- ALTR Documentation
- Data Sources
- OLTP
- Create Policies
- Restrict Access to Repository Objects
Restrict Access to Repository Objects
Notice
Prerequisites:
SSO and SCIM have been configured
Repository and repository users have been created and registered to ALTR
Sidecar has been installed and registered to ALTR. Contact ALTR Support to get started.
The sidecar has been bound to the relevant repositories
By default, impersonation policies grant IdP users the same access as the repository user they impersonate. To further restrict access, you can create an access management policy to control which kinds of queries can run on specific objects within the repository.
AMP decisions for OLTP data sources are based entirely on the query text. The sidecar does not retain information about the database or schema a user is connected to. To ensure policies allow access, include the database and schema in your queries.
Note
In order to use DBeaver and all of it’s functionality, for each access management policy, you must create a separate rule each for READ, DELETE and UPDATED to grant access to a specific database object.
To create an access management policy:
Log into ALTR via Okta.
Click Policy in the Navigation menu.
Click Create Policy.
Locate the Access Management Policy card.
Click Create Policy.
Locate the Oracle card.
Click Create Policy.
Enter a Policy Name. This is a user-friendly name to identify the policy.
Enter a Data Source. This is the repository name exactly as it appears in Oracle.
Click Next.
Create the policy rule statement by selecting the following options:
user/group name that the policy affects, which is the individual user or group of users in Okta.
create, read, update or delete to determine the level of access of the schema object that the users with the selected role can access.
object type: database, schema, table/view or column to determine what kind of object the roles have access to. These fields are case sensitive; ensure they exactly match the names of the corresponding repository objects.
Define Object, which is the specific database, schema, table/view or column.
Note
When defining objects, either select specific object names or grant access to any object.
Click Save.
Edit an access management policy to revoke or grant additional access control.
To edit a policy:
Select Policy in the Navigation menu.
Expand the policy to edit.
Click Edit Policy.
Update the policy as needed.
Click Save.
Delete an access management policy to remove access to the specified schema objects. ALTR revokes the granted access from roles in the repository.
If two policies grant the same access to the same roles, deleting one of them doesn’t remove access because the remaining policy still grants it.
To delete a policy:
Log into ALTR via Okta.
Click Policy in the Navigation menu.
Expand the policy to delete.
Click Edit Policy.
Click Delete Policy; a modal displays to confirm.
Click Delete Policy.