Establishing an explicit trusted connection and switching the user ID

You can establish an explicit trusted connection by making a request within an application when a connection to a DB2® database is established. The security administrator must have previously defined a trusted context, using the CREATE TRUSTED CONTEXT statement, with attributes matching those of the connection you are establishing (see Step 1, later).

1. The security administrator defines a trusted context in the server by using the CREATE TRUSTED CONTEXT statement. For example:

   CREATE TRUSTED CONTEXT MYTCX  
          BASED UPON CONNECTION USING SYSTEM AUTHID NEWTON  
          ATTRIBUTES (ADDRESS   '192.0.2.1')  
          WITH USE FOR PUBLIC WITHOUT AUTHENTICATION  
          ENABLE

2. To establish a trusted connection, use one of the following APIs in your application:

   Option	Description
   Application	API
   CLI/ODBC	SQLConnect, SQLSetConnectAttr
   XA CLI/ODBC	Xa_open
   JAVA	getDB2TrustedPooledConnection, getDB2TrustedXAConnection

3. To switch to a different user, with or without authentication, use one of the following APIs in your application:

   Option	Description
   Application	API
   CLI/ODBC	SQLSetConnectAttr
   XA CLI/ODBC	SQLSetConnectAttr
   JAVA	getDB2Connection, reuseDB2Connection
   .NET	DB2Connection.ConnectionString keywords: TrustedContextSystemUserID and TrustedContextSystemPassword

   The switching can be done either with or without authenticating the new user ID, depending on the definition of the trusted context object associated with the explicit trusted connection. For example, suppose that the security administrator creates the following trusted context object:

   CREATE TRUSTED CONTEXT CTX1 
   	BASED UPON CONNECTION USING SYSTEM AUTHID USER1
   	ATTRIBUTES (ADDRESS   '192.0.2.1')      
     WITH USE FOR USER2 WITH AUTHENTICATION,   
                  USER3 WITHOUT AUTHENTICATION  
     ENABLE  

   Further, suppose that an explicit trusted connection is established. A request to switch the user ID on the trusted connection to USER3 without providing authentication information is allowed because USER3 is defined as a user of trusted context CTX1 for whom authentication is not required. However, a request to switch the user ID on the trusted connection to USER2 without providing authentication information will fail because USER2 is defined as a user of trusted context CTX1 for whom authentication information must be provided.

int main(int argc, char *argv[])
{
	SQLHANDLE henv;		       /* environment handle */
	SQLHANDLE hdbc1;		     /* connection handle */
	char origUserid[10] = "newton";
  char password[10] = "test";
  	char switchUserid[10] = "zurbie";
	char dbName[10] = "testdb";
	 
// Allocate the handles 
SQLAllocHandle( SQL_HANDLE_ENV, &henv );
SQLAllocHandle( SQL_HANDLE_DBC, &hdbc1 );

// Set the trusted connection attribute
SQLSetConnectAttr( hdbc1, SQL_ATTR_USE_TRUSTED_CONTEXT, 
SQL_TRUE, SQL_IS_INTEGER );

// Establish a trusted connection
SQLConnect( hdbc1, dbName, SQL_NTS, origUserid, SQL_NTS, 
password, SQL_NTS );

//Perform some work under user ID "newton"
. . . . . . . . . . .

 // Commit the work
SQLEndTran(SQL_HANDLE_DBC, hdbc1, SQL_COMMIT); 


// Switch the user ID on the trusted connection
SQLSetConnectAttr( hdbc1, 
SQL_ATTR_TRUSTED_CONTEXT_USERID, switchUserid,  
SQL_IS_POINTER 
);

//Perform new work using user ID "zurbie"
. . . . . . . . . 

//Commit the work
SQLEndTranSQL_HANDLE_DBC, hdbc1, SQL_COMMIT); 

// Disconnect from database
SQLDisconnect( hdbc1 );

	return 0;

}  /* end of main */