Integrating SailPoint with IBM DB2

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of an IBM DB2 connector.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

Note

Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site. For more information on opening a support ticket, refer to Working With Services.

The IBM DB2 connector supports the following features:

Load and *provision IBM DB2 Accounts
*Access Certifications (certification of entitlements connected to accounts)
Delete account

For more information on features, refer to Source Features.

Permissions Management

Permissions directly assigned to accounts and groups as direct permissions during account and entitlement aggregation. To aggregate permissions, edit the Account Schema and select the option to Include permissions in aggregations.

For more information, refer to Managing Source Account Schemas.
Revocation of the aggregated permissions for an account through certification.

To enable direct permissions and their aggregation, for the account or the group schema of your connector, complete the following steps:

Use the listSources API to get source ID.
Use the listSchemas API to get schema ID for the account or group schema for which you want to enable direct permissions.
Use the updateSchema API and enter the following content in body, with the sourceID and the schemaID in the header:
```
[{
"op": "replace",
"path": "/includePermissions",
"value": true
}]
```

Supported Managed Systems

The SailPoint IBM DB2 connector supports the following versions of DB2 Server on Linux and Windows:

IBM DB2 Enterprise Server version 11.5
IBM DB2 Enterprise Server version 11.1
IBM DB2 Enterprise Server version 10.5

Prerequisites

Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
The custom DB2 jar file db2jcc.jar has been obtained from IBM DB2 JDBC Driver Versions - United States.

Best Practice

Because each version of DB2 might require a different .jar file, you must select a unique virtual appliance cluster for each version of DB2 in your environment.

Required Permissions

Configure system accounts with the permissions required to support connector operations.

Permissions Management

Permissions are assigned to accounts and groups as Direct Permissions during account and entitlement aggregation. The connector supports the following permissions:

table
database
schema, index
view
package
method
tablespace
function
procedure

Procedure to Create Service User

Based on the operating system, perform the respective procedures in the section.

For Windows Operating Systems

Create a Windows user and set up a password for this user.
Assign the DB2USERS Group to the above created user.

For Linux Operating Systems

Add the user to the Linux system and add it to the instance owner group. The default DB2 users group is db2iadm1

useradd -G <Instance_owner_group> <SERVICE_USER>
Set the password using the following command:

passwd <SERVICE_USER>
Connect to the machine using the db2inst1 or the DB2 administrator user.

IBM DB2 Enterprise Server Permissions

For IBM DB2 Enterprise Server version 10.1 and 10.5:

The Administrator login must have the SYSADM (Authority) as the minimum privilege and must be able to perform the following operations on DB User and Roles:

Search
Create
Update
Delete

Note

To run the CREATE ROLE rolename and DROP ROLE rolename query in the following DB2 versions, the respective specified authorities are required: 10.1 and 10.5: SECADM, SYSCTRL, or SECADM authority

For IBM DB2 Enterprise Server version 11.1:

Connect to the database with administrator user using command:

db2 connect to <DATABASE>
Grant the following Privileges:

GRANT DBADM ON DATABASE TO USER <SERVICE_USER>; GRANT SECADM ON DATABASE TO USER <SERVICE_USER>; GRANT ACCESSCTRL ON DATABASE TO USER <SERVICE_USER>; GRANT DATAACCESS ON DATABASE TO USER <SERVICE_USER>;
Grant the following Roles:

GRANT SYSTS_ADM to <SERVICE_USER>;
Create the source using the Service User as the user and specify the database.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.