Download PDF - IBM Redbooks

authority is granted to an entire DB2 subsystem and allows the management of all objects in
DB2 except security. DBADM authority can be granted for only one database and allows
management of only the one database for which the privilege has been given.
System DBADM authority can be granted with two additional authorities, such as WITH
ACCESSCTRL and WITH DATAACCESS. Each of these optional authorities provides
additional privileges for DBADM. For example, by specifying WITH ACCESSCTRL, the system
DBADM administrator can run the LOAD, REORG, and UNLOAD utilities, and provide data access for
all tables, views, and materialized query tables (MQTs) in the subsystem. With option
DATAACCESS, the system DBADM administrator has access to all user tables, views, and
MQTs. Also, this type of authority can run all plans, packages, functions, and procedures.
8.1.3 Minimum privileges
DB2 10 introduces minimum privileges that an administrator can use to grant users only the
privilege that is required to perform specific tasks. Table 8-1 describes these authorities with
their specific tasks.
Table 8-1 Minimum privileges
Minimum
privilege
Description of privileges
ACCESSCTRL ► Controls access to user data
► Reads and updates all catalog tables that can be updated, except
SYSIBM.SYSAUDITPOLICIES
► Allows SECADM authority to delegate authority for GRANT and REVOKE
operations for DB2 objects
EXPLAIN ► Does not allow access to user data
► Allows query tuning activities, such as SQL EXPLAIN PLAN/ALL and
DESCRIBE TABLE
SQLADM ► Allows for greater separation of duties (SAPCL alert router now can be run
using SQLADM instead of using the SYSADM privilege)
► Does not allow access to user data
► Is unable to run SQL Data Definition Language (DDL) statements, such as
CREATE, ALTER, and DROP
► Supports privileges that are a superset of the EXPLAIN privileges
► Runs RUNSTATS and MODIFY STATISTICS utilities for any databases
► Issues DB2 commands such as START, STOP, DISPLAY PROFILE
► Runs system-defined routines (stored procedures and functions) and any
packages run within this routine
► Allows query tuning activities (such as SQL EXPLAIN STMTCACHE ALL,
STMTID, or STMTTIKEN, and START, STOP, or DISPLAY PROFILE), catalog
queries, and RUNSTATSDATAACCESS
A minimum privilege of each system authority can give users specific authority for performing
specific tasks. For example, system SQLADM authority can be assigned to SAP performance
analysts who are responsible for analyzing query performance in the DB2 subsystem. The
EXPLAIN authority is helpful for SAP application programmers who need to explain SQL
statements and collect metadata information about statements. Both the SQLADM and
EXPLAIN authorities can provide enough authority for tuning SQL statements.
ACCESSCTRL authority can be granted to database administrators who need to control
access to DB2 subsystems.
116 Running SAP Solutions with IBM DB2 10 for z/OS on the IBM zEnterprise System