Hello,

Environment:
Server side: DB2 v. 8.2 on AIX 5.3.
Client side: AIX 5.3 LPARs, on a different physical server.

I have some SAS batch jobs which need to connect to a DB2 server. The
batch jobs and the database server are on different physical servers, due
to licensing issues.

How do I authorize the batch job users in a safe way? One way is to
specify the password in the SAS code, but that is very difficult to
manage, as several different people are collaborating about the code. In
the SAS code, the database password may be specified as a SAS macro which
grabs the password from an external file; however, the SAS logs may
display such macro values in some cases. In other words, it's not very
robust to have database passwords in plain text, neither in the code, nor
in separate files.

I've read about DB2's CLIENT authorization setting. But: How hard can it
be to spoof? And it looks like this is an all-or-nothing setting: Either
the DB2 server trusts all clients, or it doesn't. I.e., there doesn't
seem to be a way to make DB2 trust selected hosts only (and require
normal password access for other hosts)(?).

I'm currently considering kerberos authorization: The batch jobs would
initially use a command like Linux's "kinit" to initialize an
authorization environment, probably based on passwords in plain text
files separate from any SAS code. Afterwards, the batch job would call
the relevant SAS scripts. However, setting up Kerberos seems very
difficult with DB2 (has anyone actually done it?), and I fear that SAS'
DB2 driver is able to make use of Kerberos(?).

Does anyone have suggestions on how to solve this?