1. Implementing Row Level Security (RLS)
Christian Araujo
Implementing Row Level Security (RLS)

2. Agradecimiento a los patrocinadores
Gold
Silver
Geek

3. About Me
MCSE Data management & Analytics MCSA Database Administration SQL 2016 Manager Database Architecture & Compliance (Conduent)

4. Agenda Overview Use Cases How it works Syntax Demo Best Practices
Questions

5. Row Level Security (RLS)
Released with SQL Server 2016
First released with Azure and then introduced with the On-premises version.
Row-Level Security enables customers to control access to rows in a database table based on the characteristics of the user executing a query (e.g., group membership or execution context).
Uses security predicates
Filter predicates silently filter the rows available to read operations (SELECT, UPDATE, and DELETE).
Block predicates explicitly block write operations (AFTER INSERT, AFTER UPDATE, BEFORE UPDATE, BEFORE DELETE) that violate the predicate.

6. Row Level Security (RLS)
Use cases
Hospital (HIPAA)
Banks (PCI-DSS)
Multi-tenant application
Security repositories (PCI-DSS)
BI Solutions (Power BI)
Permissions
Creating, altering, or dropping security policies requires the ALTER ANY SECURITY POLICY permission. Creating or dropping a security policy requires ALTER permission on the schema.

7. How RLS works?

8. Syntax
CREATE FUNCTION AS sysname) RETURNS TABLE WITH SCHEMABINDING AS RETURN SELECT 1 AS fn_securitypredicate_result = USER_NAME() OR USER_NAME() = 'Manager’;

9. Syntax
CREATE SECURITY POLICY SalesFilter ADD FILTER PREDICATE Security.fn_securitypredicate(SalesRep) ON dbo.Sales WITH (STATE = ON);

10. DEMO

11. RLS Best Practices
Creating, altering, or dropping security policies requires the ALTER ANY SECURITY POLICY permission. Creating or dropping a security policy requires ALTER permission on the schema.
Avoid type conversions in predicate functions to avoid potential runtime errors.
Avoid recursion in predicate functions wherever possible to avoid performance degradation. The query optimizer will try to detect direct recursions, but is not guaranteed to find indirect recursions (i.e., where a second function calls the predicate function).
Avoid using excessive table joins in predicate functions to maximize performance.
Predicate functions should not implicitly convert character strings to date, smalldatetime, datetime, datetime2, or datetimeoffset, or vice versa, because these conversions are affected by the SET DATEFORMAT (Transact-SQL) and SET LANGUAGE (Transact-SQL) options. Instead, use the CONVERT function and explicitly specify the style parameter.

12. Questions

13. Examples