Source:
<code>protected boolean hasPermissionOnSchema(LanguageConnectionContext lcc, DataDictionary dd, Activation activation, boolean forGrant) throws StandardException { String currentUserId = lcc.getCurrentUserId(activation); ExecPreparedStatement ps = activation.getPreparedStatement(); int authorization = oneAuthHasPermissionOnSchema(dd, Authorizer.PUBLIC_AUTHORIZATION_ID, forGrant); if(authorization == NONE || authorization == UNAUTHORIZED ) authorization = oneAuthHasPermissionOnSchema(dd, currentUserId, forGrant); if (authorization == NONE) { List<String> currentRoles = lcc.getCurrentRoles(activation); List<String> rolesToRemove = new ArrayList<>(); for (String role : currentRoles) { String dbo = dd.getAuthorizationDatabaseOwner(); RoleGrantDescriptor rd = dd.getRoleGrantDescriptor (role, currentUserId, dbo); if (rd == null) { rd = dd.getRoleGrantDescriptor( role, Authorizer.PUBLIC_AUTHORIZATION_ID, dbo); } <START> if (rd == null && lcc.getCurrentGroupUser(activation) != null) { <END> rd = dd.getRoleGrantDescriptor (role, lcc.getCurrentGroupUser(activation), dbo); } if (rd == null) { rolesToRemove.add(role); } else { RoleClosureIterator rci = dd.createRoleClosureIterator (activation.getTransactionController(), role, true ); String r; while ((authorization != AUTHORIZED) && (r = rci.next()) != null) { authorization = oneAuthHasPermissionOnSchema (dd, r, forGrant); } if (authorization == AUTHORIZED) { DependencyManager dm = dd.getDependencyManager(); RoleGrantDescriptor rgd = dd.getRoleDefinitionDescriptor(role); ContextManager cm = lcc.getContextManager(); dm.addDependency(ps, rgd, cm); dm.addDependency(activation, rgd, cm); break; } } } lcc.removeRoles(activation, rolesToRemove); } return authorization == AUTHORIZED; }</code><technical_language>Similar StatementTablePermission.java, need add check role permissions: If NONE, if currentGroupUser != NULL, currentGroupUser schema level permission for schema this database object belongs to</technical_language>

Target:
protected boolean hasPermissionOnSchema(LanguageConnectionContext lcc, DataDictionary dd, Activation activation, boolean forGrant) throws StandardException { String currentUserId = lcc.getCurrentUserId(activation); ExecPreparedStatement ps = activation.getPreparedStatement(); String currentGroupuser = lcc.getCurrentGroupUser(activation); int authorization = oneAuthHasPermissionOnSchema(dd, Authorizer.PUBLIC_AUTHORIZATION_ID, forGrant); if(authorization == NONE || authorization == UNAUTHORIZED ) authorization = oneAuthHasPermissionOnSchema(dd, currentUserId, forGrant); if((authorization == NONE || authorization == UNAUTHORIZED) && currentGroupuser != null ) { authorization = oneAuthHasPermissionOnSchema(dd, currentGroupuser, forGrant); } if (authorization == NONE) { List<String> currentRoles = lcc.getCurrentRoles(activation); List<String> rolesToRemove = new ArrayList<>(); for (String role : currentRoles) { String dbo = dd.getAuthorizationDatabaseOwner(); RoleGrantDescriptor rd = dd.getRoleGrantDescriptor (role, currentUserId, dbo); if (rd == null) { rd = dd.getRoleGrantDescriptor( role, Authorizer.PUBLIC_AUTHORIZATION_ID, dbo); } if (rd == null && currentGroupuser != null) { rd = dd.getRoleGrantDescriptor(role, currentGroupuser, dbo); } if (rd == null) { rolesToRemove.add(role); } else { RoleClosureIterator rci = dd.createRoleClosureIterator (activation.getTransactionController(), role, true ); String r; while ((authorization != AUTHORIZED) && (r = rci.next()) != null) { authorization = oneAuthHasPermissionOnSchema (dd, r, forGrant); } if (authorization == AUTHORIZED) { DependencyManager dm = dd.getDependencyManager(); RoleGrantDescriptor rgd = dd.getRoleDefinitionDescriptor(role); ContextManager cm = lcc.getContextManager(); dm.addDependency(ps, rgd, cm); dm.addDependency(activation, rgd, cm); break; } } } lcc.removeRoles(activation, rolesToRemove); } return authorization == AUTHORIZED; }