Page Comparison

CREATE OR REPLACE ROLE confidentialcls_restricted ''
 
GRANT CONNECT, METADATA, EXECUTE ON test
 ;

CREATE OR REPLACE TAG confidential
    DESCRIPTION = 'Used to tag views or columns that fall under the Confidential data definition';
   ROLE cls_restricted_dob ''
GRANT CONNECT, METADATA, EXECUTE ON test;

CREATE OR REPLACE ROLE cls_restricted_gender ''
GRANT CONNECT, METADATA, EXECUTE ON test;

CREATE OR REPLACE GLOBAL_SECURITY_POLICY mask_confidential_columns
    DESCRIPTION = 'For non-RLS views, masks all columns with the confidential tag for non-admins without the confidential role'
    ENABLED = TRUE
    AUDIENCE (
ROLE cls_restricted_race ''
GRANT CONNECT, METADATA, EXECUTE ON test;

CREATE OR REPLACE TAG cls
    DESCRIPTION = 'Tags views and columns that have CLS (column level security) applied';

CREATE OR REPLACE TAG cls_restricted
    DESCRIPTION = 'Tags NOT_IN ROLES (confidential, "grp_ds_denodo-admin", restricted)
    )
    ELEMENTS (columns with restricted data that have column-level security (CLS) applied.';

CREATE OR REPLACE TAG cls_restricted_dob
    DESCRIPTION = 'Tags columns with VIEWSrestricted NOTdata TAGGEDof birth (rls_deptDOB) data to have column-level security (CLS) applied';

CREATE OR RESTRICTIONREPLACE (TAG cls_restricted_gender
       FILTERDESCRIPTION = ''Tags columns with restricted gender data to have  MASKING ANYcolumn-level security (confidentialCLS) WITH (HIDE) (numbers WITH DEFAULT, datetimes WITH DEFAULT, texts WITH DEFAULT)applied';
    
CREATE OR REPLACE TAG cls_restricted_race
    DESCRIPTION );

   );

CREATE OR REPLACE VIEWROLE cls_test
    FOLDER = '/02-transformation'(
   rls_data_strategy ''
  GRANT CONNECT, METADATA, EXECUTE ON test;
  
CREATE OR REPLACE ROLE rls_iam ''
  GRANT CONNECT, METADATA, EXECUTE ON test;
  
CREATE hire_dtOR REPLACE ROLE general ''
  GRANT  TAGS(confidential)CONNECT, METADATA, EXECUTE ON test;
  
CREATE OR termination_dtREPLACE TAG rls
    DESCRIPTION  TAGS(confidential),
        annual_rt= 'Used to tag views and columns with RLS applied';
    
CREATE OR REPLACE  TAGS(confidential),TAG rls_dept
    DESCRIPTION = 'Used to tag date_of_birthcolumns with department values for application of row-level security TAGS(restrictedRLS),';

CREATE OR REPLACE TAG rls_assigned_roles
  gender  DESCRIPTION = 'Used to tag column containing TAGS(restricted),a users assigned roles';

CREATE  OR REPLACE race
GLOBAL_SECURITY_POLICY rls_dept
    DESCRIPTION =  TAGS(restricted)
    ) AS
 'Limits rows based on departments associated with users assigned roles'
  SELECT '0001' ASENABLED emplid,= TRUE
    AUDIENCE (
    'John Doe' AS name, ALL
    )
    ELEMENTS cast('2024-11-01' AS
TIMESTAMP) AS hire_dt,      COLUMNS TAGGED ANY (rls_dept)
  cast('2024-11-02' AS TIMESTAMP)
   AS termination_dt,RESTRICTION (
        FILTER  100000.0 AS annual_rt,
           cast('1990-01-01' AS DATE) AS date_of_birth,
           'Male' AS gender,= '((strings_have_intersection(''rls_iam,grp_ds_denodo-ir-read'', rls_assigned_roles, '','') AND rls_dept = ''IAM'') OR (strings_have_intersection(''rls_data_strategy,grp_ds_denodo-ir-read'', rls_assigned_roles, '','') AND rls_dept = ''DS''))'
        REJECT 
    'Unknown' AS race
    FROM dual();

)

cast('1990-01-01' AS DATE) AS date_of_birth,
             'Male' AS gender,
             'Unknown' AS race
      FROM dual()
    )
    select st_union.*, roles.assigned_roles from st_union left join admin.get_user_roles_string roles on 1=1 CONTEXT ('formatted' = 'yes');

select * from test.rlssecurity_test context('impersonate_roles'='iamgeneral');

select 
    * 
from test.security_test 
context('impersonate_roles'='data_strategy,iam');

grp_ds_denodo-admin');

select 
    * 
from test.rlssecurity_test 
context('impersonate_roles'='grp_ds_denodo-ir-read,cls_testconfidential');

select 
    * 
from test.rlssecurity_test 
context('impersonate_roles'='general');