- ALTR Documentation
- Data Sources
- OLTP
- Create Policies
- Restrict Access to Repository Objects
Restrict Access to Repository Objects
Notice
Prerequisites:
SSO and SCIM have been configured
Repository and repository users have been created and registered to ALTR
Sidecar has been deployed and registered to ALTR
The sidecar has been bound to the relevant repositories
By default, impersonation policies grant IdP users the same access as the repository user they impersonate. To further restrict access, you can create an access management policy to control which kinds of queries can run on specific objects within the repository.
Note
In order to use DBeaver and all of it’s functionality, for each access management policy, you must create a separate rule each for READ, DELETE and UPDATED to grant access to a specific database object.
To create an access management policy:
Log into ALTR via Okta.
Click Policy in the Navigation menu.
Click Create Policy.
Locate the Access Management Policy card.
Click Create Policy.
Locate the Oracle card.
Click Create Policy.
Enter a Policy Name. This is a user-friendly name to identify the policy.
Enter a Data Source. This is the repository name exactly as it appears in Oracle.
Click Next.
Create the policy rule statement by selecting the following options:
user/group name that the policy affects, which is the individual user or group of users in Okta.
create, read, update or delete to determine the level of access of the schema object that the users with the selected role can access.
object type: database, schema, table/view or column to determine what kind of object the roles have access to. These fields are case sensitive; ensure they exactly match the names of the corresponding repository objects.
Database Object, which is the specific database, schema, table/view or column.
Click Save.
Delete an access management policy to remove access to the specified schema objects. ALTR revokes the granted access from roles in the repository.
If two policies grant the same access to the same roles, deleting one of them doesn’t remove access because the remaining policy still grants it.
To delete a policy:
Log into ALTR via Okta.
Click Policy in the Navigation menu.
Click the Access Management tab.
Expand the policy to delete.
Click View Policy.
Click Delete Policy; a modal displays to confirm.
Click Delete Policy.