System for providing user privilege information associated with secured data
In one embodiment, a system receives a request for user privilege information associated with an object of a first database. The system determines a class of a second database that corresponds to the object and accesses user privilege records that the second database associates with the class. The system determines a subset of the user privilege records that correspond to a selected user. Each of the subset of user privilege records comprise a privilege and a user privilege value indicating whether the selected user is authorized for that privilege. The subset of user privilege records are consolidated into a privilege matrix comprising a first axis listing the selected user, a second axis listing the privileges, and for each intersection of selected user and privilege, a corresponding user privilege value determined from the subset of user privilege records. The system communicates the privilege matrix in response to the request.
1. A system, comprising:
an interface operable to:
receive a request for user privilege information for a user, identifying:
an object of a first database; and
a user identifier for the user;
one or more processors operable to:
determine a class of a second database that corresponds to the object in response to receiving the request for user privilege information for the user;
access a plurality of user privilege records, based on the user identifier, that the second database associates with the class, each user privilege record corresponding to the user;
determine a subset of the user privilege records that correspond to the user, each of the subset of user privilege records comprising:
one of a plurality of privileges; and
a user privilege value indicating whether the user is authorized for that privilege;
generate a privilege matrix using the subset of user privilege records, the privilege matrix comprising:
a first axis that lists the user;
a second axis that lists the plurality of privileges; and
for each intersection of the user and a privilege from the plurality of privileges, a corresponding user privilege value determined from the subset of user privilege records; and
the interface further operable to:
communicate the privilege matrix in response to the request.
2. The system of claim 1 , wherein the user privilege records are formatted according to a Resource Access Control Facility (“RACF®”) format and the privilege matrix is formatted according to a Database 2 (“DB2®”) format.
3. The system of claim 1 , wherein:
the one or more processors are further operable to associate the privilege matrix with a RACF rule used to determine the user privilege values; and
the interface is further operable to communicate the RACF rule with the privilege matrix.
4. The system of claim 1 , wherein:
the one or more processors are further operable to:
link the privilege matrix and the subset of user privilege records used to create the privilege matrix; and
the interface is further operable to:
receive a request for the subset of user privilege records linked to the privilege matrix; and
communicate the linked subset of user privilege records.
5. The system of claim 1 , wherein the plurality of privileges include one or more of: alter, create tab, create, delete, display, drop, image copy, index, insert, recover, reference, repair, select, trigger, and update.
6. The system of claim 1 , wherein the request further comprises an object type selected from the group consisting of a database, a table space, a table, a column, a plan, a package, a stored procedure (“storproc”), an administrator authentication (“admin auth”), a system privilege, and a buffer pool (“bpool”).
7. The system of claim 1 , wherein:
the interface receives the request from an automated process;
the one or more processors are further operable to store the privilege matrix;
the interface is further operable to receive a subsequent user request for the user privilege information; and
the one or more processors are further operable to retrieve the stored privilege matrix for communication to the user.
8. A method, comprising:
receiving a request for user privilege information for a user, identifying:
an object of a first database; and
a user identifier for the user;
determining a class of a second database that corresponds to the object in response to receiving the request for user privilege information for the user;
accessing, by one or more processors, a plurality of user privilege records, based on the user identifier, that the second database associates with the class, each user privilege record corresponding to the user;
determining a subset of the user privilege records that correspond to the user, each of the subset of user privilege records comprising:
one of a plurality of privileges; and
a user privilege value indicating whether the user is authorized for that privilege;
generating a privilege matrix using the subset of user privilege records, the privilege matrix comprising:
a first axis that lists the user;
a second axis that lists the plurality of privileges; and
for each intersection of the user and a privilege from the plurality of privileges, a corresponding user privilege value determined from the subset of user privilege records; and
communicating the privilege matrix in response to the request.
9. The method of claim 8 , wherein the user privilege records are formatted according to a Resource Access Control Facility (“RACF®”) format and the privilege matrix is formatted according to a Database 2 (“DB2®”) format.
10. The method of claim 8 , further comprising associating the privilege matrix with a RACF rule used to determine the user privilege values and communicating the RACF rule with the privilege matrix.
11. The method of claim 8 , further comprising:
linking the privilege matrix and the subset of user privilege records used to create the privilege matrix;
receiving a request for the subset of user privilege records linked to the privilege matrix; and
communicating the linked subset of user privilege records.
12. The method of claim 8 , wherein the plurality of privileges include one or more of: alter, create tab, create, delete, display, drop, image copy, index, insert, recover, reference, repair, select, trigger, and update.
13. The method of claim 8 , wherein the request further comprises an object type selected from the group consisting of a database, a table space, a table, a column, a plan, a package, a stored procedure (“storproc”), an administrator authentication (“admin auth”), a system privilege, and a buffer pool (“bpool”).
14. The method of claim 8 , wherein the method receives the request from an automated process, the method further comprising:
storing the privilege matrix;
receiving a subsequent user request for the user privilege information; and
retrieving the stored privilege matrix for communication to the user.
15. A non-transitory computer readable storage medium comprising logic, the logic, when executed by a processor, operable to:
receive a request for user privilege information for a user, identifying:
an object of a first database; and
a user identifier for the user;
determine a class of a second database that corresponds to the object in response to receiving the request for user privilege information for the user;
access a plurality of user privilege records, based on the user identifier, that the second database associates with the class, each user privilege record corresponding to the user;
determine a subset of the user privilege records that correspond the user, each of the subset of user privilege records comprising:
one of a plurality of privileges; and
a user privilege value indicating whether the user is authorized for that privilege;
generate a privilege matrix using the subset of user privilege records, the privilege matrix comprising:
a first axis that lists the user;
a second axis that lists the plurality of privileges; and
for each intersection of the user and a privilege from the plurality of privileges, a corresponding user privilege value determined from the subset of user privilege records; and
communicate the privilege matrix in response to the request.
16. The logic of claim 15 , wherein the user privilege records are formatted according to a RACF format and the privilege matrix is formatted according to a DB2 format.
17. The logic of claim 15 , further operable to associate the privilege matrix with a RACF rule used to determine the user privilege values and communicate the RACF rule with the privilege matrix.
18. The logic of claim 15 , further operable to:
link the privilege matrix and the subset of user privilege records used to create the privilege matrix;
receive a request for the subset of user privilege records linked to the privilege matrix; and
communicate the linked subset of user privilege records.
19. The logic of claim 15 , wherein the plurality of privileges include one or more of: alter, create tab, create, delete, display, drop, image copy, index, insert, recover, reference, repair, select, trigger, and update.
20. The logic of claim 15 , wherein the logic receives the request from an automated process, the logic further operable to:
store the privilege matrix;
receive a subsequent user request for the user privilege information; and
retrieve the stored privilege matrix for communication to the user.