SAS Scalable Performance Data Server 4.5, Administrator'S Manual

Page: 171 / 271

Delete All Column ACLs on a Table
This deletes all column ACLs on table KBIKE.
delete acl kbike._all_;
Delete All Column ACLs on All Tables
This deletes all column ACLs on all tables.
delete acl _all_._all_;
Delete a Catalog ACL
This deletes an ACL on the catalog RBIKE.
set acltype catalog;
delete acl rbike;
Delete a Generic ACL on Catalog Entries
This deletes a generic ACL on the catalog entries MYCAT.MY*.CATAMS.
set acltype catalog;
delete acl my
c=mycat
t=catams/generic;
Symbolic Substitution
SPD Server SQL supports symbolic substitution of the user's User ID using @SPDSUSR,
group using @SPDSGRP, and whether the user is ACL Special using @SPDSSPEC in
SQL queries. When the query is parsed, @SPDSUSR will be replaced by the User ID,
@SPDSGRP by the group, and @SPDSSPEC will be "true" if the user has ACL Special
privileges. The right hand side of symbolic substitution statements must be in all upper
case text. Consider the example, "@SPDSUSR" = "SOMEUSER".
Symbolic Substitution Row Level Security
A powerful use of symbolic substitution is deploying row level security on sensitive tables
that use views. Suppose there is a sensitive table that only certain users or groups can access.
The administrator can use symbolic substitution to create a single view to the table that
provides restricted access based on user ID or groups. The administrator could give
universal access to the view, but only users or groups that meet the symbolic substitution
constraints will see the rows.
For another example, imagine a table that contains sensitive information has one column
that contains group names or user IDs. The administrator can use symbolic substitution to
create a single view that allows users to access only the rows that contain his user ID or
group. The administrator could give universal access to the view, but each user or group
would be allowed to only see their user or group rows.
Symbolic Substitution Example
PROC SQL;
Symbolic Substitution Example
165