Using the Replace Table Rule Action to Implement Row-Level Security

Back Next

Step 5. Create the Replace Table Rule

Use the symbol that you defined in Step 4 to create a Replace Table rule that filters out rows from the result set that contain information about employees in other departments.

In the Rule Editor, select the security rule folder that you created and click

Action

Append Rule

The

Append Rule

window appears.

Configure the following parameters for the Replace Table rule:

Rule Name: Enter the name of the rule. In this example, the rule name is ReplaceTable.
Description: Enter an optional description of the rule.
Matcher: Select the Any matcher. The Rule Engine applies the rule to all incoming requests.
Action: Select the Replace Table action. The Replace Table action replaces the FROM clause of the SQL statement to provide row-level security. In the Tables to Replace box, define the following parameters:
Table Name
. Enter the name of the table. In this example, the table name is
.*EMPLOYEES.*
, which identifies the EMPLOYEES table.
Alternative Object or Query
. Enter an alternative query that includes a WHERE clause to replace the original FROM clause in the request. In this example, the alternative query is
SELECT * FROM \(table) WHERE DEPARTMENT_ID=\(DepartmentID)
. The alternative query changes the statement so that it returns only rows that have the Sales department identification number in the DEPARTMENT_ID column. The query specifies the Sales department identification number with the DepartmentID symbol.
You can use the \(table), \(prefix), and \(tableOnly) symbols with the Replace Table action to specify the part of the FROM clause that you want to replace. For more information about the Replace Table action symbols, see the
Dynamic Data Masking User Guide
.
Processing Action: Select the Continue processing action. The Rule Engine continues to the next rule in the tree.
Log When Rule is Applied: To include information in the log files about when the Rule Engine applies the rule, select the Log When Rule is Applied parameter.