ARES - RLS Compatibility Mode
Code that must run without a security context of authorizations needs impersonation. Several function and properties are available for impersonation.
When an EXECUTE AS statement is run, the execution context of the session is switched to the specified login or user name. After the context switch, permissions are checked against the login and user security tokens for the specified account instead of the account calling the EXECUTE AS statement.
Check the following code:
Select USER_NAME()
execute as user = 'RLS_ALL'
Select USER_NAME()
revert
Select USER_NAME()
Result:
 |
Warning
Revert must be called! The user or login account is impersonated for the duration of the session or module execution. Afterwards, the context switch is reverted.
|
|
Warning
All functions and methods modify code only when IsRLS = True
|
The same code can be used on RLS and non-RLS databases.
- IsRLS: returns True if RLS is enabled on database.
check: select * from [dbo].[fPA_RLSEnabled]()
- Function SQLToSQLRLSAll(ASQL: String): String;
Converts SQL
- ARES.ExecuteStep_RLS_ALL(3);
Code in step 3 will be executed using SQLToSQLRLSAll.
- ExecuteAsUser_RLS_ALLSQL
Use in try-finally statements.
- ExecuteAsUser_RLS_ALLSQL(True): execute as user = 'RLS_ALL' statement is run
- ExecuteAsUser_RLS_ALLSQL(False): revert statement is run
- Property TdlDataset.ExceuteAs_RLS_ALL := True;
Code TdlDataset.SQL.Text will be executed using SQLToSQLRLSAll.
Related topics:
Row Level Security
How RLS works in practice
Upgrade
Database
Code changes