CREATE PROCEDURE add new SQL SECURITY keyword

Hi Team,

I would like the "CREATE PROCEDURE" functionality to be enhanced with a SQL SECURITY keyword. Currently it is only possible with the SET SESSION AUTHORIZATION = <dbadm-user> in a stored procedure to let users execute the specific SQL within a stored procedure which need to be executed with elevated privileges like e.a. SQLADM or DBADM. But since the user also needs to be granted the GRANT SETSESSIONUSER privilege the user can also perform any SQL with the evelated privileges from IBM Data Studio or any other SQL query tool by first execute the SET SESSION AUTHORIZATION statement and then all SQL which are available for the elevated user. This is of course a security issue and can be solved by introducing the following SQL SECURITY keywords.

The SQL SECURITY keyword defines by which user the SQL within the stored procedure should be used to check the accessrights and execute the SQL. The SQL SECURITY keyword can have e.g. the following options INVOKER, CREATOR and OWNER and below the details for these three options :

SQL SECURITY INVOKER
This should be the default and means that all accessright checking and executing of the SQL within the stored procedure should be done by the user who starts / invokes the stored procedure.

SQL SECURITY CREATOR
This means that all accessright checking and executing of the SQL within the stored procedure should be done by the user who created the stored procedure. So with this option a DBADM user can create a stored procedure with SQL only a DBADM user can execute and since all accessright checking and executing of the SQL within the stored procedure is done by the creator, in this case a DBADM user, end user only need EXECUTE privilege on the stored procedure itself to be able to execute only the SQL statements within the stored procedure.

SQL SECURITY OWNER
Since owner and creator can be two different users on Db2 and ownership can also be transferre, I think it is wise to add this option also, so all accessright checking and executing of the SQL within the stored procedure should be done by owner of the stored procedure

By introducing this extra SQL SECURITY keyword we would get a lot of extra functionality to create stored procedures for end users so they can do more administration and self-service activities on the Db2 platform by themselves but in a very secure and controlled way.

Thanks and have a nice day !!!

Regards Ralph.