Authorization Failure Detail (Type AUTHFAIL)

This topic shows detailed information about Authorization Failure Detail (Type AUTHFAIL).

When you select AUTHFAIL, the data is retrieved from IFCID 140, and the following fields are printed:

AUTHID CHECKED: DE#08541             PRIVILEGE: VALID. SECLABEL
OBJECT TYPE   : ACEE                 REASON:       0 RC:    0
SOURCE OBJECT : AUDDB1               SOURCE OWNER:   DE#08541
TARGET OBJECT : AUDTB4               TARGET OWNER:   DE#08541
MLS    RID    : XXXXX                SECLABEL:       XXXXXXXX 
TEXT: CREATE TABLE AUDTB4 (IDCOLUMN ROWID GENERATED ALWAYS NOT
      NULL, BELIEBIG CHAR(50)) IN AUDDB1.AUDTS1

Field description

Here is a description of the field labels shown in the previous example:

AUTHID CHECKED

The authorization ID causing the failure.

PRIVILEGE

The privilege that was checked. Possible values are provided in the Db2® macro DSNDQW02.

OBJECT TYPE

The Db2 object type. Possible values are:

ACEE: Access control environment element (ACEE)
APPLPLAN: Application Plan
BUFFER: Buffer Pool
COLLECT: Collection
DATABASE: Database
DISTTYPE: Distinct Type
FUNCTION: Function
LOBTS: Table Space
PACKAGE: Package
PROCEDUR: Procedure
ROW: Row
SCHEMA: Schema
SEQUENCE: Sequence
STOGROUP: Storage Group
TAB/VIEW: Table or View
USERAUTH: System privileges, such as SYSADM or SYSOPR

REASON

The user-defined reason code from the access control authorization exit routine.

RC

The return code from the access control authorization exit routine. A value of 0 means "not applicable".

SOURCE OBJECT

If the OBJECT TYPE field is not blank, this field displays the name of the object against which the authorization was checked.

If the object type is blank, then this field displays the name of the object being created. It is valid only when the privilege is CREATE ALIAS, CREATE DBA, CREATE DBC, or CREATE STOGROUP.

Otherwise, N/A is printed.

SOURCE OWNER

If the OBJECT TYPE field is not blank, this field displays the qualifier of the object against which the authorization was checked. It is valid only for qualifiable objects.

If the object type is blank, this field displays the qualifier of the alias being created. It is valid only when the privilege is CREATE ALIAS.

Otherwise, N/A is printed.

TARGET OBJECT

The name of the object being defined. It is valid only when the target owner field is valid. Otherwise, N/A is printed.

TARGET OWNER

The qualifier of the object being defined. It is valid when the privilege is CREATE INDEX or CREATE TABLE. It is also valid for a CREATE VIEW authorization check against the set of CREATE VIEW, SELECT, INSERT, DELETE, and UPDATE privileges. Otherwise, N/A is printed.

MLS RID

The record identifier (RID) of the Multilevel Security (MLS) table that is updated or deleted.

SECLABEL

The security label of a row in the Multilevel Security (MLS) table.

TEXT

The SQL statement text associated with the failure. Long SQL statement text can be truncated, depending on the amount of space available.