SQLCODE -567: Bind authorization error

What it means

Binding a package needs privileges, and Db2 for z/OS checks them against the package owner. The OWNER bind option sets the owner, and it defaults to the ID that runs the bind. If the owner lacks what the bind needs, Db2 rejects it with -567 and the package isn't bound, rebound or freed.

The message has four tokens. The bind type is BIND, REBIND or FREE. The auth ID is the package owner, or a role in a trusted context. The package is shown as location.collection.package.version. The privilege token says what was missing.

• BINDADD is the system privilege to create a new package with BIND ACTION(ADD).
• BIND is the package privilege needed to replace or rebind an existing package.
• COPY is the package privilege needed to bind with the COPY option from another package.
• CREATE IN is the privilege to create packages in a collection.

On Db2 for LUW and Db2 for i, SQLCODE -567 means something different. There it reports an authorization name that isn't valid or allowed, with SQLSTATE 42602.

Common causes

• A new program is bound into a collection for the first time, and the owner has neither BINDADD nor CREATE IN on that collection.
• OWNER names an ID or group that doesn't hold the privileges, often a production owner used from a test job.
• Someone rebinds or replaces a package and the owner's BIND privilege on it was revoked or never granted.
• A BIND COPY copies from a package the owner has no COPY privilege on.
• A client binds packages remotely over DRDA, for example driver packages from a distributed application, with an ID that has no bind authority on z/OS.

How to find the problem

1. Read the privilege and package tokens. They tell you exactly what's missing and where.
2. Check BINDADD with SELECT GRANTEE, BINDADDAUTH FROM SYSIBM.SYSUSERAUTH WHERE GRANTEE = 'PAYOWNR'.
3. Check CREATE IN on the collection in SYSIBM.SYSRESAUTH, and BIND or COPY on the package in SYSIBM.SYSPACKAUTH (columns BINDAUTH and COPYAUTH).
4. Confirm which ID was the owner. Look for OWNER in the bind statement, and remember an existing package keeps its owner on REBIND unless you change it.
5. If the owner is a RACF group, check that the binding user is connected to it.

How to fix it

• Grant what the message names, for example GRANT BINDADD TO PAYOWNR, GRANT CREATE IN COLLECTION PAYCOLL TO PAYOWNR or GRANT BIND ON PACKAGE PAYCOLL.PAYCALC TO PAYOWNR.
• Set OWNER to an ID or group that holds the bind privileges for that collection.
• For client driver packages, have a DBA with the right authority bind them once.
• Ask the DBA how the BIND NEW PACKAGE subsystem setting is configured. It controls whether BIND privilege on a package is enough to add new versions of it, or whether BINDADD is also needed.

Technical reviewer: Albert Joseph, WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s Db2 for z/OS documentation for your release.