Deactivation of ownership based authorization checking

Currently during the authorization check in DB2 there is a mixture of possible rules giving access to operation/resource one of which is the ownership check. In principle, this is a disturbing part of authorization check from the security administration perspective as it in a way removes the single point of control of the resource access from dedicated security administrators. This is especially visible when the security mechanism used is not native, but DB2 RACF security or mixture of both. Another problem observed by us is related to the inconsistency of db2 behavior when checking the same access to resource/operation in native security and DB2 RACF security. Namely, in some scenarios ownership is considered when native security is used, but invalidly is not considered when DB2 RACF security is activated and profiles are defined for the same authorization check.

In modern DB2 security standards it should be possible to have an environment with the access being fully controlled only and only by granted or RACF permitted access with ownership being not at all considered for any operation, process or resource access check. This will also make security far more transparent, better and easier auditable, more simple to manage and easier to troubleshoot in case of some security access problems.

The implementation should be controllable via new ZPARM and of course must be implement in DB2 datasharing group scope, in case DB2 datasharing is exploited.