Before you start

Introduction

Label-Based Access Control (LBAC) is a security feature introduced in IBM® Informix® Dynamic Server 11. With LBAC, administrators can control read and write access of a user at the table, column, and row level. onmouseover="linkQueryAppend(this)"

About this series

This series consists of two tutorials: the first part covers the basic row protection and column protection; the second part contains more complex scenarios and introduces the use of exemptions.

This series is based on the tutorials originally published about using LBAC with DB2 entitled "DB2 Label-Based Access Control, a practical guide" by Carmen Wong and Stan Musker. This series is adapted for Informix Dynamic Server by Manjula Pathangani and Joseph Baric.

Back to top

About this tutorial

This tutorial provides a guide to using IDS' Label-Based Access Control (LBAC) security feature. LBAC controls access to table objects by attaching security labels to them. Users attempting to access an object must have its security label granted to them. When there's a match, access is permitted; without a match, access is denied. There are three types of security labels:

• Row security labels: A security label associated with a data row or record in a database table
• Column security labels: A security label associated with a column in a database table
• User security labels: A security label granted to a database user

A security label is composed of one or more security label components. There are three types of security label components that you can use to build your security labels:

• Sets: A set is a collection of elements where the order in which those elements appear is not important. All elements are deemed equal
• Arrays: An array is an ordered set that can be used to represent a simple hierarchy. In an array, the order in which the elements appear is important. For example, the first element ranks higher than the second element, and the second higher than the third
• Trees: A tree represents a more complex hierarchy that can have multiple nodes and branches. For example, trees can be used to represent organizational charts. You use a security policy to define the security label components that make up a particular security label

IDS Security Administrator (DBSECADM) is required to manipulate LBAC objects. DBSECADM authority can only be granted by SYSADM. A database manager (DBM) does not have DBSECADM by default.

This tutorial shows how to use security labels to control access to data at the row level, column level, and at a combination of both row and column levels. You will also learn how to determine which security label component is most appropriate when creating those security labels. And finally you will learn how to use a security policy to associate your security label components with your security labels. Using examples from the financial industry and the police services area, you will:

1. Analyze the required data restrictions
2. Design the LBAC security solution
3. Implement the LBAC security solution
4. See your LBAC security solution in action

Back to top

Prerequisites

This tutorial is written for IDS database developers and IDS database administrators. You should understand the basic concepts of LBAC.

Back to top

System requirements

IDS 11 for Linux®, UNIX®, and Windows®

1 of 7 | Next

Comments

Back to top

Table of contents

• Before you start
• Protecting rows
• Protecting columns
• Protecting rows and columns
• Conclusion
• Resources
• About the authors

---

1 of 7 | Next

Next steps from IBM

WebSphere Portal can help your small and midsize business achieve better website security, along with faster time to value with easily deployable and customizable example Web sites.

---

• Try: Download a free trial version of IBM WebSphere Portal Express V6.1, which offers collaboration, document management, and secure Web content management.
• Article: This article provides an overview of the WebSphere Portal security architecture, including internet security, and secure connections between clients.
• Tutorial: This tutorial take you through the steps to develop and test your first portlet WebSphere Portal Test Environment.
• Demo: These demos show Web 2.0 features available today within WebSphere Portal, as well as several features planned for the future.
• Buy: IBM WebSphere Portal Express

Dig deeper into Information Management on developerWorks

Try IBM PureSystems. No charge.

Experience today!

---

Get started with the cloud-based trial and pattern development kit.