RE: Adopted authority and triggers

[Ed Fishel <edfishel@xxxxxxxxxx>]

Walden H Leverich wrote on 04/03/2007 06:01:47 PM:

> I would have first expected that a user's authority to a trigger program
> would either be ignored, or at least honor the adopted authority. I say
> this because the trigger is, conceptually, a component of the DBMS.
> Honoring the authority on the trigger program is somewhat akin to
> preventing you from inserting a row into a physical because there's an
> access path built over it that you don't have access to, and therefore
> you can't update that access path.

Yesterday afternoon I found these recommendations in the information
center.


 Create the program with USRPRF(*OWNER) and *EXCLUDE public authority, and
 do not grant authorities to the trigger program to USER(*PUBLIC). Avoid
 having the trigger program altered or replaced by other users. The
 database calls the trigger program even if the user causing the trigger
 program to run has authority to the trigger program.

 Create the program in the physical file's library.

After reading this recommendation I did not understand why the public
authority of the trigger program should be *EXCLUDE but the public
authority of its library would cause it to not be called. I talked to some
people and they led me to this:

http://www-1.ibm.com/support/docview.wss?rs=0&q1=SYSTEM+I&q2=SE24253&uid=nas2f38beb54b4aebe1f8625710a0072e90b&loc=en_US&cs=utf-8&cc=us&lang=en
 (I found the page by going to http://www.ibm.com/support/us/ and typing
"System i" in the Search Technical support search field and pressing Enter.
I then typed "SE24253" in the Additional Search terms field and pressed
Enter again.)  The bottom line is that this is a known problem and it will
be fixed.

Ed Fishel,
edfishel@xxxxxxxxxx