-552 authorization-id DOES NOT HAVE THE PRIVILEGE TO PERFORM OPERATION operation

Explanation

An operation was attempted by an authorization ID that lacks the required authority.

authorization-id
The authorization ID that attempted to perform the operation.

If you are using a trusted context, the authorization-id value might be a role instead of an authorization ID. A role is returned if a role was in effect and the authorization checking is performed against the role, rather than the authorization ID of the session, when the condition was encountered. Otherwise an authorization ID is returned. A role is returned in the following format as a single token:

ROLE: role-name DOES NOT HAVE THE PRIVILEGE TO PERFORM OPERATION operation

operation
The operation that was attempted.

Start of changeIf you use the RACF® access control module for authorization checking, auth-id might be different from the value that is reported in message ICH408I. The ID that is reported in message ICH408I is the user ID that RACF used to check the privilege.End of change

System action

The statement cannot be processed.

Administrator response

Check for an attempted authorization violation.

Programmer response

Ensure that the authorization ID has been granted the authority necessary to perform the operation.

SECADM authority is required to revoke any of the following:

  • System DBADM authority
  • DATAACCESS authority
  • ACCESSCTRL authority
  • CREATE_SECURE_OBJECT privilege

SQLSTATE

42502