Granular grant-able authorization to allow explaining all statements stored in DSC

Currently there is a requirement to hold at least SQLADM authority to explain statements kept in DSC, and which were executed with a different SQLID. This is security exposure as for such basic action like statement explain it gives the user all the extra authorizations which come with SQLADM authority while NONE of them is required for explain processing. When reading what is included in SQLADM, it is clear that in fact most of the authorizations included has nothing to do with sql.

Solution can be of different kinds.

1) provide a new grant option, for instance GRANT EXPLAIN ALL TO USERA

2) remove from SQLADM all the authorizations it currently has and which have nothing to do with sql processing, like profiles management for instance as this should be done by SYSCTRL at least etc.

3) provide zparm to allow customers to decide that when GRANT EXPLAIN TO USERA is issued, it in fact includes processing all statements stored in DSC.

We consider this requirement urgent since as in fact current design is invalid and causes security exposure

Needed By

Yesterday (Let's go already!)

Post comment

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.

Please enter your email address

RELATED IDEAS

Granular grant-able authorization to allow explaining all statements stored in DSC