Anyone configured/using a Db2z Type-2 connection for the MetadataStore

[dennis-behm]

Dear community,

does anyone have configured the JDBC connection to be a Type-2 connection instead of Type-4 via JDBC and could share what they have done?

The MetadataStoreFactory is requiring a UserID and Password - have you just provided some dummy credentials?

Thanks in advance.

@friedhelmmuench, haven't you configured a Type-2?

[friedhelmmuench]

Hi Dennis,

yes, we configured a Type-2 connection in the following way:

• definition of url=jdbc.db2:<db2-database> and ssid=<subsystem-id> in db2Connection.properties
• expanded CLASSPATH for running DBB with db2jcc4.jar, db2jcc_license_cisuz.jar and the path where db2Connection.conf is stored
• expanded environment-variable STEPLIB with the local installation datasets for SDSNEXIT, SDSNLOAD and SDSNLOD2
• expanded environment-variable LIBPATH with the path to the local installation of Db2 JDBC libs

In this way the dbb-zappbuild-scripts are working.

For using the command line tool to manage the metadata store with a type 2 connection we use the same db2Connection.properties set by parameter --db2-config and set --user and --password as empty string.

I hope i didn't forget anything....

[EdwardMcCarthy]

this dbb cli worked, to pass null string for --user and --password, use '' which is two single quotes

but how to use no user id and password on the zappbuild cmd when running build.groovy

[EdwardMcCarthy]

this was cmd

/usr/lpp/IBM/dbbv2/bin/dbb build-result view build.20230703.220707.007 --build-group cicsivp-main --type db2 --user '' --password '' --url jdbc:db2:DB2Z

[friedhelmmuench]

Hi Edward,
we configure the property metadataStoreDb2ConnectionConf in build-conf/build.properties with the path to a db2Connection.properties-file which contains the necessary connection informations. A sample can be found at $DBB_CONF/db2Connection.conf.
If the configuration file is set, no user and password property will be used and there is no need to configure it at command line.

[dennis-behm]

Hi Friedhelm,

thanks for sharing your configuration! Very much appreciated! This is excellent!

With the correct db2 configuration file for the TYPE-2 connection, it is NOT required to pass a userid and password via CLI options. I assume the implementation will pass in a null value to the implementation in that case, because of the current implementation:

dbb-zappbuild/build.groovy

Lines 120 to 149 in 85e0df0

	String id
	if (opts.id)
	id = opts.id
	//Get password file or encrypted password from command line
	String password
	File passwordFile
	if (opts.pf)
	passwordFile = new File(opts.pf)
	else if (opts.pw)
	password = opts.pw
	if (props.metadataStoreDb2ConnectionConf) { // Db2 Configuration properties file
	// Check if the configuration properties file exists
	File propertiesFile = new File(props.metadataStoreDb2ConnectionConf)
	if (!propertiesFile.exists()) {
	println("Db2 Connection Configuration property file does not exist: ${propertiesFile.getAbsolutePath()}\nPlease verify that the provided path is correct")
	System.exit(1)
	}
	// Load properties file into Properties object
	Properties db2ConnectionProps = new Properties()
	db2ConnectionProps.load(new FileInputStream(propertiesFile))
	// Call correct Db2 MetadataStore constructor
	if (passwordFile)
	metadataStore = MetadataStoreFactory.createDb2MetadataStore(id, passwordFile, db2ConnectionProps)
	else
	metadataStore = MetadataStoreFactory.createDb2MetadataStore(id, password as String, db2ConnectionProps)
	}

[EdwardMcCarthy]

ok thanks for that clarification

I already had set metadataStoreDb2ConnectionConf to point to a db2Connection.properties

But I was still trying to pass uid and pwd with some sort of null value, but really you just don't need to use them at all as shown in this cmd I used:

/usr/lpp/IBM/dbbv2/bin/groovyz /global/zDevOps/dbbv2/dbb-zappbuild/build.groovy --workspace /global/zDevOps/dbb/dbbDemo --application cicsivp --outDir /global/zDevOps/dbb/dbbDemoWork/out --hlq DBB.CICSIVP --fullBuild

The above cmd worked for me, did type 2 JDBC connection to Db2 on zOS all ok

All that is required in db2Connection.properties file are these two parms:

Db2 server location. Local or remote URL, your DB2 sybsystem id

url=jdbc:db2:DBID

DBB Db2 Schema. Default is DBBZ.

currentSchema=DBBZ

Then you get JDBC type 2 connection ( memory to memory ) from address space Dbb cmd is running in to Db2 on same zOS LPAR, and no need to pass a password, which means no need to store a pwd anywhere, whereas if you were storing a pwd somewhere you would need to explain to auditors how you are keeping that pwd secure etc

This link explains how the uid of the address space flows to Db2 on zOS when do JDBC type 2 without supplying uid/pwd:

https://www.ibm.com/docs/en/db2-for-zos/13?topic=sudsdjs-user-id-password-security-under-data-server-driver-jdbc-sqlj

as it says

IBM Data Server Driver for JDBC and SQLJ type 2 connectivity with no user ID or password: For IBM Data Server Driver for JDBC and SQLJ type 2 connectivity, if you use user ID and password security, but you do not specify a user ID and password, the database system uses the external security environment, such as the RACF® security environment, that was previously established for the user.

Thanks

[Crosswind]

Simply out of curiosity, what is the benefit of using a type-2 connection? Can you use PassTickets with that and thus avoid providing any credentials and authentication will be done by the task-owning user ID automatically?

[friedhelmmuench]

There is no need for passtickets or any type of credentials with a type-2-connection. Authentication is only done by the task-owning user ID. Another advantage is the direct communication with the Db2 subsystem and therefore a better performance. See https://www.ibm.com/support/pages/50-db2-nuggets-32-resource-info-comparing-jdbc-type-4-and-type-2-connections for a short explanation.