Forum Discussion

JonBFabric's avatar
JonBFabric
Helper I
6 months ago

OneLake Column Level Security Not Working

Good Morning,

 

In a previous question I asked about column level security not working with shortcuts, and accepted that this is a known limitation. Consequently I have gone back to basics and connect to the lakehouse directly from a Spark Notebook, rather than via shortcut.

 

For the purposes of this test the user has been given select access on the following:

  • 4 full tables - No CLS - These are my control as they test standard access
  • 4 tables with a subset of fields (CLS) - These test the CLS element

The lakehouse security is configured as described here.

 

The user is using a Fabric Spark Notebook with the test lakehouse assigned as the default lakehouse. This notebooks contains 8 cells, one for each table to which they have some level of access. Each cell seeks to load a single record from the table in to a dateframe, using the following syntax:

df = spark.sql("SELECT * FROM Lakehouse.Schema.table LIMIT 1")
display(df)
 
The user initiates a standard spark session and runs the notebooks. 
  • The tables to which the user has full access return a single record, as expected
  • The tables to which the user has access to only select fields return an error.

 

Strangely, the error that is returned from the failed cells does not relate to permissions, it claims that it was not possible to allocate a session, despite the fact a session is running, and the non-CLS related cells complete successfully:

 

...
Caused by: org.apache.spark.SparkException: OneSecurity error while calling allocate system context, errorCode: 430, errorMessage: OneSecurity error while invoking OneSecurity API allocate with response error {"code":"CapacityLimitExceeded","subCode":0,"message":"Unable to complete the action because your organization’s Fabric compute capacity has exceeded its limits. Try again later.","timeStamp":"2026-02-10T10:10:09.8015651Z","httpStatusCode":430,"hresult":-2147467259,"details":[{"code":"RootActivityId","message":"1fd51336-20b4-4819-b64b-18298cdb6d48"}
...

 

Can anyone advise on this problem?

 

Thanks

 

 

one lake

5 Replies

  • tayloramy's avatar
    tayloramy
    Super User
    6 months ago

    Hi JonBFabric, 

     

    Just to confirm and get the easy stuff out of the way, have you checked the Capacity Metrics app to confirm that you are not at your capacity limit? 

     

     

    • tayloramy's avatar
      tayloramy
      Super User
      6 months ago

      Hi JonBFabric, 

       

      If you freeze all cells in the notebook except for one that hits a CLS table, do you get the same error? 

       

      Also, do you get the error if you specifiy column names instead of select *? 

       

      I know with CLS in SQL, a select * will return a permissions error, maybe that is happening here and Fabric is reporting the wrong error code? 

       

       

      • JonBFabric's avatar
        JonBFabric
        Helper I
        6 months ago

        Hi tayloramy ,

         

        I know that specifying fields makes no difference, as I have tried getting them to select a single permitted field. Select * in SQL is documented to not work, but with notebooks is supposed to evaluate to just the permited fields. 

         

        I will need to get back to you on the freezing of cells once I have managed to get the use to test.