Restrict Access to Repository Objects

An Access Management Policy on an OLTP repository controls which kinds of queries a user or group can run against specific objects in the repository. This complements an Impersonation Policy, which by default grants a data consumer (the end user connecting to the repository) the same access as the repository user they impersonate — an Access Management Policy narrows that access to specific objects and query types.

Prerequisites

• The repository and its repository users are registered to ALTR.
• The sidecar is installed and registered to ALTR, and bound to the relevant repositories.

ALTR relies on query parsing to identify accessed objects; support for all query types is not guaranteed. For the query-parsing limitations this creates — why the sidecar can’t retain database or schema context, and how that affects query qualification — see Access Management Policy with Sidecars.

Create an Access Management Policy

To create an Access Management Policy:

1. Log in to ALTR through your identity provider (IdP).
2. Click Policy in the navigation menu.
3. Click Create Policy.
4. Locate the Control access to repository data card and click Create Policy.
5. Locate the card for your database and click Create Policy.
6. Enter a Policy Name to identify the policy.
7. Select the Data Source — the repository name as registered in ALTR.
8. Click Next.
9. Build the rule statement:
   1. Enter either a username or an IdP group name — the individual user or group as configured in your IdP that the policy affects.
   2. Select create, read, update, or delete to set the level of access the selected user or group has to the object.
   3. Select the object type the rule covers — database, schema, table, or column (MySQL repositories don’t have a schema level, so table and database are adjacent).
   4. Enter Define Object — the name of the specific object. Object names are case-sensitive; enter the name using the same case your database engine uses when the object is referenced unquoted in a query.
10. Click Save.

Edit an Access Management Policy

To edit a policy:

1. Click Policy in the navigation menu.
2. Expand the policy to edit.
3. Click Edit Policy.
4. Update the policy as needed.
5. Click Save.

Delete an Access Management Policy

Note

If two policies grant the same access to the same user or group, deleting one doesn’t remove that access — the remaining policy still grants it.

To delete a policy:

1. Click Policy in the navigation menu.
2. Expand the policy to delete.
3. Click Edit Policy.
4. Click Delete Policy; a modal displays to confirm.
5. Click Delete Policy.