Stack Overflow
Stack Overflow

Questions tagged [row-level-security]

Row-level security is database security term which relates to the ability to define and enforce access control logic on rows of data such that a user can only retrieve the rows of data he or she is allowed to view.

Row-level security is database security term which relates to the ability to define and enforce access control logic on rows of data such that a user can only retrieve the rows of data he or she is allowed to view.

Several database vendors provide row-level security mechanisms. For instance:

  • Oracle provides Virtual Private Database (VPD), a free feature of the Oracle Enterprise Database.
  • MySQL provides fine-grained access control (FGAC). This is further detailed in this 2006 article.
  • IBM DB2 provides row/column-level access control (RCAC). This is further detailed in this IBM knowledge base.
  • SQL Server and Azure SQL Database provide Row-Level Security (RLS). This is further detailed in the MSDN product documentation.

In row-level security, a user can ask to view a set of data e.g. medical records. The database table (or view) contains a complete set of medical records but only returns those records the user is entitled to view. The authorization is typically driven through the configuration of VPD/RCAC/FGAC or through an access control policy e.g. doctors can view the medical records of patients they are assigned to.

Row-level security is becoming more prevalent with the rise of and , technologies that help standardize access control.

An extension of row-level security is the ability to apply cell-level security. This space has been coined as dynamic data masking by Gartner analyst Joseph Feiman (see this report and these videos on data masking).

There are several third party vendor solutions which provide row-level security / dynamic data masking:

  • GreenSQL
  • Informatica DDM
  • Axiomatics Data Access Filter MD

Additional information and vendors are listed on Wikipedia.

367 questions
3
votes
1 answer

Row Level Security, poor performance

I'm evaluating the possibilities of using PostgreSQL's Row Level Security (RLS) features for soft deletion of customers. Unfortunately I'm having issues with poor performance. Here is a simple test setup in PostgreSQL version 9.5.10: A table…
Backend Viking
  • 63
  • 1
  • 5
3
votes
2 answers

Row Level Security not working in Power BI with Groups

I am running in this strange issue: first I prepared some report with power BI desktop then I go into "Manage Role" to create a rule that show data only for region ="Italy" I upload the report to the power BI Services I go to the security tab under…
Nelson Gomes Matias
  • 1,787
  • 5
  • 22
  • 35
3
votes
3 answers

PostgreSQL - infinite recursion detected in policy for relation

In database are 3 tables - Department, Employee, Account. One department has many employees. Employee contain column department_id bigint Account table contain columns login varchar, employee_id bigint and used for binding Postgres users (roles) to…
Powercoder
  • 695
  • 1
  • 5
  • 25
3
votes
1 answer

Multiple Security Predicates (FILTER|BLOCK) on same Table

I'm implementing RBAC-RLS security to my database and I have a question. Here is the scenario: I have a function that has one input parameter @PermissionId which checks if the logged user has that privilege. Each Role in the database is associated…
Stefan Taseski
  • 242
  • 2
  • 24
3
votes
1 answer

Roles, groups and set session authorization in postgres

I am mucking around with postgres row level security for multi tenant applications. I want achieve this via a policy which separates rows based on the tenant_name which is a column in my tables. I have roles for each tenant. However, I am…
InsatiableTraveller
  • 1,545
  • 2
  • 10
  • 9
3
votes
3 answers

Database independent row level security solution

does anybody knows about Java/C# database independent authorization library. This library should support read, write, delete, insert actions across company organizational structure. Something like this: - user can see all documents - user…
Filip
  • 3,257
  • 2
  • 22
  • 38
3
votes
1 answer

Oracle Row Level Security in multi-tenant app / default values for new records

Task Retrofit an existing application to use a multi-tenant approach. It shall be possible to create tenants and each user's session should reference exactly one active tenant. Each tenant should only be able to see and update his partition of the…
Magnus Jungsbluth
  • 91
  • 5
3
votes
2 answers

PostgreSQL SELECT-RULES , inheritance, row-level permissions

Here's what I've been reading: http://www.postgresql.org/docs/9.2/static/rules-views.html http://www.postgresql.org/docs/9.2/static/rules-privileges.html My goal is to allow a login to see only those rows that it "owns", so to speak. Let's say…
Tim
  • 8,669
  • 31
  • 105
  • 183
2
votes
2 answers

Webapp: Mysql: Row level security. Pro/cons? A better way to do this?

I am trying to emulate row level security on a webapp I am developing using MySQL. Using this method: Creating a database with the the required tables where the data pertaining to all the users will be stored with proper indexing of columns of the…
ThinkingMonkey
  • 12,539
  • 13
  • 57
  • 81
2
votes
0 answers

Enforcing row level permission in Django Models

I am trying to enforce row (object) level permissions in Django, on the model level. All the resources on the web revolve around two possible solutions: Option 1. Passing the request manually to a custom manager with a for_user() method: #…
Martin Taleski
  • 6,033
  • 10
  • 40
  • 78
2
votes
0 answers

How can I take advantage of Postgres row-level-security in a Laravel application?

I am currently experimenting with adopting PostgreSQL row-level security for a server-side application in Laravel. My goal is to move multi-tenancy access rights into the DB, so as to completely remove them from application logic. This requires me…
Patrick Johnmeyer
  • 31,462
  • 2
  • 26
  • 24
2
votes
1 answer

Postgres row-level-access via cognito userpool

I am trying to set up row-level access control in Postgres through a Cognito user pool. I have set up the user pool and can successfully authenticate users through it, but I am not sure how to link it to Postgres for row-level access control…
Kival M
  • 182
  • 1
  • 10
2
votes
0 answers

Row-level-security not working for Postgres internal tables

I wanted a work-around for the PostgreSQL limitation (Hide unrelated schema/tables structure for a user). I decided to go with the Row-Level-Security(RLS). The RLS seems working as expected for the user tables but did work for the internal tables…
Utkarsh
  • 137
  • 9
2
votes
2 answers

column-level security with policies in PostgreSQL 14 / PostgREST?

I'm using PostgREST as an API for a project and now implement the security functions. One thing I'd like to have but that is covered neither by row- nor by column-level security as I've read them so far is this use case: Table USERS is public…
Tom
  • 2,688
  • 3
  • 29
  • 53
2
votes
1 answer

Infinite recursion RLS

I have a table like: table person_groups person_id: uuid group_id: uuid and I want people for whom uid() = person_id to be able to get all of the other person_ids in all of their groups. I tried to use CREATE POLICY "select_comembers" ON…
chrisb2244
  • 2,940
  • 22
  • 44
1 2 3
…
24 25