RE: Record Level Security by User ID?

So what you are wondering is if you have this product
Resource
ID Option Feature Description
5770SS1 47 5119 IBM Advanced Data Security for i

Can you do this? Yes.
CREATE TABLE rob.brad (
MyChar char(10),
CreatedUser char(18)
not null
implicitly hidden
with default USER -- Size must be 18! SQL State: 42894
)
;
insert into rob.brad (mychar) values('hi');
select mychar, createduser from rob.brad;

-- User running CREATE PERMISSION has to be registered in QIBM_DB_SECADM
-- cl: CHGFCNUSG FCNID(QIBM_DB_SECADM) USER(ROB) USAGE(*ALLOWED);

create permission Brad_created_only
on rob.brad
FOR ROWS WHERE CREATEDUSER = CURRENT USER
ENFORCED FOR ALL ACCESS
ENABLE;

alter table rob.brad activate row access control;
-- sign on as DUMMY and run insert into rob/brad (mychar) values('you');
select * from rob.brad; -- only returns the row with 'hi' and only the column MYCHAR.

Of course, you cannot run DLTUSRPRF DUMMY until you change the rows. If you try you will get the misleading information: CPF2215
You may have to change the permission to DISABLE to do so.

Damn it, now I have another case to open!
I signed on as DUMMY and deleted the row he created.
DUMMY now owns no objects, even including his message queue.
I'm still getting the CPF2215.
I even tried
ALTER permission Brad_created_only
DISABLE;
alter table rob.brad DEactivate row access control;
COMMIT;



Rob Berendt