Download PDF - IBM Redbooks

Network trusted context is an object that gives users a specific set of privileges. It is available
when the user connects to the database through a trusted connection. An example is in a web
application environment. The application receives a trusted connection through the trusted
context. Then users can have their identity passed to the database server. With this trusted
context, you can then create a unique set of interactions between DB2 and your application.
DB2 extends the trusted context concept to optionally assign a default role to a trusted
context and optionally assign a role to a user of the context. A role is a database object that
groups together one or more privileges. It can be assigned to users or objects, if objects are
created in a trusted context, with the role defined as the owner, by specifying the ROLE AS
OBJECT OWNER clause in the trusted context definition. Databases, table spaces, tables,
indexes, and views can be implemented in a trusted context with a role as the owner of the
created objects. A role is only available within a trusted context. You can define a role for a
trusted context and assign it to authorization IDs. When associated with a role, and using the
trusted connection, an authorization ID inherits all the privileges that the role grants.
8.5.1 Attributes of a trusted context
A trusted context is an independent database entity that is based on a system authorization
ID and connection trust attributes.
The system authorization ID is a DB2 primary authorization ID that is used to establish the
trusted connection. A SYSTEM AUTHID for a connection can be associated only with a single
trusted context, ensuring that there is always a clear mapping between a specific connection
and a specific trusted context.
The connection trust attributes are ADDRESS, SERVAUTH, ENCRYPTION, and JOBNAME.
They identify specific connections to consider as part of the trusted context. Any defined
ADDRESS, SERVAUTH, or JOBNAME must also be unique in a trusted context.
A trusted connection can be established for a local or a remote application. The attributes
used to establish a trusted context are different for remote versus local applications.
Additional information: For more information, see Securing DB2 and Implementing MLS
on z/OS, SG24-6480.
8.5.2 How a trusted connection works
A trusted connection is a database connection that is established when the incoming
connection attributes match the attributes of a unique, enabled trusted context defined at the
server. The trust attributes identify a set of characteristics about the specific connection that
are required for the connection to be considered a trusted connection.
The relationship between a connection and a trusted context is established when the
connection to the server is first created and that relationship remains for the life of that
connection. If a trusted context definition is altered, the changed attributes of the trusted
context take effect when the next new connection request comes in, or when a switch user
request is issued within an existing trusted connection.
Chapter 8. Security enhancements of DB2 10 for SAP solutions 133