Skip to main content

Set up IBM Db2 for LUW

TL;DR

Create a least-privilege Db2 for LUW user and grant the catalog access Atlan needs to crawl metadata.

Connect
Who can do this?

You probably need your Db2 administrator to run these commands - you may not have access yourself.

Atlan supports basic username and password authentication for fetching metadata from IBM Db2 for Linux, UNIX, and Windows (LUW). Atlan only runs read-only SELECT queries against the database system catalog - it never reads or modifies the data in your tables.

Prerequisites​

Before you begin, make sure you have:

  • Db2 for LUW 11.5 or later.
  • Administrator access to grant privileges on each database you want to crawl.
  • Network access from Atlan to the Db2 listener port, which is 50000 by default. Encrypted connections typically use port 50001.
  • The name and port of every database you want to crawl. A Db2 for LUW connection reaches exactly one database, so the crawler opens one connection per database and port pair.

Create operating system user​

Db2 for LUW authenticates against the host operating system or your directory service rather than against an identity stored in the database. Ask your administrator to create a dedicated account for Atlan on the database server, or in the directory service the instance authenticates against:

useradd -m atlanuser
passwd atlanuser
  • Use a strong password for the account. Atlan uses this username and password to connect.

Grant database privileges​

For each database you want to crawl, connect to it and grant the Atlan user permission to connect:

CONNECT TO <database>;
GRANT CONNECT ON DATABASE TO USER ATLANUSER;
  • Replace <database> with the name of each database you want to crawl. Databases where the user has no CONNECT privilege can't be crawled.

Verify catalog access​

Atlan reads schema, table, view, column, and routine metadata from the database system catalog with SELECT queries. Db2 for LUW grants SELECT on the catalog to PUBLIC by default, so no extra grants are usually needed.

If your security configuration revokes those defaults, grant SELECT explicitly:

GRANT SELECT ON SYSCAT.SCHEMATA TO USER ATLANUSER;
GRANT SELECT ON SYSCAT.TABLES   TO USER ATLANUSER;
GRANT SELECT ON SYSCAT.COLUMNS  TO USER ATLANUSER;
GRANT SELECT ON SYSCAT.VIEWS    TO USER ATLANUSER;
GRANT SELECT ON SYSCAT.ROUTINES TO USER ATLANUSER;

Preflight also reads the instance service level, which comes from an administrative view. If your configuration restricts it, grant access to the view and to the routine behind it:

GRANT SELECT ON SYSIBMADM.ENV_INST_INFO           TO USER ATLANUSER;
GRANT EXECUTE ON FUNCTION SYSPROC.ENV_GET_INST_INFO TO USER ATLANUSER;

If a grant is missing, the crawl fails with SQLCODE -551 naming the object the user can't read.

Prepare SSL truststore​

If your Db2 server requires SSL/TLS connections, you can either upload the server or certificate authority (CA) certificate directly as an .arm or .pem file, or prepare a JKS or PKCS12 truststore that contains the CA certificate that signed your server's certificate:

keytool -import -alias db2luw -file <ca-certificate>.arm -keystore truststore.p12 -storetype PKCS12
  • Replace <ca-certificate> with the path to your CA certificate file.

You provide the certificate or the truststore when configuring the crawler.

Next steps​

Crawl IBM Db2 for LUW assets: Configure and run the crawler to extract metadata from Db2 for LUW