User without %Service_Login:U privilege gets a terminal with $username="irisowner" (or other IRIS startup account)

[gjsjohnmurray]

1. Create a user with only the %DB_IRISSYS role.
2. Launch iterm.
3. Authenticate as this user.
4. At the iterm prompt write $username and $roles.

🐛 You are running as the IRIS user corresponding to the Linux userid IRIS was started as, and you have the %All role

In step 1 you probably only need a role that gets you %DB_IRISSYS:U

[gjsjohnmurray]

iterm/src/iTerm/Engine.cls

Lines 74 to 75 in 9de583e

	if "USE" in iris.system.Security.CheckUserPermission(username, "%Service_Login"):
	self.writefd(f'write $system.Security.Login("{username}")\n')

I don't think this check is needed. Doc for the Login method says this permission is only required when passing a password, and then it's the caller who must have the permission, not the user that the caller is logging in.