Getting Started with DB2 Express-C

Chapter 10 – Database Security 175
Command
SERVER (default)
CLIENT
SERVER_ENCRYPT
KERBEROS
SQL_AUTHENTICATION_DATAENC
SQL_AUTHENTICATION_DATAENC_CMP
GSSPLUGIN
Description
Authentication takes place at the server
Authentication takes place on the client
Like SERVER except user IDs and
passwords are encrypted
Authentication takes place using a Kerberos
security mechanism
Server authentication plus connections must
use data encryption
Like above, except data encryption only
used when available
Authentication uses an external GSS APIbased
plug-in security mechanism
Table 10.1 – Valid AUTHENTICATION parameter values
10.2 Authorization
Authorization consists of the privileges, authorities, roles, and label-based access control
(LBAC) credentials that are stored in DB2 system tables and are managed by DB2.
A privilege allows a user to execute a single type of operation against the database, such
as CREATE, UPDATE, DELETE, INSERT, etc.
A role allows you to group together different privileges that you can grant to a user, group,
or other roles.
An authority is a predefined role consisting of several privileges.
Label-based Access Control (LBAC) credentials include policies and labels supporting
granular access to specific rows and columns by given users. LBAC is not included with
DB2 Express-C, but you can read more about it in Chapter 2.
10.2.1 Privileges
Figure 10.3 shows some of the different privileges in DB2.