Troubleshooting

Users with admin rights can modify RLS security on PANTHEON database.

1. Create Flat Tables, RLS functions and security policies

[dbo].[pPA_RLSCreate]

1. Create RLS flat tables from script in RLS scheme
   SQL Command:
   Exec [dbo].[pPA_RLSFlatTablesPrepare]
2. Fill all flat tables (data from t%usersecurity tables to RLS tables)
   SQL Command:
   Exec [dbo].[pPA_RLSFlatTablesFill]
3. Create all RLS inline table valued functions used in predicates
   SQL Command:
   Exec [dbo].[pPA_RLSCreateFunctions]
4. Fill data needed to create Security Policies for tables
   SQL Command:
   Exec [dbo].[pPA_SetRLSFunctionPolicyFill]
5. Create after-insert triggers for changes on t%usersecurity tables
   SQL Command:
   Exec [dbo].[pPA_RLSCreateTriggers]
6. Enable/disable all policies to apply RLS to database:

SQL Command:
Exec pPA_RLSSecurityPoliciesState 'ON';
Exec pPA_RLSSecurityPoliciesState 'OFF';

Exec pPA_RLSSecurityPoliciesState 'ON', 'tHE_Move';
Exec pPA_RLSSecurityPoliciesState 'OFF', 'tHE_Move';

2. Drop RLS on database (clear all)

SQL Command: Exec [dbo].[pPA_RLSDrop]

1. DROP SECURITY POLICY
2. DROP Function [RLS]
3. DROP Triggers: exec pPA_RLSCreateTriggers 'F'
4. DROP table [RLS]
5. Disable all policies to apply LS to database: Exec pPA_RLSSecurityPoliciesState 'OFF';

3. Sample to select all data without checking permissions

SQL Command:
execute as user = 'RLS_ALL'
select * from tHE_Move
revert

4. Check if RLS is enabled on a PANTHEON database

SQL Command:
select * from [dbo].[fPA_RLSEnabled]()