_NEW_USER_DESC')"
else
  CMD="DLTUSRPRF USRPRF($AS400_NEW_USER)"
fi

sshpass -p "$AS400_ADMIN_PASS" ssh "$AS400_ADMIN_USER@$AS400_HOST" \
  "system \"$CMD\""

The ACS and PowerShell variants run the equivalent CRTUSRPRF / DLTUSRPRF commands through the ACS system command or ssh from PowerShell.

Configure in Britive

Create a resource type

Go to Resource Manager → Resource Types → New Resource Type. Name it IBM-i-System and add a host parameter.

Create a permission

Go to Resource Manager → Resource Type Permissions → New Permission. Set Language to Shell (Bash) or PowerShell depending on the variant you use.

Paste the script into both the Checkout and Checkin fields — the script branches on AS400_ACTION. Declare variables:

Variable	System defined	Notes
`AS400_ACTION`	Yes	Set to `checkout`/`checkin` by Britive
`AS400_HOST`	No	System hostname or IP
`AS400_ADMIN_USER`	No	Automation profile
`AS400_ADMIN_PASS`	No	Automation profile password
`AS400_NEW_USER`	No	Profile to create/remove
`AS400_NEW_USER_DESC`	No	Profile description

Create a profile and policy

Create a profile (e.g. expiration 2h), associate the IBM i resource, add the permission, then add a policy assigning members (users or tags).

Test the script manually on the broker host before wiring it into Britive:

export AS400_HOST="ibmi.example.com"
export AS400_ADMIN_USER="QAUTO"
export AS400_ADMIN_PASS="<password>"
export AS400_NEW_USER="JITUSER1"
export AS400_NEW_USER_DESC="Britive JIT user"

AS400_ACTION=checkout ./as400_ssh.sh
AS400_ACTION=checkin  ./as400_ssh.sh

Verify

Check out the profile

Navigate to My Access → find the profile → Check Out.

Confirm the user profile exists

On the IBM i system:

DSPUSRPRF USRPRF(JITUSER1)

The profile is displayed.

Check in

Return to My Access → Check In.

Confirm the profile is removed

DSPUSRPRF USRPRF(JITUSER1)
# Expected: CPF2204 - User profile JITUSER1 not found.

Troubleshoot

Symptom	Cause	Fix
`CPF2204` on checkout failure	Admin profile lacks authority	Grant `SECADM` (and `ALLOBJ` if needed) to the automation profile
SSH connection refused	SSHD not started on IBM i	Run `STRTCPSVR SERVER(*SSHD)` and allow the automation profile to log in
ACS `system` not found	ACS not on `PATH`	Add `acslaunch_win-64.exe` and the `system` command to the broker `PATH`
Profile not deleted at checkin	`AS400_ACTION` not passed	Confirm Britive injects `AS400_ACTION=checkin` on check-in

Next Steps

Deploy the Access Broker if you haven’t already
Source: britive/access-broker-examples — IBMAS400

Last updated on July 8, 2026