You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> Azure SQL Data Warehouse supports filter predicates only. Block predicates aren't currently supported in Azure SQL Data Warehouse.
39
+
> Azure Synapse supports filter predicates only. Block predicates aren't currently supported in Azure Synapse.
40
40
41
41
## <aname="Description"></a> Description
42
42
@@ -154,7 +154,7 @@ It is possible to cause information leakage through the use of carefully crafted
154
154
155
155
-**Filestream:** RLS is incompatible with Filestream.
156
156
157
-
-**PolyBase:** RLS is supported with Polybase external tables for Azure SQL Data Warehouse only.
157
+
-**PolyBase:** RLS is supported with Polybase external tables for Azure Synapse only.
158
158
159
159
-**Memory-Optimized Tables:** The inline table-valued function used as a security predicate on a memory-optimized table must be defined using the `WITH NATIVE_COMPILATION` option. With this option, language features not supported by memory-optimized tables will be banned and the appropriate error will be issued at creation time. For more information, see the **Row-Level Security in Memory Optimized Tables** section in [Introduction to Memory-Optimized Tables](../../relational-databases/in-memory-oltp/introduction-to-memory-optimized-tables.md).
160
160
@@ -180,8 +180,6 @@ It is possible to cause information leakage through the use of carefully crafted
180
180
181
181
Create three user accounts that will demonstrate different access capabilities.
182
182
183
-
> [!NOTE]
184
-
> Azure SQL Data Warehouse doesn't support EXECUTE AS USER, so you must CREATE LOGIN for each user beforehand. Later, you will log in as the appropriate user to test this behavior.
185
183
186
184
```sql
187
185
CREATEUSERManager WITHOUT LOGIN;
@@ -268,10 +266,6 @@ EXECUTE AS USER = 'Manager';
268
266
SELECT*FROM Sales;
269
267
REVERT;
270
268
```
271
-
272
-
> [!NOTE]
273
-
> Azure SQL Data Warehouse doesn't support EXECUTE AS USER, so log in as the appropriate user to test the above behavior.
274
-
275
269
The Manager should see all six rows. The Sales1 and Sales2 users should only see their own sales.
276
270
277
271
Alter the security policy to disable the policy.
@@ -296,7 +290,7 @@ DROP FUNCTION Security.fn_securitypredicate;
296
290
DROPSCHEMA Security;
297
291
```
298
292
299
-
### <aname="external"></a> B. Scenarios for using Row Level Security on an Azure SQL Data Warehouse external table
293
+
### <aname="external"></a> B. Scenarios for using Row Level Security on an Azure Synapse external table
300
294
301
295
This short example creates three users and an external table with six rows. It then creates an inline table-valued function and a security policy for the external table. The example shows how select statements are filtered for the various users.
Create an Azure SQL Data Warehouse external table from the Sales table created.
337
+
Create an Azure Synapse external table from the Sales table created.
344
338
345
339
```sql
346
340
CREATE MASTER KEY ENCRYPTION BY PASSWORD ='somepassword';
@@ -389,7 +383,7 @@ WITH (STATE = OFF);
389
383
390
384
Now the Sales1 and Sales2 users can see all six rows.
391
385
392
-
Connect to the SQL Data Warehouse database to clean up resources
386
+
Connect to the Azure Synapse database to clean up resources
393
387
394
388
```sql
395
389
DROPUSER Sales1;
@@ -416,7 +410,7 @@ DROP LOGIN Manager;
416
410
### <aname="MidTier"></a> C. Scenario for users who connect to the database through a middle-tier application
417
411
418
412
> [!NOTE]
419
-
> In this example block predicates functionality isn't currently supported for Azure SQL Data Warehouse, hence inserting rows for the wrong user ID isn't blocked with Azure SQL Data Warehouse.
413
+
> In this example block predicates functionality isn't currently supported for Azure Synapse, hence inserting rows for the wrong user ID isn't blocked with Azure Synapse.
420
414
421
415
This example shows how a middle-tier application can implement connection filtering, where application users (or tenants) share the same [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] user (the application). The application sets the current application user ID in [SESSION_CONTEXT (Transact-SQL)](../../t-sql/functions/session-context-transact-sql.md) after connecting to the database, and then security policies transparently filter rows that shouldn't be visible to this ID, and also block the user from inserting rows for the wrong user ID. No other app changes are necessary.
0 commit comments