If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

 
Go Back  dBforums > Database Server Software > DB2 > db2profc, Privileges granted to groups are not used for authorization checking

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #1 (permalink)  
Old 08-24-06, 10:04
tubdba tubdba is offline
Registered User
 
Join Date: Aug 2004
Posts: 18
Thumbs down db2profc, Privileges granted to groups are not used for authorization checking

Hi,

during bind of static sqls from java-application against our ZOS DB2 V7 we receive -551.

The problem is quiet clear. Every programmer uses his own ID to bind "his" package to "his" user-Collection within our test-environment. During bind process of static sql all db2-authorization needed to perform the required sqls within the bnd-file are checked for the binder-ID, which includes insert, update etc on each table used.
We´ve granted those authorization on (racf)group-level. I found this in command-Reference:

db2profc - DB2 SQLJ Profile Customizer

Processes an SQLJ profile containing embedded SQL statements. By default, a DB2 package is created in the database; this utility augments the profile with DB2-specific information for use at run time. This utility should be run after the SQLJ application has been translated, but before the application is run.
Authorization
One of the following:
sysadm or dbadm authority
BINDADD privilege if a package does not exist, and one of:
IMPLICIT_SCHEMA authority on the database if the schema name of the package does not exist
CREATEIN privilege on the schema if the schema name of the package exists
ALTERIN privilege on the schema if the package exists
BIND privilege on the package if it exists.
The user also needs all privileges required to compile any static SQL statements in the application.

Privileges granted to groups are not used for authorization checking of static statements.

Bindadd and packadm-priviliges are granted to each developer.
We don´t want to grant some kind of adm authorizations nor grant table-authorization to public.

Is there a way to tell db2profc to check gróup authorizations by some kind of customization ?
Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On