Securing your PersisTable Data
In the last post, we described the integration of PersisTables with SQLServer. The SQLPersisTables protocol supports a security model to control who can see and update data within Genres. This is an optional extra and if it is not installed, the standard behaviour is available, users can create new Genres, read, write and update PersisTables held within the SQLServer Arena.
The security package can provide control over who can see, read and write PersisTables in a Genre and manage access to Genres. The control is managed through 4 group roles (a 5th is available to remove unwanted data). A user must be added to one or more of the roles to interact with the PersisTables data. The tk_admin role allows members to specify the owners of Genres, a Genre cannot be created without specifying a user who is a member of the tk_owner role. It is up to the owner to specify who can read and write to the Genre and who else can be an owner. Access to a Genre is defined by the less permissive of the user’s group role and the role assigned to the user within the Genre.
Management of the roles are handled within the Arena Manager screen which has been updated with a Security option. This is only enabled for SQL Server Arenas that have the security package installed. for more details contact us directly.
The Security option is only available for Arenas that have Security capabilities and to users who are members of the tk_admin or tk_owner role.
Clicking the Security button opens the Security maintenance screen.
The Security dialog allows tk_admin users to create new Genres and manage users within a Genre. Users added to a Genre are assigned a role within the Genre, tk_owners can add or remove users, including adding other owners, tk_write users can write to the Genre (as can owners) and tk_read users can only read from the Genre. Note that the role a user has does not have to match their database role, however the ability to access and update a Genre is limited to the minimum of their database role and Genre role. This means a user who is a tk_owner can be assigned tk_read permissions within a Genre and is only permitted to read data.
The separation of admin and owner rights means that a Genre needs to be created in advance of use. The Security dialog allows new Genre’s to be created. Note that the only way a Genre can be created ‘on the fly’ is by a user who is both assigned both the tk_admin and the tk_owner database roles.