This example shows how to use a Column Mask to prevent users from seeing the actual birthdate.

Mask birthdays with RCAC

--
-- RCAC Book: www.redbooks.ibm.com/redpieces/abstracts/redp5110.html
--

--
-- Who is allowed to deploy COLUMN MASKs and ROW PERMISSIONs
--
cl:CHGFCNUSG FCNID(QIBM_DB_SECADM) USER(SCOTTF) USAGE(*ALLOWED); 

call qsys.create_sql_sample('COFFEEBEAN');

select birthdate, e.* from COFFEEBEAN.employee e;

-- 
-- Always return Scott's birthday, unless the user belongs to the HRTEAM group profile
-- 
CREATE OR REPLACE MASK COFFEEBEAN.Fight_Ageism ON COFFEEBEAN.employee FOR COLUMN birthdate
RETURN CASE                                                         
WHEN VERIFY_GROUP_FOR_USER(SESSION_USER,'HRTEAM') = 1 THEN birthdate   
ELSE DATE('1965-09-04')                                                    
END                                                                 
ENABLE;

--
-- Turn on the column mask
--
alter table COFFEEBEAN.employee activate column access control;