Row level access control

[RajD]

Hi guys,

Is there a way in sybase I can limit access to rows in certain/all tables based on the login-id?

I believe there is a way in Oracle( I just heard. Never used Oracle) something called context which can be used to satisfy this.

Well, the requirement is:
We are managing a database for almost 3 years for a client's business/data as a third-party vendor. Now the client split in two major groups and wants to restrict access to its employees. Group A should have access to Group-A data and Group-B only to Group-B. But at the same time the corporate users wants to have access to both the groups(as it used to be so far).

Currently we are working with Sybase 11.9.2 and possibly go for ASE 12.0. Very difficult to go for ASE 12.5.x.

Partitioning the database in two or more databases and redesining the application is certainly one way of doing it.

Is there a way we can do it at the back-end without creating ripples on the front-end(or may be with minimal changes)

Any help would be appreciated, and ask me if you need to know more specific facts.

thanks,

Raj
RajD

 

[sybaseguru]

Raj,

Just a quick respose

Option 1)Create views based on these tables. Say two views for each group based upon selection criteria. You then create two groups in the database and assign login to each group based upon their business need and then grant permission on the views to each group. The drawback is that you have to modify the application to access views as opposed to tables.

Option 2) create two additional databases plus the main one as it stands. In each new database create view based uopon the table in the main database with the same name as the table name in the main database. Group A will always access database A and group B will access database B. Power users will access the main database tables directly. In either case some work is involved. I prefer option 2 because it allows you to drop and recreate views easily. If I come across other ideas will let you know.

If you have any question come back,

good luck,

Mich