__data-level-security-2-image-unique-image-unique

__data-level security

<h2>Installing the Custom Row Level Security Plugin</h2>
Installing the Server-Side Plugin
<ol>
<li>Download the plugin.</li>
<li>Enable the server-side plugin feature:
<ol>
<li>Open the Configuration Manager from your browser: <a href="https://documentation.sisense.com/latest/administration/system-settings/configmgr_linux.htm#gsc.tab=0">Linux</a> | <a href="https://documentation.sisense.com/latest/administration/system-settings/configmgr.htm#gsc.tab=0">Windows </a></li>
<li>Click the Sisense logo five times to display the full list of services configurations.</li>
<li>On the API-Gateway tab, enable serverSidePlugins.enabled. 
<img decoding="async" loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/custom-rls-enabled.png" alt="" width="903" height="367" /></li>
</ol>
</li>
<li>Place the “serverSidePlugin” folder content in the path specified under the API-Gateway serverSidePlugins.dirPath setting in the Configuration Manager.</li>
<li>Configure the Custom Row Level Security, as described below.</li>
<li>Restart Sisense services/ pods:
<ul>
<li>Linux: Restart the apigateway pod</li>
<li>Windows: Restart the Sisense services by clicking &#8220;Restart Services&#8221; in the Configuration Manager page.</li>
</ul>
</li>
</ol>
Configuring Custom Row Level Security
The configuration file is located in:
[server side plugin location]/Jaql/addDataSecurityLib/config.json 
<img decoding="async" loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/config-file.png" alt="" width="915" height="579" />
The Configuration Object Keys:
<ul>
<li>defaultEndpoint: String. Data Security Service URL. 
The URL can be provided with parameters based on the request information, for example: 
{origin.protocol}://{origin.host}:{origin.port}/secure/. 
http://{origin.host}:3000/secure/ 
/secure/ &#8211; a static route addition to the Data Secure Service. 
Using the origin information, you can define a dynamic security service endpoint based on the request origin. 
If a default endpoint is set, security rules will be applied for all cubes that do not have an explicit security endpoint set in the cubesEndpoint collection.</li>
<li>passEntireRequestBody Boolean. If set to true, interceptors will send the whole body and request headers to the data security endpoint.</li>
<li>defaultEndpointHeaders Object. Key-value pairs of the default headers that are added to the data security REST API request. If not needed, keep the object empty.</li>
<li>cubesEndpoint Array. Contains the Data Security endpoints and headers that the given cubes will get the Data Security rules from. This array is used to decide which Data Security endpoint is triggered for the given JAQL query. 
Data Security configuration object keys:
<ul>
<li>cubes: Array of full cube name: [address/cube title] (mandatory).</li>
<li>endpoint: String (mandatory). The data security endpoint for the cube.</li>
<li>endpointHeaders: Object (optional). Key-value pairs of the headers that are added to the data security endpoint that is listed above.</li>
</ul>
</li>
</ul>
Note: The configured security endpoints should be implemented by the client.
Creating a Data Security Rules Service
The Custom Row Level security checks for each query of the data source. Based on the configuration, it sends a query to the configured Data Security Rules endpoint.
The request is sent with some URL parameters:
<ul>
<li>user &#8211; The user email</li>
<li>role &#8211; User role name</li>
<li>cube &#8211; The full ElastiCube name</li>
<li>groups &#8211; User group IDs</li>
</ul>
In addition, if specified, some headers are added to the query.
The endpoint returns an object with three keys:
<ul>
<li>rules: Array of data security rules, as described below</li>
<li>includeAll: Boolean (optional). When set to true, the user can see all of the ElastiCube data.</li>
<li>excludeAll: Boolean (optional). When set to true, the user cannot access the ElastiCube data.</li>
</ul>
Note: If includeAll or excludeAll are specified, the rules are not taken into account.
The rules array contains objects that describe the data security for a user, group, or role:
<ul>
<li>dim: String (optional). The data security dimension</li>
<li>members: Array of the members that the user should see (optional). When specified the members of the dimension must be set</li>
</ul>
Return value example:
<img decoding="async" loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/return-value-example.png" alt="" width="381" height="246" />
Notes:
<ul>
<li>In case a user/role/group has more than one data security rule for an ElastiCube, the priority is:
<ol>
<li>Exclude all</li>
<li>Include all</li>
<li>Members &#8211; union between all members settings</li>
</ol>
</li>
<li>After every change made to the server-side plugin configuration file, restart the Sisense.Gateway service</li>
<li>After every system upgrade, run the installation.bat file with Administrator rights</li>
<li>The data security fields are validated against the ElastiCube. If there is even one field that does not exist in the ElastiCube, the user will not be able to see the ElastiCubedata</li>
<li>If the user/role/group does not have data security applied to an ElastiCube, the user will not see any data</li>
<li>If an ElastiCube does not have an endpoint configured in the server side plugin configuration plugin, the ElastiCube will use the Sisense default data security</li>
<li>ElastiCubesets are supported</li>
</ul>

Data Security

data security

Security

The Custom Row-Level Security plugin applies custom data security for users by querying a remote service.
You can use the Custom Row-Level Security plugin if you have dynamic data security that changes frequently (every few minutes).
On every data query sent to the Sisense server, the Sisense server first sends an HTTP/HTTPS request to a security endpoint to get the updated data security for the logged-in user. The security rules are applied to the query so that the query is processed with the new data security rules.
Important Note: The security endpoint should be implemented by the client and should return the data security rules in the expected format.
Use Case:
A company has a real-time product with complex data security rules. The security rules are saved in a database and are changed often, based on new data that comes in.
Since the company already maintains complex data security rules on their system, they would like to avoid maintaining it twice &#8211; once in their database and once in Sisense. In addition, since their data security is changed so often, they want to be assured that the Sisense security rules are always up-to-date.
Using Custom Row Level Security, they can use their existing security database, and make sure the security rules are always up-to-date.

Get the Add-on

Leave Feedback