OLTP
By default, impersonation policies grant IdP users the same access as the repository user they impersonate. To further restrict access, you can create an access management policy to control which kinds of queries can run on specific objects within the repository.
Access management decisions for OLTP data sources are based entirely on the query text. The sidecar does not retain information about the database or schema a user is connected to. To ensure policies allow access, include the database and schema in your queries.
Note
In order to use DBeaver and all of it’s functionality, for each access management policy, you must create a separate rule each for READ, DELETE and UPDATED to grant access to a specific database object.
To create an access management policy:
Log into ALTR via Okta.
Click Policy in the Navigation menu.
Click Create Policy.
Locate the Access Management Policy card.
Click Create Policy.
Locate the card for your database.
Click Create Policy.
Enter a Policy Name. This is a user-friendly name to identify the policy.
Select a Data Source. This is the repository name exactly as it appears in the database.
Click Next.
Create the policy rule statement by selecting the following options:
user/group name that the policy affects, which is the individual user or group of users in Okta.
create, read, update or delete to determine the level of access of the schema object that the users with the selected role can access.
object type: determine what kind of object the roles have access to. These fields are case sensitive; ensure they exactly match the names of the corresponding repository objects.
Define Object, which is the name of the specific object type.
Note
When defining objects, either select specific object names or grant access to any object.
Click Save.
Edit an access management policy to revoke or grant additional access control.
To edit a policy:
Select Policy in the Navigation menu.
Expand the policy to edit.
Click Edit Policy.
Update the policy as needed.
Click Save.
Delete an access management policy to remove access to the specified schema objects. ALTR revokes the granted access from roles in the repository.
If two policies grant the same access to the same roles, deleting one of them doesn’t remove access because the remaining policy still grants it.
To delete a policy:
Log into ALTR via Okta.
Click Policy in the Navigation menu.
Expand the policy to delete.
Click Edit Policy.
Click Delete Policy; a modal displays to confirm.
Click Delete Policy.