Security, Authorization, and Auditing
This domain covers Db2 12 authorities, privileges, row and column access control, and audit facilities.
Core rules
- Authentication is usually RACF or an equivalent SAF product; Db2 uses primary and secondary auth IDs. Authorization comes from administrative authorities or privileges.
- Administrative authorities include SYSADM, SYSCTRL, SYSOPR, DBADM, DBMAINT, SECADM, DATAACCESS, ACCESSCTRL, SQLADM, and SYSSTAT. SYSADM is highest; SECADM controls security objects and is separate from DBADM.
- Object privileges include SELECT, INSERT, UPDATE, DELETE, ALTER, INDEX, REFERENCES, TRIGGER, EXECUTE, and USAGE. Roles bundle privileges; trusted contexts support middleware.
- Row and column access control uses row permissions and column masks. Views are the older alternative for limiting access.
- Auditing uses audit trace classes and audit policies; SMF captures audit records.
Worked example
An application needs to read a table but must not see salary. The DBA creates a column mask on SALARY and a row permission restricting rows, then grants SELECT on the table to the application role. Reasoning: the mask and permission are enforced by Db2 for every access path; granting the base table is acceptable because RCAC limits what is visible.
Traps
- DBADM does not automatically include SECADM; separation of duties matters.
- REVOKE can cascade and remove dependent privileges.
- Static and dynamic SQL authorization are checked at different times.
- SYSADM bypasses RCAC, so test with a non-SYSADM ID.