How can one synchronize Db2 catalog to ACF2 DB2 infostorage.

Products

• ACF2 - DB2 Option

Issue/Introduction

How to Load ACF2 for Db2 with catalog information to ACF2 in bulk.

 

Environment

ACF2 for Z/os

Resolution

To bulk load ACF2™ Option for Db2 with information from the native Db2 catalog, use the Conversion Utility. 

This utility is designed to simplify rule writing by converting existing SQL GRANT entries in the Db2 catalog into ACF2 rule sets.
Run the Conversion Utility.

Conversion Workflow
------------------------------

    1. Run the Conversion Utility Job: 

       The utility extracts GRANT information and generates rule source.

    2. Evaluate Rule Sets: Review the generated rules for applicability and to identify potential vulnerabilities in the current environment.

    3. Modify Rules: Add parameters that native Db2 security cannot provide   (e.g., time-of-day restrictions or expiration dates).

    4 Compile and Store: Use the standard ACF2 rule compiler to store the new rule sets in the Infostorage database.

Critical Prerequisites and Warnings
--------------------------------------------------
Before running the utility, ensure the following conditions are met to avoid invalid or incomplete rule generation:

    Logonid Creation: You must create logonids for every entry in a secondary ID’s source group 
     before running the utility. If logonids do not exist, the utility will create "commented" 
     rule entries (preceded by a *), which are not active until manually modified 

    Authority Requirements:
        - Db2 Authority: You must have EXECUTE authority for the conversion utility application plan, 
          typically named CADB2Cnn (where nn is the Db2 release level).
        - ACF2 Authority: You must have SECURITY, ACCOUNT, or AUDIT privileges to access the Logonid database.

    Secondary ID Support: The utility supports E-SGP and X-SGP source group records, including 
     nested records. However, masking of primary IDs is not supported; do not use the EXPAND 
     parameter if your X-SGP records contain masked primary IDs 

    Clean-up: Delete logonids for any secondary IDs that will no longer be used. 
     This prevents the utility from creating rules for IDs you intend to decommission.

 Note on the Catalog Synchronization Utility

Do not confuse the Conversion Utility with the Catalog Synchronization Utility.

    -Conversion Utility: Moves data from the Db2 catalog to ACF2 (initial/bulk load).
    -Catalog Synchronization Utility: Synchronizes the Db2 catalog to reflect ACF2 rules (ongoing maintenance