2

I have installed DB2 Express on a PC. My user is not an administrator user, however as far as i know, it is possible to grant a user rights, so he can create/delete/modify a database.

I have executed: db2set DB2_GRP_LOOKUP=local after that i created a Local group: DB2Admins, and added myself to it. After that i executed `db2 update dbm cfg using sysadm_group db2admins.

After that i tried to create database test, but i get the error SQL1092N The requested command or operation failed because the user ID does not have authority to perform the requested command or operation. User ID: "myUserID".

I created a local user, and added it to the same group. If i log in with this local user, then it is ok. The user can create a a database. My user however is a domain user, and with that it is not working.

Does anyone has any idee how to solve this?

Thanks in advance!

Improve this question
10
  • Did you restart the instance after setting the DB2_GRP_LOOKUP variable?
    – mustaccio
    Commented Feb 25, 2014 at 13:04
  • @mustaccio: yes, i executed db2stop and then db2start
    – kampi
    Commented Feb 25, 2014 at 13:08
  • If you have enabled extended security (which is the default installation option), you may want to try adding your ID to the DB2USERS group.
    – mustaccio
    Commented Feb 25, 2014 at 13:17
  • @mustaccio: i have added to both local groups, db2admins and db2users a domain group which includes my usernamte too. i also added my username seperate too, but still not working :(
    – kampi
    Commented Feb 25, 2014 at 13:25
  • 1
    What are the credentials of the login that runs the DB2 service? It needs enough permissions to do the AD lookup. Local Service obviously won't do, for example.
    – mustaccio
    Commented Feb 25, 2014 at 16:05

1 Answer 1

Reset to default
2

DB2 will by default look for the group information in the same directory where the user is defined. For a domain user that would be the domain itself. If a domain user is a member of a local group, after setting DB2_GRP_LOOKUP=local make sure to restart the DB2 instance.

If you have enabled extended security (which is the default installation option), you may want to try adding your ID to the DB2USERS group.

Since the DB2 instance will need to perform the domain directory lookup when authenticating domain users, the account that runs the DB2 instance service must have sufficient permissions to perform the AD lookup. For example, Local Service authority would not be able to do that.

Each DB2 instance service needs such authority. There are other DB2-related services (DB2 DAS, DB2 Remote Command Server, etc. -- described in http://pic.dhe.ibm.com/infocenter/db2luw/v10r5/topic/com.ibm.db2.luw.qb.server.doc/doc/r0023249.html) -- they do not perform authentication and therefore do not require domain rights.

Improve this answer
1
  • Thank you worked perfectly... the secret sauce for me was that I needed to reconfigure the DB2 service to run as a domain account, never would have thought of that.
    – BCG
    Commented Jul 15, 2017 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.