CURRENT SQLID

SUBSCRIBE DB2-L Anil Kale

CURRENT SQLID
Hi all !

While executing a DDL (DB2 for z/os V9), we often specify the SET CURRENT SQLID to a value, and then execute the DDL. Say for example,
SET CURRENT SQLID = 'DB2USR1';

CREATE TABLE....
COMMIT;

INSERT INTO TABLE...
COMMIT;

SELECT * FROM TABLE....

Lets say you want to prevent some users from setting the use a particular SQLID. For example, you want to prevent a user from being able to
SET CURRENT SQLID = 'DB2USR1';

How would you do that ? Do we need to involve ACF2 (or RACF) to perform something so as to prevent the SET SQLID to a particular value.

Thanks.

Anil

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
How can you expand your staff or do succession planning in this economy?
Mentoring is a proven, economical, way to train the next generation of DB2 Users!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Phil Grainger

Re: CURRENT SQLID
(in response to SUBSCRIBE DB2-L Anil Kale)
Hi Anil

Unless you are a SYSADM you can only SET CURRENT SQLID to one of your secondary authids - is that limiting enough?

Otherwise, I'm afraid a SYSADM can SET CURRENT SQLID to anything at all

Phil Grainger
Cogito Ltd.
[login to unmask email]
+44 (0) 1298 872 148
+44 (0) 7505 266 768
www.cogito.co.uk

Attend IDUG 2011 - the premiere events for DB2 professionals.
IDUG North America, 2-6 May, Anaheim California
IDUG EMEA, 14-18 November 2010, Prague Czech Republic


-----Original Message-----
From: IDUG DB2-L [mailto:[login to unmask email] On Behalf Of Anil
Sent: 25 November 2010 06:15
To: [login to unmask email]
Subject: [DB2-L] CURRENT SQLID

Hi all !

While executing a DDL (DB2 for z/os V9), we often specify the SET CURRENT SQLID to a value, and then execute the DDL. Say for example,
SET CURRENT SQLID = 'DB2USR1';

CREATE TABLE....
COMMIT;

INSERT INTO TABLE...
COMMIT;

SELECT * FROM TABLE....

Lets say you want to prevent some users from setting the use a particular SQLID. For example, you want to prevent a user from being able to
SET CURRENT SQLID = 'DB2USR1';

How would you do that ? Do we need to involve ACF2 (or RACF) to perform something so as to prevent the SET SQLID to a particular value.

Thanks.

Anil

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
How can you expand your staff or do succession planning in this economy?
Mentoring is a proven, economical, way to train the next generation of DB2 Users!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
How can you expand your staff or do succession planning in this economy?
Mentoring is a proven, economical, way to train the next generation of DB2 Users!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

Michael Arlebrandt

Re: CURRENT SQLID
(in response to Phil Grainger)
Hi,

Of course appropriate security EXITs needs to be in place

SDSNEXIT([login to unmask email]) used for SECONDARY AUTHID checking
SDSNEXIT([login to unmask email])

For our ACF2 Lpars we build those from corresponding hlq. CAIMAC([login to unmask email])
For our RACF, TOPSECRET Lpars we build those by running DSNTIJEX step 1 and 2

After that the authority for our secondary authids are handled by ACF2 or RACF

(and we need to modify all the samples created by installation CLIST due to the non-existing support for secondary authid in installation clists :(

Best regards
Michael

_________________________________
Michael Ärlebrandt
Senior DB2 Technical Specialist
Volvo Information Technology
Gothenburg, Sweden
Mailto:[login to unmask email]
_________________________________

-----Original Message-----
From: IDUG DB2-L [mailto:[login to unmask email] On Behalf Of Phil Grainger
Sent: den 25 november 2010 09:54
To: [login to unmask email]
Subject: Re: [DB2-L] CURRENT SQLID

Hi Anil

Unless you are a SYSADM you can only SET CURRENT SQLID to one of your secondary authids - is that limiting enough?

Otherwise, I'm afraid a SYSADM can SET CURRENT SQLID to anything at all

Phil Grainger
Cogito Ltd.
[login to unmask email]
+44 (0) 1298 872 148
+44 (0) 7505 266 768
www.cogito.co.uk

Attend IDUG 2011 - the premiere events for DB2 professionals.
IDUG North America, 2-6 May, Anaheim California
IDUG EMEA, 14-18 November 2010, Prague Czech Republic


-----Original Message-----
From: IDUG DB2-L [mailto:[login to unmask email] On Behalf Of Anil
Sent: 25 November 2010 06:15
To: [login to unmask email]
Subject: [DB2-L] CURRENT SQLID

Hi all !

While executing a DDL (DB2 for z/os V9), we often specify the SET CURRENT SQLID to a value, and then execute the DDL. Say for example,
SET CURRENT SQLID = 'DB2USR1';

CREATE TABLE....
COMMIT;

INSERT INTO TABLE...
COMMIT;

SELECT * FROM TABLE....

Lets say you want to prevent some users from setting the use a particular SQLID. For example, you want to prevent a user from being able to
SET CURRENT SQLID = 'DB2USR1';

How would you do that ? Do we need to involve ACF2 (or RACF) to perform something so as to prevent the SET SQLID to a particular value.

Thanks.

Anil

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
How can you expand your staff or do succession planning in this economy?
Mentoring is a proven, economical, way to train the next generation of DB2 Users!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
How can you expand your staff or do succession planning in this economy?
Mentoring is a proven, economical, way to train the next generation of DB2 Users!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv

_____________________________________________________________________
* IDUG North America * Anaheim, California * May 2-6 2011 * http://IDUG.ORG/NA *
* Your only source for independent, unbiased, and trusted DB2 information. *
_____________________________________________________________________
http://www.IDUG.org/mentor
How can you expand your staff or do succession planning in this economy?
Mentoring is a proven, economical, way to train the next generation of DB2 Users!
_____________________________________________________________________

If you need to change settings, http://www.idug.org/cgi-bin/wa?A0=DB2-L is the home of IDUG's Listserv