Defining Clear Authorizations for Users 

To ensure that users have only the authorizations that they need for their work, we recommend the following measures:

●     Create an authorization concept that specifies clear authorizations for individual users:

○     Define which database users are to have access to which data.

○     Define which Database Manager operators are to carry out which administration tasks.

●     Create a separate database user for each person who works with the database instance. In doing this, use the user classes STANDARD and RESOURCE where possible.

●     Distribute the administration tasks. In addition to defining the database system administrator, define database users of the user class DBA and Database Manager operators.

●     Assign Database Manager operators only those server authorizations that they really need.

In some cases it can make sense to create a Database Manager operator that can check the operational state of the database instance but cannot perform any administration tasks.

Creating Database Users and Defining User Classes

On Microsoft Windows, use the database tool Database Manager GUI:

Database Manager GUI, Creating/Changing/Deleting a Database User

In other operating systems, use the database tool SQLCLI and the corresponding SQL statements for the authorization of users:

SQLCLI, Executing an SQL Statement

SQL Reference Manual, Authorization

Creating Database Manager Operators and Adjusting Server Authorizations

To create Database Manager operators, use the database tool Database Manager:

Database Manager GUI, Creating/Changing/Deleting a Database Manager Operator

Database Manager CLI, user_create

To adjust the server authorizations of Database Manager operators, use the database tool Database Manager:

Database Manager GUI: Changing the Server Authorizations

Database Manager CLI: user put