DB2 10.5 for Linux, UNIX, and Windows

User authentication and group information with DB2 on Windows

User name and group name restrictions (Windows)
There are a few limitations that are specific to the Windows environment. Be aware that general DB2® object naming rules also apply.
Groups and user authentication on Windows
Users are defined on Windows by creating user accounts using the Windows administration tool called the "User Manager". An account containing other accounts, also called members, is a group.
Trust relationships between domains on Windows
Trust relationships are an administration and communication link between two domains. A trust relationship between two domains enables user accounts and global groups to be used in a domain other than the domain where the accounts are defined.
Authentication with groups and domain security (Windows)
The DB2 database system allows you to specify either a local group or a global group when granting privileges or defining authority levels.
Using an access token to acquire users' group information (Windows)
An access token is an object that describes the security context of a process or thread. The information in an access token includes the identity and privileges of the user account associated with the process or thread.
The DB2_GRP_LOOKUP environment variable and DB2 group enumeration (Windows)
On Windows, a user can belong to groups defined at the domain level, groups defined on the local machine, or to both.
Authentication using an ordered domain list
User IDs may be defined more than once in a trusted domain forest. A trusted domain forest is a collection of domains that are interrelated through a network.
Domain security support (Windows)
The following example illustrates how the DB2 database management system can support Windows domain security. The connection works because the user name and local group are on the same domain.