By assigning user IDs and passwords, the database administrator controls who has access to a database. By granting permissions to each user ID, the database administrator controls which tasks each user can perform when connected to the database.

Permission scheme is based on user IDs

When a user logs on to the database, they have access to all database objects that meet any of the following criteria:

• objects the user created
• objects to which the user has received explicit permission
• objects to which a group the user belongs to received explicit permission

The user cannot access any database object that does not meet these criteria. In short, users can access only the objects they own or objects to which they explicitly received access permissions.

For more information, see:

• Managing user IDs, authorities, and permissions
• CONNECT statement [ESQL] [Interactive SQL]
• GRANT statement
• REVOKE statement

Using integrated logins

Integrated logins allow users to use a single login name and password to log onto both your Windows operating system and onto a database. An external login name is associated with a database user ID. When you attempt an integrated login, you log onto the operating system by giving both a login name and password. The operating system then tells the server who you are, and the server logs you in as the associated database user ID. No additional login name or password are required.

When using integrated logins, leaving the user profile Guest enabled with a blank password can permit unrestricted access to a database that is hosted by the server that accepts integrated logins. Literally any user can log in to the server using any login ID and any password because they are logged in by default to the Guest user profile.

For more information, see:

• Security concerns: Unrestricted database access
• Using integrated logins
• login_mode option [database]