Deploying a user ID/password plug-in
To customize the Db2® security system's user ID/password authentication behavior, you can develop your own user ID/password authentication plug-ins or buy one from a third party.
Before you begin
Depending on their intended usage, all user ID-password based authentication plug-ins must be
placed in either the client plug-in directory or the server plug-in directory. If a plug-in is
placed in the client plug-in directory, it will be used both for local authorization checking and
for validating the client when it attempts to connect with the server. If the plug-in is placed in
the server plug-in directory, it will be used for handling incoming connections to the server and
for checking whether an authorization ID exists and is valid whenever the GRANT statement is issued
without specifying either the keyword USER or GROUP. In most situations, user ID/password
authentication requires only a server-side plug-in. It is possible, though generally deemed less
useful, to have only a client user ID/password plug-in. It is possible, though quite unusual to
require matching user ID/password plug-ins on both the client and the server.
Note: You must stop the
Db2 server or
any applications using the plug-ins before you deploy a new version of an existing
plug-in. Undefined behavior including traps will occur if a process is still using a plug-in when a
new version (with the same name) is copied over it. This restriction is not in effect when you
deploy a plugin for the first time or when the plug-in is not in use.
After you acquire user
ID/password authentication plug-ins that are suitable for your database management system, you can
deploy them.