DB2 Server for VSE & VM: Application Programming

How to Use the Decision Tables

The DB2 Server for VSE & VM product uses decision tables to determine whether the owner of a package has the authority or the privilege to execute a given statement. There are three possible scores for each static statement:

'G'

Means that the package owner has the necessary authorization or privilege for this statement such that the owner can receive the RUN privilege.

'Y'

Means that the package owner has the necessary authorization or privilege for this statement such that the owner can receive the RUN privilege, but not the GRANT option on that privilege.

'D'

Means that the package owner must have DBA authority to execute the program containing this statement. No entry is made in the authorization catalog tables.

'G' is the highest score, followed by 'Y', followed by 'D'. For example, suppose a program contains three statements. The package owner receives a 'G', on two of them, but a 'Y' on the third (this occurs when the object referenced in the statement does not exist, or the privileges of the object cannot be resolved). In this situation, the database manager assigns the package a 'Y' (the lower score), allowing the owner to run the package but not to grant the RUN privilege on the package to another user. Because the preprocessor does not distinguish between certain SQL statements that are applied to one application server or to another, you can compensate by doing one of the following:

• Use dynamic statements that cause RUNAUTH=G on both application servers.
• Create separate packages on each application server. These separate packages can then be invoked by a mainline program.
• Create dummy tables that have the same user IDs and table names on the other application server.

Dynamic statements are always given a score of 'G'.

The next few pages show tables. In these tables:

'G', 'Y', and 'D' have the meanings outlined above.

'(G)' and '(Y)' mean that the score for the statement is either 'G' or 'Y', an error message is produced when the program is preprocessed, a partial section for the statement is placed into the package, and the authority for the statement is checked again at the time the package is run.

'n/a' means 'not applicable'.

package owner is the authorization ID of the person who preprocesses the program.