External user mapping repositories

Store user mappings in an external repository for multiple federated servers to share, and reduce the administrative maintenance of managing user mappings that are stored on each federated server.

From a maintenance perspective, storing user mappings in an external repository is better than storing them in the catalog. Remote passwords expire on a regular basis. If you store user mappings in the catalog, when a remote password expires, it must be updated at the remote data source and in the catalog. With an external repository, when a remote password expires, you update it only once, in the external repository.

To use an external repository for user mappings, you must create a user mapping plug-in. The plug-in must use security settings that match the security settings that the external repository uses. Use Secure Sockets Layer (SSL) to secure communications between the federated server and the external repository. Then when you create the configuration file for the user mapping plug-in, specify that the plug-in uses SSL. Also, restrict access to the source code of the plug-in so that the information remains secure.

If auditing is turned on, each time the federated server uses the user mapping plug-in, a VALIDATE audit record is created. To capture VALIDATE records, configure the db2audit facility.

Note: To ensure security, public user mappings are not retrieved from external user mapping repositories.

These sample plug-ins and complete instructions for creating, testing, and deploying your own custom plug-in are provided: