Implementing Row Level Security in SQL Server Louis Davidson, Data Architect, CBN

Data Architect; CBN, drsql.org Book Author Written 6 books on database design, along with parts of other books on DMVs, Exam Refs, MVP Deep Dives, etc. Corporate Data Architect Worked for the same company for 20 years, which has allowed me a breadth of technology experience. Louis Davidson Data Architect; CBN, drsql.org Microsoft Data Platform MVP Though I still like to call it SQL Server MVP, because I am that conservative (also known as old). /louisdavidson @drsql http://drsql.org/blog

What is Row Level Security? Hiding rows from users based on some context Implement a predicate to hide rows based on inclusion in a role, or name, or even application/time period. Unlike most security, dbo/sa are not immune to it’s effects (unless desired) Is a form of Horizontal Partitioning Filters out rows that do not meet a security oriented predicate A primary goal will be to limit effect on the application

Row Level Security Example All Data In Table CustomerId Name SalesTotal ManagedBy 1 Betty’s Bikes 200000.00 Fred 2 Cy’s Cycles 10003.21 3 Tom’s Ten Speeds 560020.00 Linda 4 Paula’s Penny-farthings 200.00 Say our predicate is: USER_NAME() = ManagedBy

Row Level Security Linda’s View 3 Tom’s Ten Speeds 560020.00 Linda 4 CustomerId Name SalesTotal ManagedBy 3 Tom’s Ten Speeds 560020.00 Linda 4 Paula’s Penny-farthings 200.00

Row Level Security Fred’s View 1 Betty’s Bikes 200000.00 Fred 2 CustomerId Name SalesTotal ManagedBy 1 Betty’s Bikes 200000.00 Fred 2 Cy’s Cycles 10003.21

Row Level Security Everyone Else’s View (Including SA and db_owner) CustomerId Name SalesTotal ManagedBy

Demo Agenda We will be covering how to implement row level security using SQL Server 2016+ methods, as well as other timeless methods Define row level security Using the Row Level Security (RLS) Feature The mechanics of implementing RLS Performance/scaling considerations Row level security without the feature Bonus: Dynamic Data Masking

Row Level Security Feature Predicate Function Simple Table Valued UDF that returns either nothing (to not allow access) or something (to allow access) UDF parameters usually map to one or more columns in the table. Security Policy Attaches the predicate function to a table Predicate functions can be applied to: Filter our data from the user’s view Block a user from performing some action

Demo Time! Row Level Security

Learn more from Louis Davidson @drsql louis@drsql.org http://drsql.org/blog