1.1.1

• Within the SQLFire user authorization system, Fred becomes a case-sensitive authorization identifier. Fred is
known as Fred!.
• When specifying which users are authorized to access the accounting database, you must list Fred's authorization
identifier, "Fred!" (which you must always delimit with double quotation marks).
sqlfire.authz-full-access-users=sa,"Fred!",manager
As shown in the first example, your external authentication system may be case-sensitive, whereas the authorization
identifier within SQLFire may not be. If your authentication system allows two distinct users whose names differ
by case, delimit all user names within the connection request to make all user names case-sensitive within the
SQLFire system. In addition, you must also delimit user names that do not conform to SQL92Identifier rules
with double quotes.
SQLFire Member JVM Owner
The term JVM owner refers to the authorization identifier of the user who booted the SQLFire member JVM. If
you enable or plan to enable SQL authorization, controlling the identity of the JVM owner becomes important.
If a member is started without supplying a user (only possible if authentication is not enabled), the JVM owner
is set to the default authorization identifier, "APP", which is also the name of the default schema.
The JVM owner has automatic SQL level permissions when SQL authorization is enabled. See Configuring
User Authorization on page 250 for more information.
Attention: The JVM owner cannot be changed after the SQLFire member starts. Instead, you must stop
the member and then restart it using different user credentials. If you plan to run with SQL authorization
enabled, start new SQLFire members as the user that you want to be the JVM owner.
Configuring User Authorization
When you specify user authorizations, SQLFire verifies that a user has been granted permission to access a
schema, database object, or a SQL action.
• Connection Authorization and SQL Standard Authorization on page 250
• User Authorization Properties on page 250
• How User Authorization Properties Work Together on page 251
• Changing Connection Authorization Settings on page 251
Connection Authorization and SQL Standard Authorization
There are two types of user authorization in SQLFire: connection authorization and SQL standard
authorization. Connection authorization specifies the basic access that users have when they connect to the
distributed system. SQL authorization controls the permissions that users have on database objects or for SQL
actions. You set the user authorization properties in SQLFire as system-level properties, either at the command
line or connection string when booting SQLFire members, or in the sqlfire.properties file.
User Authorization Properties
You can set properties to control user authorizations for SQLFire. Some properties set the default access mode
for all users. Other properties set the default level of access for specific user IDs.
The properties that affect authorization are:
•
sqlfire.authz-default-connection-mode—Controls the default access mode. Use
sqlfire.authz-default-connection-mode to specify the default connection access that users have
when they connect to a SQLFire member. If you do not explicitly set the
vFabric SQLFire User's Guide250
Deploying vFabric SQLFire