4

I'm struggling here on how to do this I couldn't find anywhere or won't be able understand the documentation.

So I'm connected as a DBA user on a DB2 client (TOAD for example) and I want to create a new user to the database from this client, I went to the User tab, right click on it and chose the Add User option.

There is no place to add the user password. Even confirming the create command the user appears on the users list.

So I went to the command line tool and try to create a new using the GRANT command as:

GRANT DBADM WITH DATAACCESS WITH ACCESSCTRL ON DATABASE TO USER TEST;

The user gets created (I see it on the user tab on TOAD) but I'm unable to connect with it because I didn't define the password.

So, how can I define a password for newly created user on DB2 that it is not an OS user?

Improve this question

3 Answers 3

Reset to default
8

There are no users in DB2 that are not OS users. The client software (not only Toad is guilty of this) makes this a bit confusing: what they show as "users" are actually grants given to the (externally defined) users.

As you have discovered, you can grant privileges to arbitrary users or groups, and no verification is done if those users and groups exist at that time.

However, to connect to the database and exercise the granted privileges you must authenticate first, and for that you must have the user defined in the OS (or another configured authentication service, such as an LDAP directory).

Improve this answer
0
2

Well, you can write your own plugin with your own security authentication...

https://www.ibm.com/developerworks/data/library/techarticle/dm-0512chong/index.html The code is very small and create three plugins txtclient, txtgroup, and txtserver.

In the example, they authenticate the users based on a hard coded list of users....on file txtcommon.c. I have ran this sample before and impressed my co-workers by login in with user newton, socrates, plato, boss.... NOT OS users at all, they were panicking.....

Improve this answer
1
  • Well that is just another way to call it, as in @mustaccio 's answer, an externally defined users. It is a circumvent way to customize your access based on a security role (defined permissions through plugins) that pre-exists in the database. Although it is a way to say that you don't necessarily need an OS user to login into DB2 I would rather create an OS user and give proper grants than going through this plugin process which IMHO is a total overkill. Thank you for sharing this information. I really appreciated it. +1 for you. Cheers.
    – Jorge Campos
    Commented Jan 29, 2018 at 23:44
0

Taken from DB2 UDB security. User and group authentication is managed in a facility external to DB2 UDB, such as the operating system, a domain controller, or a Kerberos security system. This is different from other database management systems (DBMSs), such as Oracle and SQL Server.

+info? please click here http://www.ibm.com/developerworks/data/library/techarticle/dm-0508wasserman/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.