User mappings

A user mapping is an association between an authorization ID on the federated server and the information that is required to connect to the remote data source.

To create a user mapping, you specify the following information in the CREATE USER MAPPING statement:
  • local authorization ID
  • local name of the remote data source server as specified in the server definition
  • remote ID and password
For example, assume that you created a server definition for a remote server and specified 'argon' as the local name for the remote server. To give Mary access to the remote server, create this user mapping: 
CREATE USER MAPPING FOR Mary 
SERVER argon
OPTIONS (REMOTE_AUTHID 'remote_ID', REMOTE_PASSWORD 'remote_pw')

When Mary issues an SQL statement to connect to the remote server, the federated server performs these steps:

  1. Retrieves Mary's user mapping
  2. Decrypts the remote password 'remote_pw' that is associated with the remote server
  3. Calls the wrapper to connect to the remote server
  4. Passes the remote ID 'remote_ID' and the decrypted remote password to the wrapper
  5. Creates a connection to the remote server for Mary

By default, the federated server stores user mapping in the SYSCAT.USEROPTIONS view in the global catalog and encrypts the remote passwords. As an alternative, you can use an external repository, for example a file or an LDAP server, to store user mappings. To provide the interface between the federated server and the external repository, you create a user mapping plug-in.

No matter how you store user mappings, carefully restrict access to them. If user mappings are compromised, data in the remote databases might be vulnerable to unauthorized activity.

In Federation component, you can also create public user mappings to allow all local database users to access a data source through a single remote user ID and password.