Managing pending privileges for grant management

In grant management, a pending privilege is a group privilege that has been defined but has not been implemented. Pending privileges are generated by Db2 Admin Tool after you create a group privilege if the relevant group objects exist.

To manage pending privileges for grant management:

1. On the DB2 Administration Menu (ADB2) panel, specify option Z, and press Enter.
2. On the System Administration (ADB2Z) panel, specify option GM, and press Enter.
3. On the Grant Management Menu (ADB2ZGM) panel, specify option PP and optionally any filtering criteria and press Enter.

   ADB2ZGM n ----------------- DD1A Grant Management Menu ------------------ 13:53
   Option ===> PP                                                                     
                                                                                  
                                                            Db2 System: DD1A      
                                                            Db2 SQL ID: ADM001    
                                                                                  
    G - Groups                                 GO - Group objects                 
    P - Privileges                             GP - Group privileges              
    S - SSIDs                                  PP - Pending privileges            
                                                                                  
   Enter standard selection criteria:                                             
    Name  . . . .                            > Creator . . .            >         
    Type  . . . .                              AUTHID  . . .            >         
    Qualifier . .                            > SSID  . . . .                      
    Ends in <=. .                            > (e.g. n DAYS or n MONTHS)          
                                                                                  

   For pending privileges, you can enter filtering criteria in the Name, AUTHID, Creator, SSID, and Ends in fields.

   If no pending privileges are defined (the ADBGMPP table is empty), you have no privileges to manage. You must first add a group privilege.

   Tip: If you have already added a group privilege and still do not see any pending privileges, ensure that you have expanded any generic objects and that the defined group privileges are applicable to your group objects. For example, if your group privilege applies to functions, but your objects include only tables, no pending privileges are generated. For more information, see When pending privileges are generated in grant management.

   Otherwise, the GM - Manage Pending Privileges (ADB2ZGPP) panel displays a list of grant management privileges.

   ADB2ZGPP  ------------- DD1A GM - Manage Pending Privileges  Row 1 to 13 of 62 
   Command ===>                                                  Scroll ===> PAGE 
                                                                        More: >   
   Commands: CLEANUP  DELETE  RUN  DISFAILED                                      
   Line commands:                                                                 
    C - Cleanup  D - Delete  G - Group  GP - Group privilege  I - Interpret       
    P - Privilege  R - Run  S - SSID  ? - Show all line commands                  
                                                                                  
   Sel AUTHID   R Group Name       Privilege Name   P Statement                   
       *        * *                *                * *                           
   --- -------> - ---------------> ---------------> - --------------------------->
       TS5771     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5772     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5771     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5772     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5771     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5772     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5771     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5772     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5771     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5772     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5771     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5772     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "
       TS5771     KWAPP            PROCPRIV         Y GRANT EXECUTE ON PROCEDURE "

   Tips:

   • Scroll right to see more columns, such as any error messages that were returned by previous attempts to run the statement in a pending privilege.
   • Use the / line command to view all the details for a particular privilege.
   • To display only those privileges that are pending (meaning that the GRANT or REVOKE statements have not been run), type a Y in the search argument area under the P column:

     
     Sel AUTHID   R Group Name       Privilege Name   P Statement                   
         *        * *                *                Y *                           
     --- -------> - ---------------> ---------------> - --------------------------->

   • To display only those privileges for which the statements were previously run but failed, issue the DISFAILED command. Then use the Run SQL Code and Error Message columns to determine why the privilege failed.
4. Perform any of the following actions as needed to run or manage your privileges:
   • Running the statements in pending privileges
   • Cleaning up pending privileges
   • Deleting a pending privilege