User Authority Requirements

It is not necessary to set the USER parameter to QSECOFR, but the user parameter you supply must have the following authorities:

*USE authority for objects QSYS/QSYGETPH and QSYS/QSYRLSPH.
*ALLOBJ authority is not required, however, the connecting client user profile must provide *USE authority and *OBJMGT (Object Management) to the user profile that started the Dispatcher. This requirement is necessary because the user profile that started the Dispatcher is then allowed to validate the connecting client user's i5/OS user profile and password.
*SECADM authority is not required, however, the connecting client user profile will not be allowed to change its own expired password unless the user profile that started the Dispatcher has *SECADM authority. If you prefer to run the Dispatcher without *SECADM authority then you must provide alternative mechanisms for your end users to change their passwords. For more information, see Managing Passwords with System i TCP/IP Connections in the online help.
Note: If the connecting client user profile is the same user profile that started the Dispatcher, it does not require *SECADM authority for resetting its own expired password.