EXT_AUTHORIZER_EXPLAIN stored procedure in Data Virtualization

Authorization

Copy link to section

To run the EXT_AUTHORIZER_EXPLAIN procedure, you must be a Data Virtualization Manager. For more information, see Managing roles for users in Data Virtualization.

Input parameters

Copy link to section

SCHEMA_NAME

The type of this required parameter is VARCHAR(128). Specifies the schema of the evaluated object.

OBJECT_NAME

The type of this required parameter is VARCHAR(128). Specifies the name of the evaluated object.

USERNAME

The type of this required parameter is VARCHAR(128). Specifies the Data Virtualization user ID of the user to evaluate the object against.

Output parameters

Copy link to section

AUTHORIZER_EXPLAIN

The type of this parameter is VARCHAR(32672). The explanation of the evaluation result in JSON format.

Output property names

Copy link to section

Refer to the following table for an explanation of each property name that you might encounter in the output.

Syntax

Copy link to section

CALL DVSYS.EXT_AUTHORIZER_EXPLAIN('<SCHEMA_NAME>', '<OBJECT_NAME>', '<USERNAME>', ?);
Copy to clipboardCopied to clipboard

Examples

Copy link to section

The following two examples demonstrate what happens when you use this stored procedure on Data Virtualization objects that have row filtering and column masking (obfuscation) rules applied.

Row filtering rule applies to an object

To evaluate the virtual table MY_TABLE in schema MY_SCHEMA for user USER1, run the following SQL statement:

CALL DVSYS.EXT_AUTHORIZER_EXPLAIN('MY_SCHEMA', 'MY_TABLE', 'USER1', ?);
Copy to clipboardCopied to clipboard

For an object with a row filtering rule applicable, the output might look like the following example:

 Value of output parameters
  --------------------------
  Parameter name  : AUTHORIZER_EXPLAIN
  Parameter value : {"IKC":{"resource_key":"1ed88d5b-148e-49c5-85a3-000000000000:/MY_SCHEMA/MY_TABLE","evaluation_outcome":"Transform","governance_convention":"AEAD",asset_id":"9cb85f03-100a-4bd5-8275-000000000000","container":{"id":"753b9703-4f82-4552-9906-000000000000","name":"Default"},"is_cached":false,"user_id":"0000000000","rules":[{"id":"297d03ad-be3f-43c3-b534-000000000000","name":"Table RoLE normal"},{"id":"b140d918-9ca8-4356-86c2-000000000000","name":"Table RoLE fail"}],"transform_spec":[{"operation_type":"research/include_rows_ref","parameters":[{"predicate":[["$$source.MY_TABLE_ID","=","$$references[0].MY_TABLE_ID"]],"references":[{"catalog_id":"753b9703-4f82-4552-9906-000000000000","asset_id":"b1d5fdd1-5ae4-45c5-b1b3-000000000000","resource_key":"1ed88d5b-148e-49c5-85a3-000000000000:/MY_SCHEMA/MY_TABLE"}]}]}]}}s_ref","parameters":[{"predicate":[["$$source.MY_TABLE_ID","=","$$references[0].TABLE_ID"]],"references":[{"catalog_id":"753b9703-4f82-4552-9906-000000000000","asset_id":"b1d5fdd1-5ae4-45c5-b1b3-000000000000","resource_key":"1ed88d5b-148e-49c5-85a3-000000000000:/MY_SCHEMA/MY_TABLE"}]}]}]}}

Column masking rule applies to an object

To evaluate the virtual table MY_TABLE_MASK in schema MY_SCHEMA for user USER1, run the following SQL command:

CALL DVSYS.EXT_AUTHORIZER_EXPLAIN('MY_SCHEMA', 'MY_TABLE_MASK', 'USER1', ?);
Copy to clipboardCopied to clipboard

For an object that has two column masking rules that are applied, the output might look like the following example:

Value of output parameters
  --------------------------
  Parameter name  : AUTHORIZER_EXPLAIN
  Parameter value : {"IKC":{"resource_key":"1ed88d5b-148e-49c5-85a3-000000000000:/MY_SCHEMA/MY_TABLE_MASK","evaluation_outcome":"Transform","governance_convention":"AEAD","asset_id":"f11f6916-dc49-4838-869a-000000000000","container":{"id":"753b9703-4f82-4552-9906-000000000000","name":"Default"},"is_cached":false,"user_id":"000000000000","rules":[{"id":"e4de009b-ea72-4bc2-b70c-000000000000","name":"Name mask"},{"id":"275e2e1b-4d13-4d91-939d-000000000000","name":"Redact first name"}],"transform_spec":[{"operation_type":"research/pseudo","parameters":[{"salt":"034f0be01d66800028a7fb5069e1b5f59b3c876ba3c2d00436db09b3e0e50072","dataclass":"LastName","maskingType":"Full","name":"LAST_NAME","preserveFormat":"true","maskingProcessor":"FormatPreservingTokenization"}],"profiled_dataclass":"LastName"},{"operation_type":"research/pseudo-pretty","parameters":[{"maskingChar":"X","maskingType":"Full","name":"FIRST_NAME","preserveFormat":"false","maskingLen":"10"}],"profiled_dataclass":"FirstName"}]}}

In this example, the transform_spec indicates that the outcome of the evaluation resulted in masking two columns:

1. LAST_NAME column is masked with format-preserving obfuscation.
2. FIRST_NAME column is masked with full redaction, or ten X characters.

"transform_spec": [{
			"operation_type": "research/pseudo",
			"parameters": [{
				"salt": "000f0be01d6680b62007fb5069e1b0009b3c876ba000d65006db09b3e0e50072",
				"dataclass": "LastName",
				"maskingType": "Full",
				"name": "LAST_NAME",
				"preserveFormat": "true",
				"maskingProcessor": "FormatPreservingTokenization"
			}],
			"profiled_dataclass": "LastName"
		}, {
			"operation_type": "research/pseudo-pretty",
			"parameters": [{
				"maskingChar": "X",
				"maskingType": "Full",
				"name": "FIRST_NAME",
				"preserveFormat": "false",
				"maskingLen": "10"
			}],
			"profiled_dataclass": "FirstName"
		}]
Show more