Forum Discussion
Fabric - Row Level Security on Warehouse - Stage 2...
- 2 years ago
Okay, I managed to find a solution...
In my setup, I do have one table, that shows all users and which products each of them is allowed to see, e.g.:
Table ProductsPerUserUser Product [email protected] 2345 [email protected] 1234 [email protected] 2345 [email protected] 5678 To derive the Products the user is allowed to see, I had to extend the security function as follows:
CREATE FUNCTION
[SC_Security].[fn_securityProducts](@Product AS INT)
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN
SELECT 1 AS result
FROM
ProductsPerUser PPU
INNER JOIN
Products PROD
ON PPU.Product = PROD.Product
WHERE (PPU.User = USER_NAME() OR USER_NAME() = 'dbo')
AND PROD.Product = @Product
GONow, I can implement the security policy on each table that has the "Product" as a field.
Works like a charm...
Okay, I managed to find a solution...
In my setup, I do have one table, that shows all users and which products each of them is allowed to see, e.g.:
Table ProductsPerUser
| User | Product |
| [email protected] | 2345 |
| [email protected] | 1234 |
| [email protected] | 2345 |
| [email protected] | 5678 |
To derive the Products the user is allowed to see, I had to extend the security function as follows:
CREATE FUNCTION
[SC_Security].[fn_securityProducts](@Product AS INT)
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN
SELECT 1 AS result
FROM
ProductsPerUser PPU
INNER JOIN
Products PROD
ON PPU.Product = PROD.Product
WHERE (PPU.User = USER_NAME() OR USER_NAME() = 'dbo')
AND PROD.Product = @Product
GO
Now, I can implement the security policy on each table that has the "Product" as a field.
Works like a charm...
That's nice!
I'm trying to do the same thing, and managed to apply the RLS to my tables.
However, it seems that the RLS also affects my own user.
Is there a way to make it so that any person who is workspace Contributor, Member or Admin won't get affected by the RLS?
Is that what the OR USER_NAME() = 'dbo' clause should do?
I tried that, but it didn't have any effect for my user (except if I hardcode my own username there)
Appreciate any hints or clues 😀
- webchris2 years ago
Advocate III
Hi fabricator1
I think the
OR USER_NAME() = 'dbo')
part solves this issue for the automatically running process.
Maybe you need to add your user_name as well as an exception.
Hope this helps
- fabricator12 years ago
Advocate II
webchris thanks! 😀