Row-level security (RLS)

With RLS (row-level security), you can restrict data access for users or user groups within a single dataset. For example, you can introduce data access control for different customers.

You can introduce row-level access control either in a dataset or a data source.

Configuring RLS at the dataset levelConfiguring RLS at the dataset level

You can control access to any dataset dimension. Each user or user group can be granted permissions for an unlimited number of measure values.

With RLS, a query to a dataset passes through the following filter:

where dimension in (value_1, value_2 ... value_N)

User accessUser access

For users, access control is based on the access configuration which looks like this:

'value_1': user_1, user_2
'value_2': user_3
'value_3': user_1, user_2, user_3

For example, to configure user-login access to all rows with the first-company value in the Company name field, set the following configuration:

'first-company': user-login@yandex.ru

To configure access for multiple users, list their accounts in the access configuration separated by commas:

'first-company': user-login-1@yandex.ru, user-login-2@yandex.ru, user-login-3@yandex.ru

Access for user groupsAccess for user groups

For user groups, access control is based on the access configuration which looks like this:

'value_1': @group:group_1_name
'value_2': @group:group_1_name, @group:group_2_name

The configuration specifies the group name rather than its identifier. If a group is renamed, you will need to update its RLS configuration accordingly.

For example, to configure group-name user group access to all rows with the first-company value in the Company name field, set the following configuration:

'first-company': @group:group-name

To configure access for multiple user groups, list them in the access configuration separated by commas:

'first-company': @group:group-name-1, @group:group-name-2, @group:group-name-3

You can configure access for users and groups at the same time:

'first-company': user-login-1@yandex.ru, user-login-2@yandex.ru, @group:group-name-1, @group:group-name-2

Wildcards and quotation marks in RLS configurationWildcards and quotation marks in RLS configuration

You can define values, users, and group names using wildcard characters:

• User_1, user_2, and group_1_name can access all the field's values

  *: user_1, user_2, @group:group_1_name
  

  For example, to configure access to all rows with any value in the Company name field, set the following configuration:

  *: user-login-1@yandex.ru, @group:group-name-1
  

• value_1 is available to all users and groups

  'value_1': *
  

  For example, to allow all users to access all rows with the first-company value in the Company name field, set the following configuration:

  'first-company': *
  

Quotes in values are set using double quotes:

'value in ''quotes''': user_1, user_2

For example, to set quotation marks for the first-company "Example" company name in the Company name field, specify the following configuration:

'first-company ''Example''': user-login-1@yandex.ru, @group:group-name-1

You can also use the " character:

'first-company "Example"': user-login-1@yandex.ru, @group:group-name-1

Configuring RLS at the data source levelConfiguring RLS at the data source level

Configuring RLS at the dataset level requires editing the datatset every time the RLS settings change.

To avoid this, you can move the row-level security logic to the data source side:

1. Add a new field for storing user IDs to the source data. All requests to the source will be filtered by this field.

   To view your ID, follow this link. If you need another user's ID, ask them to open this link and pass the ID to you.

2. For each row of source data, specify the ID of the user who is allowed to access this row. If multiple users must have access to the same row, you can move the access control logic to a separate table and join it to the main table at the dataset level.

3. In the dataset, enter userid:userid in the ID field under the RLS settings. The userid variable can be used together with the regular RLS type in the dataset:

   'value_1': user_1, user_2
   'value_2': user_3
      userid:userid
   

How to change permissions to a row in a datasetHow to change permissions to a row in a dataset

To configure access permissions to data rows: