Specify OWNER for External Stored Procedures Merged

We use a CI/CD pipeline to create external stored procedures in all test environments and production. The pipeline use a single userID to create all objects, a user with as low privileges as possible and absolutely not SYSADM. When creating plans, packages and native stored procedures the pipeline sets the OWNER to a value that represents a RACF group belonging to the application involved. The CI/CD user can do that as you only need BINDAGENT privilege to set the OWNER. We use AUTHEXIT_CHECK=DB2 and that leads to privileges being verified against the OWNER of the plan, package or stored procedure.

For external stored procedures you cannot specify OWNER. The value is implicitly set to the value of CURRENT SQLID. To use SET CURRENT SQLID the value specified has to be a secondary authid for the user (or the user has to have high privileges). If the pipeline user get all the authids needed it gets too high privileges. Our work-around solution now is to use the same SQLID when creating all external stored procedures. The RACF group used for this has no privileges at all.

Why is this a problem to us? When the stored procedure executes a package the privileges are first checked against the owner of the stored procedure. If that owner does not have the privileges it is checked against the owner of SYSSTAT (or probably the plan if the stored procedure is called using static SQL). And if that fails too it is checked against the caller of the stored procedure. This means in our case that the caller has to have execute privilege on all the packages the are used by the stored procedure.

The other problem is that native stored procedures and external stored procedures are handled in different ways.

We suggest that the CREATE PROCEDURE statement for external stored procedures is enhanced with the OWNER keyword. We do not need the enhancement for external SQL procedures.