Granting privileges to user groups

You can simplify the assignment and management of privileges by creating user groups and by granting privileges to the groups. In this way, you can efficiently assign the same set of privileges to all the users of a given group at the same time.

About this task

Suppose that the database administrator at Spiffy wants several employees in the Software Support department to create tables in the DB1 database. The database administrator creates DEVGROUP as a RACF® group ID for this purpose. To simplify the process, the database administrator decides that each CREATE TABLE statement should implicitly create a unique table space for the table. Hence, DEVGROUP needs the CREATETAB privilege, the CREATETS privilege, the privilege to use the SG1 storage group and, the privilege to use one of the buffer pools, BP0, for the implicitly created table spaces. The following diagram shows this group and their privileges:

Begin figure description. Sample RACF group and required privileges. End figure description.

Begin general-use programming interface information.The database administrator, DBA01, owns database DB1 and has the privileges to use storage group SG1 and buffer pool BP0. The database administrator holds both of these privileges with the GRANT option. The database administrator issues the following statements:

  1. GRANT CREATETAB, CREATETS ON DATABASE DB1 TO DEVGROUP;
  2. GRANT USE OF STOGROUP SG1 TO DEVGROUP;
  3. GRANT USE OF BUFFERPOOL BP0 TO DEVGROUP;End general-use programming interface information.

Because the system and database administrators at Spiffy still need to control the use of those resources, the preceding statements are issued without the GRANT option.

Three programmers in the Software Support department write and test a new program, PROGRAM1. Their IDs are PGMR01, PGMR02, and PGMR03. Each programmer needs to create test tables, use the SG1 storage group, and use one of the buffer pools. All of those resources are controlled by DEVGROUP, which is a RACF group ID.

Therefore, granting privileges over those resources specifically to PGMR01, PGMR02, and PGMR03 is unnecessary. Each ID should be associated with the RACF group DEVGROUP and receive the privileges that are associated with that functional ID. The following diagram shows the DEVGROUP and its members:

Begin figure description. Sample RACF group and group members. End figure description.

The security administrator connects as many members as required to the group DEVGROUP. Each member can exercise all the privileges that are granted to the group ID.