SQL Server 2017 Developer's Guide by Dejan Sarka

Author:Dejan Sarka
Language: eng
Format: epub
Tags: COM051170 - COMPUTERS / Programming Languages / SQL, COM021050 - COMPUTERS / Databases / Servers, COM021030 - COMPUTERS / Databases / Data Mining
Publisher: Packt Publishing
Published: 2018-07-06T12:14:51+00:00

Predicate-based Row-Level Security

Using programmable objects for RLS protects sensitive data very well because users don't have direct access to the tables. However, the implementation of such a security might be very complex for existing applications that don't use stored procedures, and other programmable objects. This is why SQL Server 2016 and 2017 include predicate-based RLS. A DBA creates the security filters and policies. The new security policies are transparent to the application. RLS is available in the Standard, Enterprise, and Developer editions. There are two types of RLS security predicates:

Filter predicates that silently filter the rows the application reads. For these predicates, no application change is needed. Note that, besides reading, filter predicates also filter the rows when an application updates or deletes the rows; this is because the application again simply does not see the filtered rows.

Block predicates that explicitly block write operations. You can define them for after-insert and after-update operations, when the predicates block inserts or updates that would move a row beyond the scope of the block predicate. After-insert block predicates also apply to minimally logged or bulk inserts. You can also define block predicates for before-update and before-delete operations, when they serve as filter predicates for the updates and deletes. Note that if you already use filter predicates, before-update and before-delete predicates are not needed. You might want to change the affected applications to catch additional errors produced by block predicates.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.