DB2 - Correlation Identifier for RACF Access Checks Triggered by DB2 (FASTAUTH)

Description of Current Situation:
We recently migrated from Db2 internal authorization to RACF-based Db2 Security using RACF profiles.

Functional behavior is correct, but transparent and auditable reporting of Db2 access decisions is currently not possible. Using zSecure Access Monitor*, we can see RACF class/profile decisions, return codes, and user attributes that influenced an access.

However, when Db2 performs an authorization sequence — for example:

• User attempts access to DBD0.IDAA_MGMT.SELECT → RACF return code 8 (expected denial)
• Db2 then checks DBD0.SYSADM → RACF return code 0 (user has administrative privilege)

Both attempts are visible in Access Monitor.

The successful administrative authority check (RC=0), which actually grants access to the underlying Db2 object, is not reported in a way that allows us to correlate it with the failed check.

As at the same time a user tries to access another resource like DBD0.IDAAV2_MGMT.SELECT

This results in an audit gap: the resource owner sees a denied SELECT on the table, even though Db2 subsequently allows the read access via the SYSADM authority. This means administrative access to sensitive data is effectively 'unseen' in terms of relation of both access checks is not transparent.

Required Enhancement:
A Unique Correlation Identifier (Correlation ID) for Each Db2 Authorization Flow

A new optional parameter or context token that:

• Is generated once per “authorization flow” initiated by Db2
• Is passed to RACROUTE REQUEST=FASTAUTH
• Is included in SMF Type 80 records and zSecure Access Monitor events
• Is returned consistently across all RACHECK calls triggered within the same logical access chain

Business and Audit Justification:
The inability to correlate Db2 authorization flows results in:

• Incomplete reporting of actual access decisions
• “Invisible” administrative access to sensitive data
• Incorrect perception of denied access when access was actually granted via SYSADM or similar privileges
• A non-auditable gap where administrators’ read activities are not transparently tracked

Regulated environments (financial, insurance) require demonstrable, transparent, and correlated access reporting.

zSecure Access Monitor:
zSecure Access Monitor uses RACF post-processing exits to record access events. This is completely separate to any SMF records that RACF may write for auditing. Therefore any enhancement would also need to include the proposed correlation ID when those RACF post-processing exits are called so that Access Monitor can include them in the recorded access event records.