LI74159: USER GETS SQL0551N WHEN USING A PRIVILEGE GRANTED THROUGH A ROLE AND ROLE NAME EQUALS NAME OF USER'S GROUP

DB2 Version 9.5 Fix Pack 5 for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 6a for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 7 for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 8 for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 9 for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 10 for Linux, UNIX, and Windows

APAR status

• Closed as program error.

Error description

• The user receives the SQL0551N error when using a privilege
  granted to the user through a role, and the role shares the same
  name with the group to which the user belongs.
  
  For example, if user U belongs to group G, where G=R
  
  create role R
  grant role R to user U
  grant select on table T to role R
  terminate
  (connect to database as user U)
  select * from T
  
  SQL0551N  "U" does not have the privilege to perform
  operation
  "SELECT"
  on object "T".  SQLSTATE=42501
  
  An entry can be seen in SYSCAT.ROLEAUTH to confirm that the user
  was granted the role.
  

Local fix

Problem summary

• USERS AFFECTED: ALL
  
  PROBLEM DESCRIPTION:
  
  The user receives the SQL0551N error when using a privilege
  granted to the user through a role.
  
  
  PROBLEM SUMMARY:
  
  THe SQL0551N is returned if the privilege is granted through a
  role and the role name is the same as that of the user's group.
  

Problem conclusion

• Problem was first fixed in Version 9.5 Fix Pack 5
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  IC61586 IC61894 IC61895 IC61896 IC61897

Fix information

• Fixed component name

  DB2 UDE ESE LIN

• Fixed component ID

  5765F4104

Applicable component levels

• R810 PSN

     UP

• R820 PSN

     UP

• R910 PSN

     UP

• R950 PSN

     UP