SAS/ACCESS 9.2 for Relational Databases: Reference, Fourth Edition

532 Accessing DB2 System Catalogs 4 Chapter 16uses the RRSAF-supported authorization identifier to validate a given connection’sauthorization to use both DB2 and system resources, when those connections are madeusing the System Authorization Facility and other security products like RACF.Basically, this authorization identifier is the user ID with which you are logged on toz/OS.With RRSAF, the SAS server makes the connections for each client and theconnections have the client z/OS authorization identifier associated with them. This istrue only for clients that the SAS server authenticated, which occurred when the clientspecified a user ID and password. Servers authenticate their clients when the clientsprovide their user IDs and passwords. Generally, this is the default way that serversare run. If a client connects to a SAS server without providing his user ID andpassword, then the identifier associated with its connections is that of the server (aswith CAF) and not the identifier of the client.Other than specifying DB2RRS at SAS start-up, you do not need to do anything elseto use RSSAF. SAS/ACCESS Interface to DB2 under z/OS automatically signs on eachconnection that it makes to DB2 with either the identifier of the authenticated client orthe identifier of the SAS server for non-authenticated clients. The authenticated clientshave the same authorities to DB2 as they have when they run their own SAS sessionfrom their own ID and access DB2.Accessing DB2 System CatalogsFor many types of SAS procedures, SAS/ACCESS Interface to DB2 under z/OS mustaccess DB2 system catalogs for information. This information is limited to a list of alltables for a specific authorization identifier. The interface generates this SQL query toobtain information from system catalogs:SELECT NAME FROM SYSIBM.SYSTABLESWHERE (CREATOR = ’authid’);Unless you specify the AUTHID= option, the authorization ID is the z/OS user IDthat is associated with the job step.The SAS procedures or applications that request the list of DB2 tables includes, butis not limited to, PROC DATASETS and PROC CONTENTS, or any application thatneeds a member list. If the SAS user does not have the necessary authorization to readthe DB2 system catalogs, the procedure or application fails.Because querying the DB2 system catalogs can cause some locking contentions,SAS/ACCESS Interface to DB2 under z/OS initiates a separate connection for the queryto the DB2 system catalogs. After the query completes, a COMMIT WORK command isexecuted.Under certain circumstances, you can access a catalog file by overriding the defaultvalue for the “DB2CATALOG= System Option” on page 403.