Views and privileges

[rhodesm_groups]

Hi DB2 gurus! Question for you all. Is the following possible (mainly
the last two bullets)?

* Already have table called XYZ of information keyed by SSNs.
* Create an xref table for SSNs to employee numbers. We'll call this
table XREF.
* Create a view that joins XYZ and XREF, showing all columns of XYZ,
but with the employee number instead of SSN.
* Remove select access on XYZ and XREF for all users.
* Users can perform selects on the view.

Thanks,
Mike

[Serge Rielau]

rh************@yahoo.com wrote:

Hi DB2 gurus! Question for you all. Is the following possible (mainly
the last two bullets)?

* Already have table called XYZ of information keyed by SSNs.
* Create an xref table for SSNs to employee numbers. We'll call this
table XREF.
* Create a view that joins XYZ and XREF, showing all columns of XYZ,
but with the employee number instead of SSN.
* Remove select access on XYZ and XREF for all users.
* Users can perform selects on the view.

Thanks,
Mike

Sure, no problem. Just make ser you have at least an informational (NOT
ENFORCED) RI constraint, so DB2 knows it can internally substitute and
do join elimination whenever the empno is not required.

Cheers
Serge
--
Serge Rielau
DB2 Solutions Development
IBM Toronto Lab

[Knut Stolze]

rh************@yahoo.com wrote:

Hi DB2 gurus! Question for you all. Is the following possible (mainly
the last two bullets)?

* Already have table called XYZ of information keyed by SSNs.
* Create an xref table for SSNs to employee numbers. We'll call this
table XREF.
* Create a view that joins XYZ and XREF, showing all columns of XYZ,
but with the employee number instead of SSN.
* Remove select access on XYZ and XREF for all users.
* Users can perform selects on the view.

That's perfectly fine and the traditional mechanism to implement more
fine-grained access rules.

--
Knut Stolze
DB2 Information Integration Development
IBM Germany