User roles

User roles include Db2® instance owners, database administrators, and text table owners; each having a specific set of administrative rights.

Db2 instance owner

The Db2 instance owner user can start and stop the instance services for Db2 Net Search Extender and control the locking services. In addition, the Db2 instance user is granted DBADM authority for each enabled database. This enables a central point of control for all database changes driven by Net Search Extender.

Required Db2 authorizations

The SECADM must grant DBADM with DATAACCESS privilege to the instance owner. These authorizations are a prerequisite for the execution of Db2 Net Search Extender administrative commands.

Required file system authorizations

Read and write access for all text index directories and read access to model files.

Commands for the instance owner

DB2TEXT START, DB2TEXT STOP, DB2TEXT CONTROL and DB2EXTHL

The commands are only allowed on the server. In a partitioned database environment, this can be any of the configured nodes. Each command checks if the user running the command is the Db2 instance owner. If you, as the instance owner, decide to use a fenced user ID to run the stored procedure and UDFs, the fenced user must have read and write access to all files in the index directory (with read access to the entire directory path). Be aware that your fenced user ID and instance user ID must be members of the same primary group to grant the instance user ID correct access to files created by the fenced user ID and vice versa. Assign correct group membership and file permissions.

In addition to the instance owner any user with the same primary group as that of the instance owner will also be able to execute DB2TEXT START, DB2TEXT STOP, DB2TEXT CONTROL and DB2EXTHL

Database administrators

Database administrators can enable and disable databases for use with Net Search Extender.

Required Db2 authorizations

DBADM

Commands for the database administrator

DB2TEXT ENABLE DATABASE and DB2TEXT DISABLE DATABASE.

Text table owners

The text table owner can create, drop, and change indexes. Note that they must be able to control (by having read and write access) the location of indexes and updates to the full-text indexes.

Required Db2 authorizations and privileges

Owner of text table.

Commands for the text table owner:

DB2TEXT CREATE INDEX, DB2TEXT DROP INDEX, DB2TEXT ALTER INDEX, DB2TEXT ACTIVATE CACHE, DB2TEXT DEACTIVATE CACHE, DB2TEXT UPDATE INDEX, DB2TEXT CLEAR EVENTS, and DB2EXTTH.

Note that the command implementation partially runs under the user ID of the Db2 instance owner. Therefore, grant the instance owner the necessary file system access before creating or altering the text indexes. For details on required permissions as listed for each command see Administration commands for the text table owner