Security

Casabase Cube row-level security is opt-in per user. A dimension can be security-enabled without restricting every user. Enforcement occurs only when the dimension has security enabled and the user has at least one active security rule.

MANAGE_SECURITY_RULE

Minimum role: CUBE_ADMIN

MANAGE_SECURITY_RULE(
    P_ACTION,
    P_PARAMS
) -> VARCHAR

Manages row-level security rules.

A rule grants one user access to one member of one dimension and includes that member’s descendants.

Parameters

Parameter	Type	Req/Opt	Description
P_ACTION	VARCHAR	req	ADD, UPDATE, DELETE, or DEACTIVATE.
P_PARAMS	VARCHAR	req	JSON object containing the operation-specific parameters.

For P_PARAMS:

Action	Required content
ADD	cube_name, hier_name, member_name, user_name
UPDATE	id, plus the fields to change
DELETE	ids array
DEACTIVATE	ids array

Caution

The parameter name is hier_name, not dim_name.

Passing dim_name is rejected even though the underlying stored column is named DIM_NAME.

Security enforcement behavior

Security enforcement requires both conditions to be true:

1. Security is enabled on the dimension.
2. The user has at least one active security rule for the cube.

A user with no active security rules is unrestricted by Casabase Cube row-level security.

Deactivating a user’s last active rule therefore makes that user unrestricted. To remove the user’s application access entirely, revoke the applicable Casabase Cube application role.

Row-level security also requires READ SESSION to be granted to the application because rules are evaluated against CURRENT_USER().

Examples

Grant access to a branch and its descendants:

CALL CUBE.MANAGE_SECURITY_RULE('ADD','{
  "cube_name":"FINANCE",
  "hier_name":"ENTITY",
  "member_name":"North America",
  "user_name":"na.controller@company.com"
}');

Grant access to the entire dimension by granting its top member:

CALL CUBE.MANAGE_SECURITY_RULE('ADD','{
  "cube_name":"FINANCE",
  "hier_name":"ENTITY",
  "member_name":"Total Entity",
  "user_name":"cfo@company.com"
}');

Move an existing rule to another branch:

CALL CUBE.MANAGE_SECURITY_RULE(
    'UPDATE',
    '{"id":101,"member_name":"EMEA"}'
);

Deactivate rules:

CALL CUBE.MANAGE_SECURITY_RULE(
    'DEACTIVATE',
    '{"ids":[101,102]}'
);

Reactivate a rule:

CALL CUBE.MANAGE_SECURITY_RULE(
    'UPDATE',
    '{"id":101,"active":true}'
);

Permanently remove rules:

CALL CUBE.MANAGE_SECURITY_RULE(
    'DELETE',
    '{"ids":[101,102]}'
);