SQL Server 行级安全性不适用于异常 [已关闭]

Question

我正在尝试使用以下函数在表上实现 RLS。我还有另一个表

UserAccess

来控制谁可以访问数据表 (

RLS_Data

)。以下功能完美运行。

CREATE FUNCTION rls.fn_Data_Predicate
         (@DataProviderID AS INT, @TableName sysname)
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN
(
    SELECT 1 as Result
    FROM [fin].[RLS_Data] d
    INNER JOIN [stg].[UserAccess] e ON e.DataProviderId = d.DataProviderID
    WHERE d.DataProviderID = @DataProviderID
        AND e.[User Email] = CURRENT_USER
        AND e.TableName = @TableName 
        AND e.isAuthorized = 1
);

当用户将

isAdmin

设置为 True 时，我希望 JOIN 忽略任何其他列的匹配。仅当用户

isAdmin

为 False 时，才会发生其他列匹配。

内连接仅适用于对数据表具有只读访问权限的人类用户

UserAccess

。所以我尝试以下

SELECT 1 as Result
FROM [fin].[RLS_Data] d
INNER JOIN [stg].[UserAccess] e ON e.DataProviderId = d.DataProviderID
WHERE e.[User Email] = CURRENT_USER 
    AND ( e.isAdmin = 1 
        OR (d.DataProviderID = @DataProviderID
            AND e.TableName = @TableName  
            AND e.isAuthorized = 1
            )
        )

如果用户将

isAdmin

设置为 true，这仍然不会返回所有数据。

Answer 1

您可以将连接更改为

EXISTS

或

IN

，然后将其与

OR

组合到您的

IsAdmin

列上。

CREATE OR ALTER FUNCTION rls.fn_Data_Predicate (
  @DataProviderID INT,
  @TableName sysname
)
RETURNS TABLE
WITH SCHEMABINDING
AS RETURN
(
    SELECT 1 AS Result
    FROM stg.UserAccess e
    WHERE e.[User Email] = System_USER
      AND e.TableName = @TableName 
      AND e.isAuthorized = 1
      AND (
          e.IsAdmin = 1
          OR e.DataProviderId IN (
            SELECT d.DataProviderID
            FROM fin.RLS_Data d
            WHERE d.DataProviderID = @DataProviderID
          )
      )
);