I have done data masking and row level security based on the role of the user in snowflake. Now we are Integrating Tableau and Looker with snowflake using service account for these tools. Now since it is going to be a service account, which all the user will have access to. I am wondering how can we implement the masking and row level security.
Please note the access to snowflake is using SSO which is done by OKTA.
I am not very familiar with Tableau or Looker So wondering If we can do these security features from these tool or will have to bring in OKTA configuration(somehow) to configure this.
One way I am thinking to control this is by having multiple Service Account for the tool and depending on account assigned the role.
Or if people here can help me for how to implement this with a better way.
Snowflake has partnered with Tableau and Looker to integrate the access to Snowflake using OAuth.
Please refer to this document on how to set up the integration.
https://docs.snowflake.com/en/user-guide/oauth-partner.html
The user will log in to Snowflake using their own account via Tableau or Looker and all the data masking and row-level security that was applied to the user's role will take effect.
Related
I am a former Lotus Notes/Domino developer, learning the Microsoft stack. I am building a web application with a SQL server back end. I want to build a basic CRUD application where users register, then login. They should be able to work with data they created or that has been shared with them. I am unsure how to achieve that result.
One of the cool features of the Domino database was the ability to add reader and or author fields to each record with user IDs, or roles and the server would automatically filter out those records when a user accesses the database. So if the user opened a View or Queried the database, the server would never let them see records they were not assigned access to.
Does SQL server have similar functionality? I've seen some information on row-level security, is that the best way to secure data? If not, what is the best practice to secure data so users can only see their data?
Thanks for any help you can offer.
Yes. SQL server has Row Level Security:
Row-Level Security enables you to use group membership or execution
context to control access to rows in a database table.
Row-Level Security (RLS) simplifies the design and coding of security
in your application. RLS helps you implement restrictions on data row
access. For example, you can ensure that workers access only those
data rows that are pertinent to their department. Another example is
to restrict customers' data access to only the data relevant to their
company.
The access restriction logic is located in the database tier rather
than away from the data in another application tier. The database
system applies the access restrictions every time that data access is
attempted from any tier. This makes your security system more reliable
and robust by reducing the surface area of your security system.
But it's more common to embed the authorization logic in a server-side application like a web server or web API. Row-Level Security is more common where users connect directly to the database, like in reporting and analytics, and client/server desktop applications.
Currently my team and I have a client that is using Power BI Premium.
We need to have Row Level Security enabled for both internal and external users.
We gave a recommendation to have Azure AD groups handle user management, but the client does not want to have all of there internal and external users be shown in their Azure AD. They believe it will be unmanageable for them. They want us to recommend another way to be able to manage internal users in Azure AD and have all external users managed in Azure AD, but completely separated from internal users, or by some other user management service that Azure provides. All the while, remaining in the same tenant since it seems the Power Bi Premium license can only be associated to one tenant and being able to have Row Level Security implemented for both internal and external users.
Is this possible? If so, how can we do it?
Thank you all for your time and help.
as per microsoft, https://learn.microsoft.com/en-us/power-bi/admin/service-admin-azure-ad-b2b
as far as I'm aware, the ideal way to share power bi with external users like that is this is to through azure b2b. which means you will have them as a guest user in your azure tenant. the second they are a guest in your tenant, that means they are on the list in your azure ad Users. which has advantages, their activity is trackable, reportable etc.
Our organizations has 10s of thousands of user accounts in our azure ad tenant, it doesn't make it any less manageable. just use the search bar or the filters, I'm not sure what the issue would be that makes it unmanageable.
if the requirement is secured power bi sharing,
you're better off trying to understand why your client thinks its unmanageable and help relieve their fears.
the only other option that I can see is, if you don't want to see external users, then you could use power BI embedded to embed power bi reports in a different web app that you create, and allow access to the webapp. but then you will have to deal with all the user level management stuff in code.
here's an article: https://medium.com/bi-helper/power-bi-embedded-report-distribution-to-external-users-1cf46fe1303b
hope this helps a bit.
I am supposed to build a Java EE Webapp on a legacy MsSql Database.
It is corporate security policy to use and respect database level user authentication and table level user roles and authorization per user.
This means, I need to create a database connection per user with the credentials of the user.
Is there any way to achieve this in standard JPA or do I have to implement my own connection pool? And if I did, what are the consequences? Would I be able to use container managed transactions?
I could not find any documentation or best practices on this scenario for JPA, but there is a number of DBA handbooks that recommend this kind of database level user auditing strategy.
So whats the best practice to work with a JavaEE stack on this kind of database?
I have a question that really feels like I should have an easy answer to, but for one reason or another I haven't been able to totally reason around it.
I'm embarking on development of an ASP.NET MVC3 intranet application, and I'm currently working on designing authentication & authorization. We're forced to use basic authentication in our environment, and we use Active Directory, so the authorization part is generally taken care of. Unfortunately our role/user hierarchy in active directory doesn't mirror what I need for the roles in the application, so I'm going to have to define my own.
I'm using SQL Server, so I was originally thinking of using stored procedures for all DML, and then creating roles and adding users in roles in SQL Server, and then controlling access to the stored procedures via those roles. I was also thinking I could query for those SQL Server database-level users & roles in order to use that as the source of authorization info in the application itself. That originally seemed like a great idea, but it doesn't seem like a popular one (for one, it seems the queries for that are a little long and messy for what they produce). Alternatively, would it be better to have the web app impersonate a user for all queries to the server, and then implement a user/role database with my own schema, and only authorize on the application side?
It originally seemed that authorizing on both the application and database side would be a good thing for security, and using the SQL Server user/role objects means that the user and role data wouldn't need to be stored in two places.
I did see some potentially relevant discussion at Best practice on users/roles on SQL Server for a web application, but I think this is a different question overall.
Thanks!
I recommend creating a sql login that the web application will use to connect to sql server. This way you are not impersonating any specific AD account which may get deleted, disabled in the future and can control the user strickly in SQL Server.
I would then recommend implementing roles based authentication in your application. This will enable you to create users and roles that are custom to your application and then assign users to them. This way if a user tries to access a resource that their role is not allowed it will not do any work. Here is a demo app based on this principle http://www.codeproject.com/KB/web-security/rolesbasedauthentication.aspx.
What is the best option for a windows application that uses SQL server authentication? Should I create a single SQL account and manage the users inside the application (using a users table). Or should I create a SQL server account for each user. What is your experience? Thank you!
Depends on whether the username/password for the SQL server would be exposed to the user, and whether that would be a problem. Generally for internal apps (in smaller organisations), one would trust the users not too log in directly to the sql server. If you have a middleware layer (ie webservices) the password can be hidden from user.
I prefer to use a general login for the DB and manage users in the application. Even if you do create a login to sql for each application user, they could still connect directly, so why not just use a generic sql login that is easier to manage. This is of course assuming all users have the same accesses.
One good practice, if the users potentially can get direct access to the db, would be to grant access only through Stored Procedures and not directly to tables, so that only certain actions can be performed. Steer away from writing business logic or security checks (except basic ones) within the stored procs.
One way I would solve your problem is to write some webservices that check security and does your CRUD (via datasets, etc), but again it depends on the app and environment.
In summary if you have a middle layer or all users have the same access manage the user within the application and use a single user login. Otherwise use a login per user or role.
One option that I have used in the past is to use the ASP.NET Membership Provider. It makes authentication a breeze to use. The only drawback that I saw was that it added a bunch of tables to your database.
The code for using it is very straight-forward.
Here's a blog post about using this in a Windows app. http://msmvps.com/blogs/theproblemsolver/archive/2006/01/12/80905.aspx Here's another article with more details. http://www.c-sharpcorner.com/UploadFile/jmcfet/Provider-basedASP.NET10162006104542AM/Provider-basedASP.NET.aspx
Here's another article that talks about using it with Windows applications: http://www.theproblemsolver.nl/usingthemembershipproviderinwinforms.htm
Google for "ASP.NET 2.0 Membership Provider", and you will get plenty of hits.
What about having SQL accounts based on the level of permissions needed for the task. For example you could have a read only account just used for reporting if your system has a lot of reporting. You would also need an account what has write access for people to change their passwords and other user admin tasks.
If you have situations where certain users are only going to have access to certain data I would have separate accounts for that data. The problem with using 1 account is you are saying that there is no SQL injection anywhere in your application. That is something everyone would strive for but sometimes perfect security is not possible, hence the multi-pronged approach.