Configuring row-level access control
About this task
Row-level access control (RLAC) enforces authorization policies to data within a table by matching a filter, such as a user or company name, applied to a text-based partition key. RLAC provides more granular security for tables so that only authorized users can view or modify subsets of the data. The RLAC feature is useful for multi-tenant applications.
Enable row-level access control in LCM for DSE clusters that have tables with row-level permissions required for access. Follow these steps to make Lifecycle Manager (LCM) aware of and allow use of RLAC configured for DataStax Enterprise (DSE) clusters provisioned and managed by LCM.
Procedure
-
Click Config Profiles from the Lifecycle Manager navigation menu.
-
Click the edit icon for the configuration profile to edit, or click Add config profile if you have not already created a profile.
-
In the Config Profile pane under the Cassandra section, select cassandra.yaml.
-
In the Security pane, verify the following selections:
-
Ensure that the authenticator setting is DseAuthenticator.
-
Ensure that the authorizer setting is DseAuthorizer.
-
-
In the Config Profile pane under the Cassandra section, select dse.yaml.
-
Scroll to the DSE Authorizer Options pane and make the following selections:
-
Select enabled for authorization options.
-
Select allow_row_level_security.
-
-
Click Save to save the Config Profile.
What’s next
-
Go to the Clusters workspace in Lifecycle Manager and select the configuration profile to apply at the cluster, datacenter, or node level. Nodes can inherit configuration profile settings from the cluster or datacenter levels, or have settings at the node level that take precedence.
-
Run a configuration job to push the configuration to all applicable nodes.
-
Restrict the applicable tables rows and grant permissions to the applicable role names using
GRANTorREVOKEstatements as required for your environment. For details and an example, see Setting up Row Level Access Control (RLAC). -
Log in as each user role and run queries to confirm that results represent your defined access permissions.
