Allow execution of revoke impact in batch mode

During migration of security from native DB2 to RACF, there is cleanup activity after creation of all profiles and permits completed in order to remove grants in DB2 for a clean picture. Also, for any other security configuration change, clean up activity of old users/groups used to manage DB2 objects this might be also a case. In such situation, a mass revoke might be required and testing object/grant by object/grant in panels is just impossible. Hence we would like to have a possibility of the mass revoke requests being processed and reported via batch interface.

Proposed solution:

We believe that the best and cleanest, also fully understandable solution would be to provide on input a valid, complete revoke statement or list of revoke statements. For instance:

REVOKE DELETE ON XX.TABA FROM USERA BY ALL;

REVOKE DELETE ON XX.TABA FROM GROUPA BY BIBI;

REVOKE DBADM ON DATABASE DBA FROM GROUPA ;

REVOKE DBADM ON DATABASE DBB FROM GROUPA

BY ROLE "R_DB2_SYSADM" NOT INCLUDING DEPENDENT PRIVILEGES ;

REVOKE DBADM ON DATABASE DBB FROM GROUPA

NOT INCLUDING DEPENDENT PRIVILEGES ;

The batch process shall analyze the revoke impact per statement and then write out in the output a report, something similar to the one, currently being printed in TSO panel revoke impact report.

We believe that this is the best as it is very clear what revoke I want to run, and what revoke then shall be examined and impact shall be reported on.