1.0

SQLFire Member JVM Owner
The term JVM owner refers to the authorization identifier of the user who booted the SQLFire member JVM. If
you enable or plan to enable SQL authorization, controlling the identity of the JVM owner becomes important.
If a member is started without supplying a user (only possible if authentication is not enabled), the JVM owner
is set to the default authorization identifier, "APP", which is also the name of the default schema.
The JVM owner has automatic SQL level permissions when SQL authorization is enabled. See Configuring
User Authorization on page 238 for more information.
Attention: The JVM owner cannot be changed after the SQLFire member starts. Instead, you must stop
the member and then restart it using different user credentials. If you plan to run with SQL authorization
enabled, start new SQLFire members as the user that you want to be the JVM owner.
Configuring User Authorization
When you specify user authorizations, SQLFire verifies that a user has been granted permission to access a
schema, database object, or a SQL action.
• Connection Authorization and SQL Standard Authorization on page 238
• User Authorization Properties on page 238
• How User Authorization Properties Work Together on page 239
• Changing Connection Authorization Settings on page 239
Connection Authorization and SQL Standard Authorization
There are two types of user authorization in SQLFire: connection authorization and SQL standard
authorization. Connection authorization specifies the basic access that users have when they connect to the
distributed system. SQL authorization controls the permissions that users have on database objects or for SQL
actions. You set the user authorization properties in SQLFire as system-level properties, either at the command
line or connection string when booting SQLFire members, or in the sqlfire.properties file.
User Authorization Properties
You can set properties to control user authorizations for SQLFire. Some properties set the default access mode
for all users. Other properties set the default level of access for specific user IDs.
The properties that affect authorization are:
•
sqlfire.authz-default-connection-mode—Controls the default access mode. Use
sqlfire.authz-default-connection-mode to specify the default connection access that users have
when they connect to a SQLFIre member. If you do not explicitly set the
sqlfire.authz-default-connection-mode property, the default user authorization for a database
is fullAccess, which is read-write access.
•
sqlfire.authz-full-access-users and sqlfire.authz-read-only-access-users
—These properties specify one or more user IDs that have read-write access and read-only access to the
distributed system as a whole.
•
sqlfire.sql-authorization —Enables SQL standard authorization. Use
sqlfire.sql-authorization to control whether object owners can grant and revoke permission for
other users to perform SQL actions on their database objects. The default setting for
sqlfire.sql-authorization is FALSE. When sqlfire.sql-authorization is set to TRUE,
object owners can use the GRANT and REVOKE SQL statements to set the user permissions for specific
database objects or for specific SQL actions.
vFabric SQLFire User's Guide238
Deploying vFabric SQLFire