MainframeKit

-552

SQLSTATE 42502NEGATIVE SQLCODE

The authorization ID lacks the privilege for an operation such as CREATE TABLE or BINDADD. Unlike -551, it is about an operation, not access to one object.

MOST LIKELY

The job or user runs under an ID that was never granted the system or database privilege needed (for example CREATETAB, BINDADD, CREATEIN).

FIRST CHECK

Read the authorization ID and operation in the message.

TRY IT ▸

MainframeKit assistant

What it means

The message names the authorization ID (or the role, inside a trusted context) and the operation it tried, for example CREATE TABLE or BINDADD. Db2 does not run the statement and returns -552 with SQLSTATE 42502.

If RACF controls Db2 access, the ID in the -552 message can differ from the user ID that RACF shows in its ICH408I message. Revoking some system authorities (System DBADM, DATAACCESS, ACCESSCTRL, CREATE_SECURE_OBJECT) needs SECADM.

Typical causes

  • The job or user runs under an ID that was never granted the system or database privilege needed (for example CREATETAB, BINDADD, CREATEIN).
  • A bind runs with a different OWNER than expected, and that owner lacks the privilege.
  • SET CURRENT SQLID switched to an ID without the authority.
  • A role in a trusted context does not hold the privilege.
  • A revoke of a high-level authority attempted without SECADM.

How to fix it

  1. Read the authorization ID and operation in the message.
  2. Check which ID the job actually used: job USER, bind OWNER, CURRENT SQLID or role.
  3. Look up that ID's grants in the catalog (SYSIBM.SYSUSERAUTH, SYSDBAUTH, SYSSCHEMAAUTH).
  4. Ask the security administrator or DBA to grant the needed privilege, or rerun under the correct ID.
  5. If RACF is in use, compare the ID with any ICH408I messages in the job log.