Simplifying Authorization

As you have seen throughout this appendix, there are many rules and considerations to take into account when setting up security in DB2 for zSeries. We would recommend you simplify securityas long as your installation standards allow itfollowing this simple strategy:

• The implementer should bind the procedure or user-defined function package using the DYNAMICRULES define behavior so that DB2 only checks the definer's ID to execute dynamic SQL statements in the routine. Otherwise, DB2 needs to check the many different IDs that invoke the user-defined function.

• If you have many different routines, group those routines into schemas and then grant EXECUTE on the procedures in the schema to the appropriate users. Users have EXECUTE authority on any functions that you add to that schema. For example, to grant the EXECUTE privilege on a schema to PUBLIC, issue the following statement:

 GRANT EXECUTE ON PROCEDURE myschemaname.* TO PUBLIC;