Troubleshooting federated trusted connections

Occasionally trusted connections fail. When they do, use these tips and tools to troubleshoot the problem.

Tools for troubleshooting

To find out whether an outbound connection is trusted or not, perform one of the following tasks:
  • If audit logs on the remote database server were configured to log connections, check those audit logs.
  • Check the informational messages, which are at diaglevel 4, in the db2diag.log file on the federated server.

Trusted connection fails

When an explicit trusted connection request fails, warning SQL20360W is returned. When an implicit trusted connection attempt fails, no message is returned. In both cases, a regular non-trusted connection is created.

These are common causes of trusted connection failure:

  • The database server does not have an enabled trusted context object. The trusted context object must explicitly state ENABLE.
  • The trusted context objects on the database server do not match the trust attributes that are presented. For example, the IP address specified in a trusted context object might be incorrect, or you might need to create additional trusted context objects to accommodate additional trusted connections.
  • The application requests an explicit trusted connection, but the database server authentication type is set to CLIENT.
  • The client is not using TCP/IP to communicate with the database server.

Switching the user on the connection fails

When a user is not switched on a connection, SQL20361N is returned, and the connection is placed into the unconnected state. While in an unconnected state, the only statements that are allowed are commit, rollback, connect, connect reset, disconnect, and another switch-user request.

These are the common causes of connection-switching failure:
  • The user ID does not have connect privileges on the database. In this case SQL1060N is returned.
  • The user ID or PUBLIC is not defined in the WITH USE FOR clause of the trusted context.
  • Switching the user is allowed with authentication, but the user presents no credentials or the wrong credentials.
  • A switch-user request is not made on a transaction boundary.
  • The trusted context that is associated with a trusted connection has been disabled, dropped, or altered.