zSecure - Correlation of Db2 Authorization Flows in zSecure Access Monitor

Background
We recently migrated from Db2 internal authorization to RACF-based Db2 security using RACF profiles. While the functional behavior is correct, we have identified a significant limitation in audit transparency when analyzing Db2 authorization flows using zSecure Access Monitor.

In Db2 authorization processing, multiple RACF checks can occur within a single logical access attempt. For example:

• Access attempt to DBD0.IDAA_MGMT.SELECT → RACF RC=8 (denied)
• Fallback check to DBD0.SYSADM → RACF RC=0 (granted via administrative authority)

Both checks are visible in Access Monitor; however, they are recorded as independent events with no correlation.

This results in:

• Apparent denial of access to a protected resource
• No transparent indication that access was subsequently granted via administrative privilege
• Lack of traceability for effective data access, especially for privileged users

Clarification from Db2 Development
Db2 development has confirmed that correlation-relevant context is already available and propagated via the RACROUTE interface:

• The Db2 RACF exit populates LOGSTR_DATA in RACROUTE REQUEST=FASTAUTH
• LOGSTR_TIME (STCK value) and additional fields (object type, name, schema, etc.) are consistent across all authorization checks within the same logical access flow
• This information is intended specifically to support correlation of authorization decisions

Enhancement Request
We request that zSecure Access Monitor be enhanced to:

1. Capture and expose LOGSTR_DATA fields from RACROUTE calls issued by Db2 (especially LOGSTR_TIME)
2. Introduce a correlation mechanism that groups RACF events belonging to the same Db2 authorization flow, based on LOGSTR_DATA
3. Provide reporting capabilities that:
   • Link denied and granted checks within the same flow
   • Clearly indicate the effective access decision
   • Highlight when access is granted via administrative authorities (e.g., SYSADM)
4. Ensure that this correlation is available in:
   • Access Monitor recorded event data
   • zSecure reporting (CARLa / UI)

Business Value

• Accurate and complete audit trail of Db2 access decisions
• Visibility of privileged data access
• Closure of audit gaps in regulated environments
• Improved compliance and forensic analysis capabilities