Impersonation Policy

An Impersonation Policy lets multiple users share a database login without sharing its credentials. The policy maps identity provider (IdP) users and groups to database repository users. Impersonation applies to OLTP data sources connected through the ALTR sidecar.

In this section

• Allow Access to a Repository — Create an Impersonation Policy that maps IdP users or groups to repository users.

How Impersonation Works

Each rule in an Impersonation Policy maps an IdP user or IdP group to a database repository user — for example, the IdP group data-engineering maps to the database user de_service_account, while the IdP user jane.doe@company.com maps to jane_readonly.

When a user connects:

1. The user authenticates through SSO and generates a temporary token.
2. The user connects to the database through the sidecar using the token.
3. The Impersonation Policy determines which repository user’s credentials to use, and the sidecar connects to the database as that user.

The connection then carries the mapped repository user’s native database permissions. The mapping is transparent: the connecting application sees a normal database connection, and no action is required from the user beyond signing in.

IdP Groups

ALTR acquires a user’s IdP groups when the user authenticates through SSO, and your SSO configuration must send groups to ALTR for group-based rules to match. If a user’s groups change in the IdP, the user must log out and back in for ALTR to acquire the updated groups.

Prerequisites

• SSO configured for your organization; IdP groups sent to ALTR if you use group-based rules. See SSO and SCIM.
• Connecting users provisioned as data consumers through System for Cross-domain Identity Management (SCIM).

Create an Impersonation Policy

See Allow Access to a Repository for the creation procedure; to connect through the policy, see Connect through Impersonation.