4

I have a list of user accounts on AIX server, where the db2 database resides in. The user accounts all belong to a specific group which I can confirm from aix shell.

User accounts work in DB2. However, I cannot seem to be able to add execution rights to the group so I wouldn't have to grant execution rights to individual user accounts.

I have tried this:

GRANT EXECUTE ON PROCEDURE MYSCHEMA.MYPROCEDURE TO GROUP MYGROUP WITH GRANT OPTION;

using a user that has created the stored procedures, and it succeeds. However, when trying to execute that procedure using another account that belongs to that group in aix server, I get

"useraccounthere" does not have the required authorization or privilege to perform
operation "EXECUTE" on object "MYSCHEMA.MYPROCEDURE".. SQLCODE=-551, SQLSTATE=42501,
DRIVER=4.14.113

Any ideas what could be wrong, or what I could check?

shgnInc
  • 258
  • 2
  • 14
eis
  • 141
  • 1
  • 3

1 Answers1

1

I ran into a similar problem and while this wasn't what happened here, this answer may help others running into this.

Make sure the OS group mygroup is all lowercase. DB2 on AIX does not recognize uppercase letters in the group name and will fail to validate a user belongs to a group if that group name has uppercase letters. eg:

# id useraccounthere
uid=xx(useraccounthere) gid=yyy(mygroup) <- this works

# id useraccounthere
uid=xx(useraccounthere) gid=yyy(MyGroup) <- this does not work

This is documented here: DB2 UDB Security

NullUserException
  • 315
  • 2
  • 11