Row Level Security enhancements in 91SP3 Ashutosh Deshpande BMC Software May 2017

Contents Background of Row Level Security Problem Statement Solution Results

Background of Row Level Security Row level security (RLS) is achieved by adding dynamic group fields on a form Submitter: field id 2 Assigned To: field id 4 Assignee Group: field id 112 Dynamic group fields: 60000-60999 Server generates SQLs if there are multiple fields via Traditional algorithm of Combined Likes (OR clauses) New algorithm (RLS_SPLIT / regex) was implemented in 9.0 SP1 with a shared configuration (Disable-New-RLS-Implementation) to turn it OFF None of these algorithms seem to solve all problems for all forms for customers consistently

Problem Statement – Customer use case The sequence of the RLS_SPLIT functions is not predictable Query 1 18:14:44.2650 */ SELECT COUNT(*) FROM T2803 WHERE (((T2803.C700010006 = N'Open/Active') OR (T2803.C700010006 = N'Deferred')) AND ((T2803.C700010002 = N'OS3:CM:Request') OR (T2803.C700010002 = N'OS3:OP:Request') OR (T2803.C700010002 = N'OS3:WO:Request')) AND EXISTS(SELECT 1 FROM(SELECT Item FROM RLS_split(T2803.C60005, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60012, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60020, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60004, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60023, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60021, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60013, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60025, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60024, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60026, ';')) privs join RLS_split('-30721;-30700;-30701;30717;-30725;30715;-30705;30711;30712;30710;7900;3004;-30720;''cloneRoger'';-30710;-30711;30707;2182;30727;30705;-30715;30702;30725;30722;30700;30701;30720;2220;30721;2189;13006;0', ';') u ON privs.Item = u.Item)) 18:14:49.4620 */ OK   Query 2 18:18:45.2460 */ SELECT COUNT(*) FROM T2803 WHERE (((T2803.C700010006 = N'Open/Active') OR (T2803.C700010006 = N'Deferred')) AND ((T2803.C700010002 = N'OS3:CM:Request') OR (T2803.C700010002 = N'OS3:OP:Request') OR (T2803.C700010002 = N'OS3:WO:Request')) AND EXISTS(SELECT 1 FROM(SELECT Item FROM RLS_split(T2803.C60025, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60021, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60013, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60004, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60020, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60005, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60026, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60023, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60012, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60024, ';')) privs join RLS_split('-30721;-30700;-30701;30717;-30725;30715;-30705;30711;30712;30710;7900;3004;-30720;''cloneRoger'';-30710;-30711;30707;2182;30727;30705;-30715;30702;30725;30722;30700;30701;30720;2220;30721;2189;13006;0', ';') u ON privs.Item = u.Item)) 18:18:45.3940 */ OK Timings                Query1                                 Query2                             Execution 1:       00:00:04.9433815              00:00:00.3160251              Execution 2:       00:00:04.6853596              00:00:00.3350252              Execution 3:       00:00:04.6563563              00:00:00.3840337         

Problem Statement Since 9.0 SP1, many customers reported issues with slowness in SQL queries that involve RLS Disabling new RLS implementation (RLS_SPLIT / regex) gave temporary relief for some customers for some forms In 9.1 SP2, default setting for “Disable-New-RLS-Implementation” was changed from “F” to “T” to fallback to traditional algorithm of Combined Likes (OR clauses) Many customers still continue to face the inconsistent performance issues in some parts of ITSM On deep dive, it is found that server generated SQLs are not consistent when there are many dynamic group fields in the form One of the algorithms fits better in some forms, but not others posing challenge to select the best setting

Solution Continue the existing shared configuration (Disable-New-RLS-Implementation) to define best suited algorithm that will give best results for most of the forms Allow configuration to override algorithm for any given form RLS_SPLIT Combined Likes (OR clauses) Generate predictable SQL queries by using sorted field ids in WHERE clauses for RLS queries Provide new shared configurations (RLS-Field-Order-RLS-Split, RLS-Field-Order-Combined-Likes) to choose between ascending or descending order of the field ids in SQLs based on algorithm Allow configuration to override order of the dynamic group fields in a form in generated SQL queries so as to get per-form consistent and predictable performance Expose these configurations as form properties via Developer Studio

Solution

Results