Replacing SYSADM with DBADM on OS/390

Michael Fennell

Replacing SYSADM with DBADM on OS/390
Folks,

I just wanted to post the question - is there a down side to replacing
SYSADM with DBADM. Currently we are responsible for all the databases
within our subsystem, so I am not sure how much will actually change.

Mike Fennell
Fidelity Investments
(508) 787-9120


---------------------------------------------------------------------------------
Welcome to the IDUG DB2-L list. To unsubscribe, go to the archives and home page at http://www.idugdb2-l.org/archives/db2-l.html. From that page select "Join or Leave the list". The IDUG DB2-L FAQ is at http://www.idugdb2-l.org. The IDUG List Admins can be reached at [login to unmask email] Find out the latest on IDUG conferences at http://conferences.idug.org/index.cfm

Min Zhang

Re: Replacing SYSADM with DBADM on OS/390
(in response to Michael Fennell)
Mike,

If you are using v7, I found from "DB2 UDB for OS/390 and z/OS V7 SQL Reference" DROP 5.5 has following requirement on Authorization, which I know is true when I am trying to drop Aliases. Check others SQL statements to see if SYSADM is required but not DBADM.

.......

Authorization
To drop an alias, storage group, or view, the privilege set that is defined below must include at least one of the following:

Ownership of the object
SYSADM or SYSCTRL authority

Regards,

Min Zhang

DB2 DBA
703.876.4320

>>> [login to unmask email] 12/29/04 02:59PM >>>
Folks,

I just wanted to post the question - is there a down side to replacing
SYSADM with DBADM. Currently we are responsible for all the databases
within our subsystem, so I am not sure how much will actually change.

Mike Fennell
Fidelity Investments
(508) 787-9120


---------------------------------------------------------------------------------
Welcome to the IDUG DB2-L list. To unsubscribe, go to the archives and home page at http://www.idugdb2-l.org/archives/db2-l.html. From that page select "Join or Leave the list". The IDUG DB2-L FAQ is at http://www.idugdb2-l.org. The IDUG List Admins can be reached at [login to unmask email] Find out the latest on IDUG conferences at http://conferences.idug.org/index.cfm

---------------------------------------------------------------------------------
Welcome to the IDUG DB2-L list. To unsubscribe, go to the archives and home page at http://www.idugdb2-l.org/archives/db2-l.html. From that page select "Join or Leave the list". The IDUG DB2-L FAQ is at http://www.idugdb2-l.org. The IDUG List Admins can be reached at [login to unmask email] Find out the latest on IDUG conferences at http://conferences.idug.org/index.cfm

Edward Long

Re: Replacing SYSADM with DBADM on OS/390
(in response to Min Zhang)
Hi Mike.
Happy New Year and all that stuff.
Closest to the pin is not a sewing term!!


"Fennell, Michael" <[login to unmask email]> wrote:

Folks,

I just wanted to post the question - is there a down side to replacing SYSADM with DBADM. Currently we are responsible for all the databases within our subsystem, so I am not sure how much will actually change.

Mike Fennell
Fidelity Investments
(508) 787-9120
--------------------------------------------------------------------------------- Welcome to the IDUG DB2-L list. To unsubscribe, go to the archives and home page at http://www.idugdb2-l.org/archives/db2-l.html. From that page select "Join or Leave the list". The IDUG DB2-L FAQ is at http://www.idugdb2-l.org. The IDUG List Admins can be reached at [login to unmask email] Find out the latest on IDUG conferences at http://conferences.idug.org/index.cfm

Edward Long

---------------------------------------------------------------------------------
Welcome to the IDUG DB2-L list. To unsubscribe, go to the archives and home page at http://www.idugdb2-l.org/archives/db2-l.html. From that page select "Join or Leave the list". The IDUG DB2-L FAQ is at http://www.idugdb2-l.org. The IDUG List Admins can be reached at [login to unmask email] Find out the latest on IDUG conferences at http://conferences.idug.org/index.cfm

Mark McCormack

Replacing SYSADM with DBADM on OS/390
(in response to Edward Long)
Mike,

We have one secondary authid for the whole DBA group. That authid lost
sysadm authority a few years ago. It was replaced with dbadm authority for
all application data bases. We have had a few minor glitches.
1. We lost the ability to -alter bufferpool. Only sysadm can do that.
2. It is necessary to have sysadm grant use of bufferpools and perhaps
stogroups to the dbadm authid.
3. Dbadm can create, grant use, and drop a table where the table creator
is not the dbadm's authid. DB2v7 allows dbadm to create a view where the
view creator is not the dbadm's authid. But dbadm cannot then grant use of
the view or drop the view. This may be unusual for many, but we do it
often enough that we have needed to add extra secondary authids to cover
this.

Mark

---------------------------------------------------------------------------------
Welcome to the IDUG DB2-L list. To unsubscribe, go to the archives and home page at http://www.idugdb2-l.org/archives/db2-l.html. From that page select "Join or Leave the list". The IDUG DB2-L FAQ is at http://www.idugdb2-l.org. The IDUG List Admins can be reached at [login to unmask email] Find out the latest on IDUG conferences at http://conferences.idug.org/index.cfm