DB2 UDB security, Part 4: Understand how authorities and privileges are implemented in DB2 UDB

Document options Document options requiring JavaScript are not displayed Discuss Rate this page Help us improve this content

Level: Introductory

Ted J. Wasserman (tedwas.ibm@gmail.com), Database Consultant, IBM

05 Jan 2006

A series of articles about IBM DB2 Universal Database for Linux, UNIX, and Windows (DB2 UDB) V8.2 security features would not be complete without a discussion of the different administrative authority levels and privileges. This article is the fourth part of a series that examines the security features available in DB2 UDB V8.2.

Part 1 looked at the user and group accounts that are required for DB2 UDB installation and operation. Part 2 discussed how to enable and write your own security plug-ins, while Part 3 looked at how security plug-ins could be customized to authenticate users. This article reviews the different administrative authority levels and privileges available in DB2 UDB and how they can be granted to and revoked from user and group accounts.

Introduction

In Part 1 of this series, you learned that certain user and group accounts are needed to install and operate DB2 UDB V8.2. The important point to remember is that these accounts are defined in a security facility outside of DB2 UDB -- typically the operating system. User account management, including password policies, naming conventions, and group definitions, are all managed by this external facility.

DB2 UDB interacts with this external facility in order to validate a supplied user ID and password when a DB2 request is submitted. This interaction is referred to as authentication and is shown in the bottom half of Figure 1. DB2 UDB relies on this external security facility to authenticate a user and will only grant access to DB2 UDB resources if authentication is successful.

Once authentication is successful, DB2 UDB must determine whether the user has the required permissions to perform the intended operation. This process is known as authorization and is illustrated in the top half of Figure 1. DB2 UDB uses two internal mechanisms to determine whether authorization is successful -- authority levels and privileges. We cover both of these concepts in more detail in the next sections.

Back to top

Authority levels

DB2 UDB defines a hierarchy of authority levels to assign a set of pre-determined administrative rights to groups of user accounts. These administrative rights include the ability to take database backups, force users off the system, view table data, and more.

There are four instance authority levels (SYSADM, SYSCTRL, SYSMAINT, SYSMON) and two database authority levels (DBAMD, LOAD). Authority levels that are defined at the instance level apply to all databases within the instance.

Authority levels are arranged in the hierarchical format shown in Figure 2. At the top of the hierarchy is the SYSADM authority level, which is the highest level of authority a user can have in DB2 UDB. A user with SYSADM authority can perform all available DB2 operations. The SYSCTRL and SYSMAINT authority levels provide a subset of SYSADM rights to manage the system but do not allow access to any data in the tables. The SYSMON authority provides the ability to use the database system monitor. The DBADM authority allows a user to perform administrative tasks on a specific database in an instance and allows full access to the data and objects in that database. The LOAD authority allows a user to run the LOAD utility, DB2 UDB's high-speed bulk data loader.

Table 1 summarizes each authority level and its intended use.

Table 2 compares common administrative operations permitted for each authority level.

Grant/Revoke instance level authorities

Instance level authorities are established by assigning user groups defined in the external security facility to the associated instance level authority parameters (SYSADM_GROUP, SYSCTRL_GROUP, SYSMAINT_GROUP, SYSMON_GROUP). For example, if you wanted a user account called KATE to have SYSMAINT authority, you could put KATE in a group called MAINT and then update the instance parameter called SYSMAINT_GROUP to the value MAINT. Any user in the group MAINT would then have the SYSMAINT authority. To revoke the SYSMAINT authority from KATE, you could simply remove her from the MAINT group or change the value of the SYSMAINT_GROUP parameter to a new group name that she is not a member of. In the latter case, this would also revoke the SYSMAINT authority from other users in the MAINT group if they were also not a member of the new group.

Instance level authority parameters can be changed from the command line or from the Control Center. For example, to change the value of the SYSMAINT_GROUP parameter to the value MAINT using the command line, you can execute the following command:

Group names Group names on all platforms must be 30 bytes or less in length.

update dbm cfg using SYSADM_GROUP MAINT

For the change to take effect, you must restart the DB2 UDB instance using the following two commands:

db2stop

db2start

To ensure the change has taken effect, you can view the value of the parameter by issuing the following command:

get dbm cfg

The previous series of commands and results are illustrated in Listing 1. You can also update any of the other instance level authority parameters in a similar manner.

				

db2 => update dbm cfg using sysmaint_group maint
DB20000I  The UPDATE DATABASE MANAGER CONFIGURATION command completed
successfully.

db2 => db2stop
11/19/2005 21:19:03     0   0   SQL1064N  DB2STOP processing was successful.
SQL1064N  DB2STOP processing was successful.

db2 => db2start
11/19/2005 21:19:09     0   0   SQL1063N  DB2START processing was successful.
SQL1063N  DB2START processing was successful.

db2 => get dbm cfg

Database Manager Configuration

Node type = Enterprise Server Edition with local and remote clients

.....

 SYSADM group name                        (SYSADM_GROUP)      =
 SYSCTRL group name                       (SYSCTRL_GROUP)     =
 SYSMAINT group name                      (SYSMAINT_GROUP)    = MAINT
 SYSMON group name                        (SYSMON_GROUP)      = 

.....

To change the value of the instance level authority parameters using the control center, open Control Center, expand the All Systems folder, expand the target system, expand the Instances folder, right-click the target instance (in this example, DB2), and select the Configure Parameters item (see Figure 3).

Scroll through the list of parameters (Figure 4) and find the associated authority level parameters. Click the button beside the parameter value to change its value. In the example in Figure 4, we changed the value of the SYSMAINT_GROUP parameter to the value MAINT.

You must stop and restart the instance for the parameter change to take effect. From the Control Center, right-click on the target instance again, and select the Stop item. If prompted to confirm stopping the instance, click the OK button. Right-click on the target instance again, and select the Start item. You can then go back and verify that the parameter change has taken effect.

In a default DB2 UDB installation on Windows, the values of these instance-level authority parameters default to NULL. This means that any user account belonging to the local Administrators group automatically inherits these authorities. For this reason, we highly recommend explicitly changing the value of these parameters to specific group names in order prevent unintended/unauthorized access. On Linux and UNIX installations, this is not as large a concern since a NULL value defaults to the primary group of the instance owner, which by default only contains the user ID of the instance owner after an installation. However, it is still a good practice to set these parameters explicitly.

The database level authorities, such as DBADM, CONNECT, CREATETAB, and LOAD, are granted and revoked in a similar way as database privileges. They are covered in the next section.

Back to top

Privileges

While instance authority levels are used as a mechanism to assign a pre-defined set of administrative rights to a group of user accounts, privileges are explicitly assigned to individual users or groups to allow them to perform specific activities on database objects (for example, to create and drop an index). Privileges strictly define the tasks that a user can perform. For example, a user may have the privilege to read a table's data but not to update that data.

Figure 5 shows the different levels of authorities and privileges available in DB2 UDB. This ranges from privileges on tables to privileges on schemas and stored procedures. The top of Figure 5 shows the instance authority levels that were described in the previous section. Note how the SYSADM and DBADM authorities automatically receive all the authorities and privileges below the dotted line for a particular database.

Table 3 summarizes the types of database authorities that can be granted to and revoked from users or groups of users. Only users with SYSADM or DBADM authority can grant and revoke these authorities.

*SYSIBM becomes the owner of the implicitly created schema, and the PUBLIC group is given the privilege to create objects in this schema.

Table 4 summarizes the only available table space privilege (USE) that can be granted to and revoked from users or groups of users. The USE privilege cannot be used with SYSCATSPACE or on any system temporary table spaces.

Table 5 summarizes the different types of schema privileges that can be granted to and revoked from users or groups of users.

Table 6 summarizes the different types of table/view privileges that can be granted to and revoked from users or groups of users.

Table 7 summarizes the only available index privilege (CONTROL) that can be granted to and revoked from users or groups of users.

Table 8 summarizes the different types of package privileges that can be granted to and revoked from users or groups of users. The section "Static and Dynamic SQL considerations" covers package concepts in more detail.

Table 9 summarizes the only available routine privilege (EXECUTE) that can be granted to and revoked from users or groups of users.

Table 10 summarizes the different types of sequence privileges that can be granted to and revoked from users or groups of users.

Granting privileges

Like the instance level authorities, privileges can be granted and revoked using command syntax or the Control Center. In order to grant or revoke privileges, you must have a database connection. Figure 6 shows the syntax diagram for the GRANT statement for table and view privileges. The GRANT statement syntax for other database objects is similar and is available in the DB2 UDB documentation.

For example, to grant the INSERT privilege on the ACCOUNT table to user JEFF using the GRANT statement, you would issue the following statement:

GRANT INSERT ON TABLE account TO USER jeff

To grant the SELECT privilege on the CUSTOMER table to the group SALESREPS, you would issue the following statement:

GRANT SELECT ON TABLE customer TO GROUP salesreps

Care must be taken when granting authorities and privileges to a user or group, as DB2 UDB will let you grant those privileges to a non-existent account. At some later time, an account might be created with the same name and automatically receive all of the previously granted authorities and privileges.

You can also grant privileges using the Control Center by expanding the All Databases folder, expanding the target database, expanding the folder containing the database object of interest, right-clicking on that object, and choosing the Privileges item. In Figure 7, we expanded the Tables folder in the SAMPLE database, right-clicked on the EMPLOYEE table, and chose the Privileges item.

In the table privileges dialog window, you can select either the User or Group tab, depending on whether you want to grant privileges to a user or group. If the user/group is not already in the list, click the Add User or Add Group button to add a user or group. You can specify which privileges should be granted to the user or group by clicking on the drop-down box for each privilege and selecting either Yes, No, or Grant. Selecting Yes means the privilege should be granted, selecting No means the privilege should not be granted, and selecting Grant means the privilege should be granted as well as the privilege to grant other users/groups the privilege. Clicking the Grant All button grants all the available privileges to the designated user or group. Clicking the Revoke All button revokes all the available privileges from the designated user or group.

From Figure 7, you can see that a user called MARK has only been granted the INSERT privilege on the EMPLOYEE table, meaning that MARK can only INSERT data into it, not read or update it. This of course assumes that MARK is not a member of a group that has these privileges or has SYSADM/DBADM authority.

Granting privileges to users versus groups

You may have noticed from the examples above or the GRANT statement syntax diagram that you have the ability to specify whether you want to grant a privilege to a user or group, by using the TO USER or TO GROUP clauses respectively. If neither of these clauses is specified but the specified name is defined in the operating system only as a group, then GROUP is assumed. If the specified name is defined in the operating system only as user or if it is undefined, USER is assumed. If the specified name is defined in the operating system as both, an error is returned. As a best practice, we always recommend including either the TO USER or the TO GROUP clause in GRANT statements to avoid any ambiguity.

PUBLIC group

DB2 UDB internally uses a pseudo-group called PUBLIC, which privileges can be granted to and revoked from. PUBLIC is not actually a group defined in the external security facility, but is rather a way to assign privileges to any user who successfully authenticates. You can grant privileges to and revoke them from the PUBLIC group like any other group. For example, to revoke the IMPLICIT_SCHEMA authority from the PUBLIC group, you could issue the following statement:

REVOKE IMPLICIT_SCHEMA ON DATABASE FROM PUBLIC

It is important to understand the security implications of granting privileges to the PUBLIC group. Any user that supplies a valid user ID and password has the ability to perform any operation the PUBLIC group has been granted.

WITH GRANT OPTION

Many of the database object privileges also allow you to include the WITH GRANT OPTION clause in the GRANT statement. This enables you to grant a privilege to a user/group while giving the user or members of the group the right to grant the same privilege to other users/groups. For example, the following statement grants the ALTERIN, CREATEIN, and DROPIN privileges on the schema called ACCT to the group G1 as well as the ability for members of the group G1 to grant those same privileges to other users or groups:

GRANT ALTERIN, CREATEIN, DROPIN ON SCHEMA ACCT TO GROUP G1 WITH GRANT OPTION

CONTROL privilege The CONTROL privilege for an object cannot be granted to other users or groups using the WITH GRANT OPTION clause. It must be specifically granted to a user or group and can only be done by someone with SYSADM or DBADM authority.

The WITH GRANT OPTION is only available for the GRANT statements of packages, routines, schemas, tables, views, and table spaces.

Revoking privileges

The REVOKE statement is used to revoke privileges that were previously granted. Figure 8 shows the syntax diagram of the REVOKE statement for tables and views. Again, the REVOKE syntax for other database objects is similar and is available in the DB2 UDB documentation.

For example, to revoke the ALTER privilege on the STAFF table from user JEN, you could issue the following statement:

REVOKE ALTER ON TABLE staff FROM USER jen

To revoke all privileges on the STAFF table from JEN, you could issue the following statement:

REVOKE ALL PRIVILEGES ON TABLE staff FROM USER jen

Privileges can also be revoked using the Control Center in the same way they were granted. Simply re-open the object privileges dialog window, as was previously shown in Figure 7. To revoke a privilege, change the drop-down list for that privilege to NO, or click the Revoke All button to revoke all the privileges associated with that object.

To revoke privileges on database objects, you must have DBADM authority, SYSADM authority, or CONTROL privilege on that object. Note that holding a privilege WITH GRANT OPTION is not sufficient to revoke that privilege. To revoke the CONTROL privilege from another user, you must have SYSADM or DBADM authority.

Revoking a privilege from a user or group revokes that privilege granted by any other account. However, revoking a privilege from a user or group does not revoke that same privilege from other accounts that were granted the privilege by that same user/group. For example, assume that user BEN grants SELECT WITH GRANT OPTION to user RICK, then RICK grants SELECT to users RAVI and CHRIS. If BEN later revokes the SELECT privilege from RICK, RAVI and CHRIS still retain the SELECT privilege.

Revoking specific privileges from a member of a group

You may have a situation where you want to grant a privilege to a group and then revoke the privilege from just one member of the group. However, you cannot revoke an explicit privilege that was never explicitly granted in the first place. You have two options in this case:

• You can remove the member from the group; or, create a new group with fewer members and grant the privilege to the new group
• You can revoke the privilege from the group and then grant it to individual members of the group

Granting and revoking database authorities

The database level authorities, such as DBADM, LOAD, and CREATETAB are also granted to a user or a group using the GRANT statement. For example, the following statement grants the DBADM authority to the user SALLY:

GRANT DBADM ON DATABASE TO USER sally

The following statement grants the LOAD authority to the group MAINT:

GRANT LOAD ON DATABASE TO GROUP maint

Recall that users with the LOAD authority also require the INSERT privilege to load data into a table and the DELETE privilege if the LOAD operation is defined as REPLACE.

Revoking DBADM authority To revoke DBADM authority, you must have SYSADM authority.

To revoke database level authorities, use the REVOKE statement. For example, to revoke the LOAD authority from the group MAINT, you would issue the following statement:

REVOKE LOAD ON DATABASE FROM GROUP maint

Back to top

Implicit privileges

In some circumstances, the database manager implicitly grants certain privileges to a user when a user creates a database object, such as a table or a package, or when the DBADM authority level is granted. It is important to understand which implicit privileges are granted and the security implications of these implicit privileges. Table 11 summarizes the cases where implicit privileges are granted.

For example, suppose you initially granted the DBADM authority to the user PAUL and at a later time you decided to revoke that authority. To revoke the DBADM authority from PAUL, you could use the following statement:

REVOKE DBADM ON DATABASE FROM USER paul

After executing this command, PAUL would no longer have DBADM authority; however, he would still have the GRANT, BINDADD, CONNECT, CREATETAB, CREATE_EXTERNAL_ROUTINE, CREATE_NOT_FENCED_ROUTINE, IMPLICIT_SCHEMA, LOAD and QUIESCE_CONNECT authorities on the database that were implicitly granted when PAUL was originally granted the DBADM authority. These would need to be explicitly revoked from PAUL.

It is considered a good security practice to explicitly revoke many of the privileges that are implicitly granted to PUBLIC after a new database is created. This helps lock down your system and ensures only users who are supposed to access the database actually do.

Back to top

Static and dynamic SQL considerations

When the syntax of an SQL statement is fully known at compile time, the statement is referred to as static SQL. This is in contrast to a dynamic SQL statement, whose syntax is not known until run-time.

There are some differences in the way privileges are handled between static and dynamic SQL. One such difference is how group membership is handled. In general, group membership is only considered for dynamic SQL and non-database object authorizations (such as instance level commands and utilities). The one exception to this general case occurs when privileges are granted to PUBLIC; these are considered when static SQL is processed.

Another difference is when authorization actually takes place. If a program is coded with static SQL statements, packages (database objects that contain the optimized and executable form of SQL statements) must be created in the database before the associated program can execute the SQL statements contained in the package. Authorization for static SQL takes place at compile or bind time. At run-time, a user only needs to have EXECUTE privileges on the package in order to execute the statements in it. This does not imply that the user has direct access to the underlying database objects. The only access to the underlying database objects is through the specific statements in the package. For dynamic SQL statements, authorization takes place on a per statement basis. The user executing the statement must have the appropriate privileges to execute that statement at run-time, either because they were explicitly granted them or possess them through group membership.

For example, suppose the following static SQL statement is found in an embedded-SQL application:

EXEC SQL SELECT col INTO :hostvar FROM table123;

Suppose the application file containing this statement was pre-compiled, producing a bind file called sampleapp.bnd. If the developer BARBARA wanted to bind this file to the database (thus creating a package), she would explicitly need to have the SELECT privilege on TABLE123 in order for the BIND command to succeed. The one exception to this rule would be if the PUBLIC group had been granted this privilege. BARBARA would also need the BINDADD authority, if this was a new package, or only the BIND privilege, if this was an existing package that she wanted to re-bind to the database (for example, because the database statistics were recently updated).

Packages may also include dynamic SQL, in which case the required privileges depend on the value that is specified for the DYNAMICRULES clause of the PRECOMPILE/BIND command when the package is precompiled or bound to the database. To use dynamic SQL in a package bound with DYNAMICRULES RUN (the default), the user who runs a dynamic SQL application must have the privileges necessary to issue each SQL request, as well as the EXECUTE privilege on the package. The privileges may be granted to the user's ID, to any group of which the user is a member, or to PUBLIC.

If the application is bound with the DYNAMICRULES BIND option, DB2 UDB associates the package owner's user ID with the application packages. This allows any user who runs the application to inherit the privileges associated with the package owner's user ID.

For example, suppose the application file in the example above also contained dynamic SQL, as shown in Listing 2:

				
EXEC SQL BEGIN DECLARE SECTION;
  char hostVarStmt[50];
  short hostVarDeptnum;
EXEC SQL END DECLARE SECTION;

strcpy(hostVarStmt, "DELETE FROM org WHERE deptnum = ?"); 

EXEC SQL PREPARE Stmt1 FROM :hostVarStmt; 

hostVarDeptnum = 15;
EXEC SQL EXECUTE Stmt1 USING :hostVarDeptnum;

If BARBARA wanted to bind the same bind file to the database, she would need the BINDADD authority if this was a new package or just the BIND privilege if the package already existed. Further, suppose BARBARA used the following BIND command to bind the file:

BIND sampleapp.bnd QUALIFIER u1 OWNER u2 DYNAMIC RULES RUN

In this case, all unqualified SQL statements (statements that did not qualify database objects with a schema) would use the schema U1. The user U2 would own the package because of the use of the OWNER clause. Since BARBARA specified the DYNAMIC RULES RUN clause, the privileges of the user running the application (executing the package) are checked for dynamic SQL.

However, if BARBARA used the following BIND command to bind the file, the privileges of the package owner would be checked for dynamic SQL:

BIND sampleapp.bnd QUALIFIER u1 OWNER u2 DYNAMIC RULES BIND

In this case, the owner of the package is specified as U2. Thus at run-time, the privileges of the user U2 are checked, rather than the user running the application.

Routine privileges

The EXECUTE privilege applies to all types of routines, including functions, procedures, and methods within the database. Once a user is granted the EXECUTE privilege for a routine, the user can then invoke that routine, create a function that is sourced from that routine (applies to functions only), and reference the routine in any DDL statement, such as CREATE VIEW or CREATE TRIGGER. Individual privileges for objects accessed inside the routine are not required.

Back to top

How privileges/authorities are maintained in DB2 UDB

Instance level authorities Instance level authority levels (SYSADM, SYSCTRL, SYSMAINT, and SYSMON) and group membership are defined outside of DB2 UDB, and are therefore not reflected in system catalog tables.

DB2 UDB stores information about privileges in seven system catalog views:

• SYSCAT.DBAUTH - database privileges
• SYSCAT.COLAUTH - table and view column privileges
• SYSCAT.INDEXAUTH - index privileges
• SYSCAT.PACKAGEAUTH - package privileges
• SYSCAT.SCHEMAAUTH - schema privileges
• SYSCAT.TABAUTH - table and view privileges
• SYSCAT.TBSPACEAUTH - table space privileges

These views can be queried just like any other ones. For example, to find out what table privileges a user EMMA has, you could issue the statement shown in Listing 3:

				
SELECT substr(grantor,1,8) AS grantor,
       SUBSTR(grantee,1,8) AS grantee,
       granteetype AS gtype,
       SUBSTR (tabschema,1,8) AS schema,
       SUBSTR (tabname,1,8) AS tabname,
       controlauth AS ctl,
       alterauth AS alt,
       deleteauth AS del,
       indexauth AS idx,
       insertauth AS ins,
       selectauth AS sel,
       refauth AS ref,
       updateauth AS upd
  FROM syscat.tabauth 
  WHERE grantee = 'EMMA'

GRANTOR GRANTEE  GTYPE SCHEMA   TABNAME  CTL ALT DEL IDX INS SEL REF UPD
------- -------- ----- -------- -------- --- --- --- --- --- --- --- ---
INST1   EMMA     U     INST1    TABLE1   Y   G   G   G   G   G   G   G

A grantee type (GTYPE) of 'U' means that the grantee (the account that holds the privilege) is a user account. A GTYPE value of 'G' means that the grantee is a group account. In the other columns, a value of 'Y' means the privilege is held, a value of 'N' means the privilege is not held, and a value of 'G' means the privilege is held and grantable to others. In Listing 3, you see that the user EMMA has CONTROL privilege on the table TABLE1 as well as all the other available table privileges, including the ability to grant those privileges to other users.

Implicitly granted privileges Privileges granted to users by the system will have SYSIBM as the grantor.

To find out all accounts with privileges, you can query each of the system catalog views and combine the results together using the UNION operator, as shown in Listing 4:

				
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'DATABASE' FROM SYSCAT.DBAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'TABLE   ' FROM SYSCAT.TABAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'PACKAGE ' FROM SYSCAT.PACKAGEAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'INDEX   ' FROM SYSCAT.INDEXAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'COLUMN  ' FROM SYSCAT.COLAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'SCHEMA  ' FROM SYSCAT.SCHEMAAUTH
   UNION
   SELECT DISTINCT GRANTEE, GRANTEETYPE, 'SERVER  ' FROM SYSCAT.PASSTHRUAUTH
   ORDER BY GRANTEE, GRANTEETYPE, 3

You can also find out all the privileges a user or group has using the Control Center. To do this, open Control Center, expand the All Databases folder, expand the target database, expand the Users and Group Objects folder, expand either the DB Users or DB Groups folder, and double-click the row for the user or group of interest. In Figure 9, the privileges dialog for the user MARK in the SAMPLE database is opened. By selecting the Database tab, you can see that the user MARK has the CONNECT and LOAD authorities. To revoke these authorities, you could uncheck the box beside each authority.

GET AUTHORIZATIONS command

DB2 UDB has a command called GET AUTHORIZATIONS that is a useful shortcut for reporting the authorities of the current user. This command uses the values found in the database manager configuration file and the authorization system catalog view (SYSCAT.DBAUTH). Listing 5 shows the results of issuing the command:

				
 db2 => get authorizations

 Administrative Authorizations for Current User

 Direct SYSADM authority                    = NO
 Direct SYSCTRL authority                   = NO
 Direct SYSMAINT authority                  = NO
 Direct DBADM authority                     = NO
 Direct CREATETAB authority                 = NO
 Direct BINDADD authority                   = NO
 Direct CONNECT authority                   = NO
 Direct CREATE_NOT_FENC authority           = NO
 Direct IMPLICIT_SCHEMA authority           = NO
 Direct LOAD authority                      = NO
 Direct QUIESCE_CONNECT authority           = NO
 Direct CREATE_EXTERNAL_ROUTINE authority   = NO
 Direct SYSMON authority                    = NO

 Indirect SYSADM authority                  = YES
 Indirect SYSCTRL authority                 = NO
 Indirect SYSMAINT authority                = NO
 Indirect DBADM authority                   = NO
 Indirect CREATETAB authority               = YES
 Indirect BINDADD authority                 = YES
 Indirect CONNECT authority                 = YES
 Indirect CREATE_NOT_FENC authority         = NO
 Indirect IMPLICIT_SCHEMA authority         = YES
 Indirect LOAD authority                    = NO
 Indirect QUIESCE_CONNECT authority         = NO
 Indirect CREATE_EXTERNAL_ROUTINE authority = NO
 Indirect SYSMON authority                  = NO

Having a Direct authority means the authority was explicitly granted to the user. Having an Indirect authority means the user belongs to a group that was granted that authority. A user might have both a direct and indirect authority if the user was explicitly granted that authority and belonged to a group that was granted that authority.

Back to top

Deciding which privileges/authority levels are necessary

Usually, different users in your organization require different levels of database access. For example, a customer service representative would need a much more restrictive access level than a database administrator. This section presents a few scenarios and discusses the authorities and privileges that are needed in each case.

Scenario 1

Tony, an analyst in the finance department, runs queries every morning to find out the profitability of the company's stores.

In this case, Tony can be granted CONNECT privilege on the databases of interest, as well as the SELECT privilege on all the tables he requires access to.

Scenario 2

Janet, a database administrator, looks after all database maintenance activities for all databases in the company. Her responsibilities include taking backups, restoring the database when required, storage management, and running traces. She should not be able to access any of the data in the database.

In this case, Janet could be granted the SYSMAINT authority. SYSCTRL authority might also be considered if SYSMAINT is too restrictive.

Scenario 3

Jim, an application programmer, develops and tests the database manager application programs. He may also create tables of test data.

In this case, Jim requires BINDADD, BIND, CONNECT, and CREATETAB on one or more databases, some specific schema privileges, and a list of privileges on some tables. CREATE_EXTERNAL_ROUTINE may also be required if he is developing routines in an external programming language, like C or Java.

Scenario 4

Susan, a planner in the marketing department, needs to load the PRODUCT_SALES table with new data she receives from the department stores every night in order to determine new buying trends.

In this case, Susan requires the CONNECT privilege on the database, the LOAD authority, as well as the INSERT and SELECT privileges on the PRODUCT_SALES table.

Back to top

Controlling access to database objects using schemas

A common question frequently asked by new DB2 UDB database administrators is how they can provide an environment for their users to create and drop their own database objects while limiting the access of these objects from other users. While giving each user his or her own physical database would solve the problem, it may not be the optimal solution. A better solution might be to control database object access through the use of schemas.

Schemas are database objects used to logically group related database objects together. They are also often used as a way to indicate object ownership. Schemas have privileges associated with them, allowing the schema owner to control which users have the privilege to create, alter, and drop objects in the schema. A schema owner is initially given all of these privileges on the schema, with the ability to grant them to others. A user with SYSADM or DBADM authority can change the privileges held by users on any schema.

By default, when a database is created, all users have the IMPLICIT_SCHEMA authority. This allows any user to create objects in any schema not already in existence. An implicitly created schema allows any user to create other objects in the same schema. If the IMPLICIT_SCHEMA authority is revoked from PUBLIC, schemas can be explicitly created using the CREATE SCHEMA statement or implicitly created by users (such as those with DBADM authority) who have been implicitly granted the IMPLICIT_SCHEMA authority.

To give each user control of their own database objects, a database administrator could explicitly create a schema for each user. The administrator would then grant all the required privileges on the schema only to each individual user. Other users would then be prevented from tampering with any objects created in the schema. To further lock down the system, the IMPLICIT_SCHEMA authority could also be revoked from PUBLIC so that the only way a user could create a database object would be through a designated schema which they had the appropriate privileges for. This approach allows users to create whatever database objects they need and prevents them from tampering or getting their database objects mixed up with those created by other users.

Back to top

Summary

In this article, we have reviewed the different authority levels and privileges defined in DB2 UDB and how they can be assigned to users using command line syntax and the Control Center. We also discussed some of the finer details of privileges, including implicit privileges, the differences in authorization between static and dynamic SQL, and how privilege information is stored in the system catalog tables. Finally, we covered how schemas can be used as an effective mechanism for controlling access to database objects in multi-user environments. With this knowledge, you should be able to define a privilege/authority strategy that minimizes the threat of accidental or intentional system misuse.

Resources

• "Quick Beginnings for DB2 Servers Version 8.2": DB2 UDB documentation describing DB2 UDB server installations.
  
  
• DB2 Online Information Center: The most recent DB2 online (and searchable) documentation.
  
  
• "DB2 UDB security, Part 1: Understand how user and group accounts interact with DB2 UDB" (developerWorks, August 2005): This article describes the different user and group accounts needed to install and work with DB2 UDB for Linux, UNIX, and Windows, Version 8.2 and introduces the DB2 UDB security model, including user authentication, user and group authorization, and super users.
  
  
• "DB2 UDB security, Part 2: Understand the DB2 Universal Database security plug-ins" (developerWorks, December 2005): Learn about the DB2 UDB security plug-ins, a new feature introduced in Version 8.2. This article explains what the security plug-ins accomplish and teaches you how to enable and write your own security plug-ins.
  
  
• "DB2 UDB security, Part 3: Security plug-ins using the GSS-API security mechanisms (SPKM / LIPKEY)" (developerWorks, December 2005): Use the new GSS-API security mechanisms to customize the DB2 UDB security plug-ins to achieve authentication based on public key technology.
  
  
• developerWorks Information Management zone: Find more resources for DB2 UDB developers and administrators.
  
  

• IBM DB2 Universal Database Enterprise Server Edition V8.2 for Linux, UNIX, and Windows: Download a trial version from developerWorks.
  
  
• Build your next development project with IBM trial software, available for download directly from developerWorks.
  
  

• Participate in the discussion forum.
  
  
• developerWorks blogs: Get involved in the developerWorks community.

About the author

		Ted J. Wasserman is a database consultant at the IBM Silicon Valley Laboratory in San Jose, California. Ted works on the DB2 Business Partner Technical Enablement team, where he specializes in helping IBM Business Partners migrate their applications and databases to DB2. Ted has a master's degree in computer science, as well as a bachelor's degree in computer science from Queen's University in Kingston, Ontario, Canada.

Rate this page

Please take a moment to complete this form to help us better serve you. Did the information help you to achieve your goal? Yes No Don't know   Please provide us with comments to help improve this page:   How useful is the information? 1 2 3 4 5 Not useful Extremely useful

Share this.... Digg this story del.icio.us Slashdot it!

Back to top