docs: add DB2 for i (AS/400) connection guidance - #145
Conversation
IBM i differs from LUW on every DSN component: port 446 (DDM/DRDA, not the 8471 IBM i Access host server), DATABASE is the RDB name rather than an application library, libraries map to schemas via CurrentSchema, and a customer-supplied Db2 Connect license is a hard prerequisite (SQL1598N without it).
Connector PR Review: docs: add DB2 for i (AS/400) connection guidanceBlocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0 Review SummaryThe full PR diff was scanned for security and correctness. The new commit normalizes nullable columns in the DB2 for i example query with COALESCE(TEXT_DESCRIPTION, '') and COALESCE(VARCHAR(PREVIOUS_SIGNON), '') so CEL only ever sees strings and avoids "no such overload" failures on NULL/timestamp values. Verified this is safe downstream: an empty last_login string is skipped in pkg/bsql/resources.go:161, and unparseable values only warn. No new issues found; the ?<...|unquoted> provisioning in examples/db2-test.yml is the documented, value-sanitized baton-sql DDL pattern. Security IssuesNone found. Correctness IssuesNone found. SuggestionsNone. |
LUW example syncs authorization IDs and roles from SYSCAT with grant/revoke provisioning; IBM i example syncs user profiles and group profile membership from QSYS2, sync-only since profile changes go through CL commands rather than SQL. Both parse-tested alongside the existing examples.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| # GRANT is DDL — parameter binding is not allowed, so identifiers are | ||
| # inlined with ?<...|unquoted> (values are sanitized, never escaped). | ||
| - | | ||
| GRANT ROLE ?<role_name|unquoted> TO USER ?<principal_name|unquoted> |
There was a problem hiding this comment.
🟡 Suggestion: Consider ?<role_name|identifier> / ?<principal_name|identifier> here (and in the revoke/admin queries) instead of unquoted. This connector's own token docs recommend identifier for GRANT/DDL, and the reference redshift-test.yml uses it. unquoted strips every char outside [a-zA-Z0-9_], so a DB2 authorization ID containing a legal special char (e.g. #, $, @) would be silently rewritten and the grant applied to the wrong identifier. Both options are injection-safe; identifier just avoids the silent corruption. (Confidence: medium)
CEL string operations on NULL or timestamp values fail with "no such overload"; COALESCE in the query keeps the mapped values string-typed.
1 participant
Description
Documentation follow-up to #140, prompted by a real DB2 for i (AS/400) deployment attempt where connection details copied from an IBM i Access / jt400 setup failed in non-obvious ways.
Adds a "DB2 for i (AS/400)" section to
docs/db2.mdcovering what differs from LUW:SQL1598Nwithout it) — the go/no-go check to run before anything elseSQL30081N)DATABASEmust be the RDB name fromWRKRDBDIRE, not an application library?CurrentSchema=or schema-qualified queries; noDBQlibrary listsUseful links: