Managing access through row permissions and column masks

Row and column access control enables you to manage access to a table at the level of a row, a column, or both. You can implement row access control through row permissions and column access control through column masks.

Row and column access control
Row and column access control is a DB2 security solution that uses SQL to control access to a table at the level of a row, a column, or both.
Row permission
A row permission is a database object that describes a specific row access control rule for a table. In the form of an SQL search condition, the rule specifies the conditions under which a user, group, or role can access the rows of data in the table.
Column mask
A column mask is a database object that describes a specific column access control rule for a column. In the form of an SQL CASE expression, the rule specifies the condition under which a user, group, or role can receive the masked values that are returned for a column.
Rules of row and column access control
The rules of row and column access control apply to both read and write operations on a table. The conditions that are specified in row permissions and column masks apply to both data retrieval operations and data change operations.
Creating row permissions
A row permission specifies the conditions under which users can access a row. With the SECADM authority, you can use the CREATE PERMISSION statement to create a row permission.
Creating column masks
A column mask specifies the rules for users to receive the masked values that are returned for the column. With the SECADM authority, you can use the CREATE MASK statement to create a column mask.
Modifying column masks to reference UDFs
With the SECADM authority, you can modify column masks on tables that are activated for column access control.
Using INSERT on tables with row access control
You can use the INSERT statement on tables that are activated for row access control.
Creating triggers for tables with row and column access control
With the required authority and privileges, you can create triggers for tables that are activated for row and access control.

Parent topic: Getting started with DB2 security