ARES - RLS Compatibility Mode

Code that must run without a security context of authorizations needs impersonation. Several function and properties are available for impersonation.

When an EXECUTE AS statement is run, the execution context of the session is switched to the specified login or user name. After the context switch, permissions are checked against the login and user security tokens for the specified account instead of the account calling the EXECUTE AS statement.

Check the following code:

Select USER_NAME()

execute as user = 'RLS_ALL' 

Select USER_NAME()

revert

Select USER_NAME()

Result:

Warning Revert must be called! The user or login account is impersonated for the duration of the session or module execution. Afterwards, the context switch is reverted.

Warning All functions and methods modify code only when IsRLS = True

The same code can be used on RLS and non-RLS databases.

• IsRLS: returns True if RLS is enabled on database.
  check: select * from [dbo].[fPA_RLSEnabled]()
• Function SQLToSQLRLSAll(ASQL: String): String;
  Converts SQL
  
• ARES.ExecuteStep_RLS_ALL(3);
  Code in step 3 will be executed using SQLToSQLRLSAll.
• ExecuteAsUser_RLS_ALLSQL
  Use in try-finally statements.
  • ExecuteAsUser_RLS_ALLSQL(True): execute as user = 'RLS_ALL' statement is run
  • ExecuteAsUser_RLS_ALLSQL(False): revert statement is run

• Property TdlDataset.ExceuteAs_RLS_ALL := True;
  Code TdlDataset.SQL.Text will be executed using SQLToSQLRLSAll.

Related topics:

  Row Level Security

  How RLS works in practice

  Upgrade

  Database

 Code changes