Connecting to DB2

Performing SAF call

SAF call performed

Connecting with primary ID

Logonid defined for each ID

Associating with secondary IDs

Supported, but UID might replace

Protecting DB2 data sets

Use CA ACF2 access rules

Retrieving data through DDF

Supported

These resources are protected through privileges and ownership concepts:

• Databases

• Databases

• Tables and views

• Tables and views

• Storage groups

• Storage groups

• Table spaces

• Table spaces

• Buffer pools

• Buffer pools

• Application plans

• Application plans

• Packages

• Packages

• Collections

• Collections

• Indexes

• Indexes (through table rules)

• System privileges and utilities

• System privileges and utilities

• Functions

• Functions

• Stored procedures

• Stored procedures

• Schemas

• Schemas

• Distinct types

• Distinct types

• JAR files (DB2 Version 7.1 and
  above)

• JAR files

• Sequences (DB2 Version 8.1 and
  above)

• Sequences

• Roles (DB2 Version 9.1 and above)

• Roles

• Trusted contexts (DB2 Version 9.1 and above)

• Trusted contexts

Multiple DB2 subsystems

Create multiple DB2 OPTS infostorage records with different SYSIDs—use maskable $SYSID or Group SYSID. Assign the same GSYSID value to each different subsystem and use that value in the $SYSID rule.

Explicit privileges (GRANT/REVOKE)

Use CA ACF2 Option for DB2 rules

Implicit ownership

Use $UIDOWNER/$LIDOWNER in rules

Executing plans or packages

Create, compile, and store rule

Subsetting tables through use of views

Same as DB2

UPDATE and REFERENCES privileges to a selected column

Use SERVICE and COLUMN on rules

Using primary or secondary IDs to control access

UID determines access—Secondary IDs are supported if needed

Granting PUBLIC access

Specify UID(*) on rules or insert resources on SAFELIST

Granting access to an object

Create, compile, and store rule

Dropping an object

Does not affect privileges

Changing object’s ownership

Change, recompile, and store rule

Not available

Grouping resources

Grouped authorities:

Use CA ACF2 Option for DB2 rules or privileges

• ACCESSCTRL

Use $KEY(ACCESSCTRL) on rule

• DATAACCESS

Use $KEY(DATACCESS) on rule

• DBADM

Use SERVICE(DBADM) on database rule

• DBMAINT

Use SERVICE(DBMAINT) on database rule

• DBCTRL

Use SERVICE(DBCTRL) on database rule

• PACKADM

Use SERVICE(PACKADM) on collection rule

• Install SECADM

Use $KEY(SECADM) on rule

• Install SYSOPR

No rule—same as native DB2 security

• Install SYSADM

No rule—same as native DB2 security

• SQLADM

Use $KEY(SQLADM) on rule

• SYSADM

Use $KEY(SYSADM) on rule

• SYSCTRL

Use $KEY(SYSCTRL) on rule

• SYSOPR

Use $KEY(SYSOPR) on rule

• System DBADM

Use $KEY(SYSDBADM) on rule

BINDAGENT

Use $KEY(BINDAGENT.logonid) on rule

No equal authority

Scoped SECURITY

WITH GRANT OPTION

Use %CHANGE or %RCHANGE

REVOKE cascade effect

No cascade effect

Not available

Shift and zone processing

Updates catalog with GRANT/REVOKE

Does not update or reference catalog

Checks catalog during validation

Checks CA ACF2 Option for DB2 rules

Checks at bind or execution for binding of plans or packages (static SQL)

Checks when DB2 does

Checks owner during bind of plan or package

Checks owner during bind

use of security tables

Not needed—uses CA ACF2 Option for DB2 rules and DB2 records instead

Sign‑on/attach connection exits

Still available

All GRANTs in catalog

Conversion utility creates rules

Use infostorage record to phase in subsystems

Use infostorage record to phase in subsystems

Use infostorage record to phase in resources

Use $MODE in rules to phase in rule sets