Notes on Security Statement Syntax › Expansion of Authorization Identifier › Expansion of Authorization Identifier Usage

Expansion of Authorization Identifier Usage

User Catalog Definition

The CREATE/ALTER/DROP statements for USER manipulate the definitions of user-identifier in the user catalog. Similarly, the CREATE/ALTER/DROP statements for GROUP manipulate the definitions of group-identifier in the user catalog.

When you specify authorization-identifier in any other security statement (or in the ADD USER parameter of CREATE/ALTER GROUP), authorization-identifier must be defined in the user catalog if either of these is true:

• The identifier is a user-identifier and security on the specified resource is enforced by CA IDMS internal security.
• The identifier is a group-identifier.

If authentication of users is handled by an external security system, user-identifier need not be defined in the user catalog.

Authorizing a User to Update a Table

In the following GRANT statement, the authorization identifier is the user identifier RES:

grant update
   on table employee
   to res;

Revoking Execution Privileges from a Group

In the following GRANT statement, the authorization identifier is the group identifier ACCT_GRP_1:

revoke execute
   on category emp_update
   from acct_grp_1;