1. Row Level Security enhancements in 91SP3
Ashutosh Deshpande
BMC Software
May 2017

2. Contents Background of Row Level Security Problem Statement Solution
Results

3. Background of Row Level Security
Row level security (RLS) is achieved by adding dynamic group fields on a form
Submitter: field id 2
Assigned To: field id 4
Assignee Group: field id 112
Dynamic group fields:
Server generates SQLs if there are multiple fields via
Traditional algorithm of Combined Likes (OR clauses)
New algorithm (RLS_SPLIT / regex) was implemented in 9.0 SP1 with a shared configuration (Disable-New-RLS-Implementation) to turn it OFF
None of these algorithms seem to solve all problems for all forms for customers consistently

4. Problem Statement – Customer use case
The sequence of the RLS_SPLIT functions is not predictable
Query 1
18:14: */ SELECT COUNT(*) FROM T2803 WHERE (((T2803.C = N'Open/Active') OR (T2803.C = N'Deferred')) AND ((T2803.C = N'OS3:CM:Request') OR (T2803.C = N'OS3:OP:Request') OR (T2803.C = N'OS3:WO:Request')) AND EXISTS(SELECT 1 FROM(SELECT Item FROM RLS_split(T2803.C60005, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60012, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60020, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60004, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60023, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60021, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60013, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60025, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60024, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60026, ';')) privs join RLS_split('-30721;-30700;-30701;30717;-30725;30715;-30705;30711;30712;30710;7900;3004;-30720;''cloneRoger'';-30710;-30711;30707;2182;30727;30705;-30715;30702;30725;30722;30700;30701;30720;2220;30721;2189;13006;0', ';') u ON privs.Item = u.Item))
18:14: */ OK
Query 2
18:18: */ SELECT COUNT(*) FROM T2803 WHERE (((T2803.C = N'Open/Active') OR (T2803.C = N'Deferred')) AND ((T2803.C = N'OS3:CM:Request') OR (T2803.C = N'OS3:OP:Request') OR (T2803.C = N'OS3:WO:Request')) AND EXISTS(SELECT 1 FROM(SELECT Item FROM RLS_split(T2803.C60025, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60021, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60013, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60004, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60020, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60005, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60026, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60023, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60012, ';') UNION ALL SELECT Item FROM RLS_split(T2803.C60024, ';')) privs join RLS_split('-30721;-30700;-30701;30717;-30725;30715;-30705;30711;30712;30710;7900;3004;-30720;''cloneRoger'';-30710;-30711;30707;2182;30727;30705;-30715;30702;30725;30722;30700;30701;30720;2220;30721;2189;13006;0', ';') u ON privs.Item = u.Item))
18:18: */ OK
Timings                Query1                                 Query2                            
Execution 1:       00:00:               00:00:              
Execution 2:       00:00:               00:00:              
Execution 3:       00:00:               00:00:          

5. Problem Statement
Since 9.0 SP1, many customers reported issues with slowness in SQL queries that involve RLS
Disabling new RLS implementation (RLS_SPLIT / regex) gave temporary relief for some customers for some forms
In 9.1 SP2, default setting for “Disable-New-RLS-Implementation” was changed from “F” to “T” to fallback to traditional algorithm of Combined Likes (OR clauses)
Many customers still continue to face the inconsistent performance issues in some parts of ITSM
On deep dive, it is found that server generated SQLs are not consistent when there are many dynamic group fields in the form
One of the algorithms fits better in some forms, but not others posing challenge to select the best setting

6. Solution
Continue the existing shared configuration (Disable-New-RLS-Implementation) to define best suited algorithm that will give best results for most of the forms
Allow configuration to override algorithm for any given form
RLS_SPLIT
Combined Likes (OR clauses)
Generate predictable SQL queries by using sorted field ids in WHERE clauses for RLS queries
Provide new shared configurations (RLS-Field-Order-RLS-Split, RLS-Field-Order-Combined-Likes) to choose between ascending or descending order of the field ids in SQLs based on algorithm
Allow configuration to override order of the dynamic group fields in a form in generated SQL queries so as to get per-form consistent and predictable performance
Expose these configurations as form properties via Developer Studio

7. Solution

8. Results