User mappings and federated trusted connections

These tables describe how user mappings, with and without remote IDs and remote passwords, are used in end-to-end federated trusted connections and in outbound federated trusted connections.

These tables describe the possible user mappings for BOSS, the connection originator, and for Mary, the connection re-user. In the tables, the term non-trusted connection refers to a regular connection that is not trusted on the inbound connection and not trusted on the outbound connection.

Some cells of the table use the term if available to describe a password. A password is available to the federated server if both a user ID and a password are explicitly specified as part of the connection. If you use API connect calls to connect to the federated server, then the password is explicitly passed in; for example, in CLI/ODBC, the password is specified through the SQL_ATTR_TRUSTED_CONTEXT_PASSWORD connection attribute. If you use the CONNECT statement to connect to the federated server, then use this syntax to pass in the password explicitly:

CONNECT TO database name USER user ID USING password

Mappings for connection originators and federated proxy users

Table 1. User mappings for BOSS, the connection originator
User mapping for BOSS	Non-trusted connection	End-to-end federated trusted connection (Where BOSS establishes the trusted inbound connection)	Outbound federated trusted connection (Where the server or user mapping option FED_PROXY_USER='BOSS' is set)
No user mapping	Pass BOSS's federated user ID and federated password (if available) to the remote data source.	Pass BOSS's federated user ID and federated password (if available) to the remote data source.	ERROR SQL1101N
User mapping that specifies only a remote user ID	Pass BOSS's remote user ID and federated password (if available) to the remote data source.	Pass BOSS's remote user ID and federated password (if available) to the remote data source.	ERROR SQL1101N
User mapping that specifies a remote user ID and a remote password	Pass BOSS's remote user ID and remote password to the remote data source.	Pass BOSS's remote user ID and remote password to the remote data source.	Pass BOSS's remote user ID and remote password to the remote data source.

Mappings for connection re-users

Table 2. User mappings for Mary, the connection re-user
User mapping for Mary	End-to-end federated trusted connection (Where BOSS establishes the trusted inbound connection, and the connection switches to Mary)	Outbound federated trusted connection (Where the server or user mapping option FED_PROXY_USER='BOSS' is set)
No user mapping	Pass Mary's federated user ID and federated password (if available) to the remote data source.	Pass Mary's federated user ID to the remote data source.
Non-trusted user mapping that specifies only a remote user ID	Pass Mary's federated user ID and federated password (if available) to the remote data source.	Pass Mary's federated user ID to the remote data source.
Non-trusted user mapping that specifies a remote user ID and a remote password	Pass Mary's federated user ID and federated password (if available) to the remote data source.	Pass Mary's federated user ID to the remote data source.
Trusted user mapping that specifies only a remote user ID	Pass Mary's remote user ID to the remote data source.	Pass Mary's remote user ID to the remote data source.
Trusted user mapping that specifies a remote user ID and a remote password	Pass Mary's remote user ID and remote password to the remote data source.	Pass Mary's remote user ID and remote password to the remote data source.