System-Level Privileges for Row-Level Security - Teradata Vantage

Teradata® VantageCloud Lake
Deployment
VantageCloud
Edition
Lake
Product
Teradata Vantage
Published
January 2023
Language
English (United States)
Last Update
2024-04-03
dita:mapPath
phg1621910019905.ditamap
dita:ditavalPath
pny1626732985837.ditaval
dita:id
phg1621910019905

Administrators can grant system-level privileges to users or profiles for the purpose of establishing and maintaining row-level security.

These privileges enable users to:
  • Create row-level security constraints using SQL requests.
  • Define row-level security constraints on tables using SQL requests.
  • Assign row-level security constraint values (security credentials) to users and profiles using SQL requests.
The privileges are as follows:

See the section on the DBC.AccessRights table in AccessRight Column for a list of the two-character abbreviations for these privileges.

CONSTRAINT ASSIGNMENT Privilege

This system-wide privilege enables users to define row-level security constraints on tables and to assign row-level security constraint values to users and profiles using SQL DDL statements. Administrators can grant this privilege to individual users or to profiles.

Vantage automatically grants this privilege to user DBC WITH GRANT OPTION, which enables user DBC to grant this privilege to any other user or role.

The rules and restrictions for granting the CONSTRAINT ASSIGNMENT privilege are as follows:
  • You can only grant CONSTRAINT ASSIGNMENT to another user or role if you also have the WITH GRANT OPTION privilege.
  • You cannot specify a target database object.
  • You cannot grant CONSTRAINT ASSIGNMENT to PUBLIC.
You must have the CONSTRAINT ASSIGNMENT privilege to use these SQL DDL statements on tables that have row-level security constraints or users and profiles that have security credentials assigned to them. These statements can be used on users or profiles that do not have security credentials assigned to them.
  • ALTER TABLE
  • CREATE PROFILE
  • CREATE TABLE
  • CREATE USER
  • MODIFY PROFILE
  • MODIFY USER
  • SHOW CONSTRAINT

    The CONSTRAINT DEFINITION privilege also enables you to run a SHOW CONSTRAINT request.

CONSTRAINT DEFINITION Privilege

This system-wide privilege enables users to create and modify row-level security constraints using SQL DDL statements. Administrators can grant this privilege to individual users or to roles.

Vantage automatically grants this privilege to user DBC WITH GRANT OPTION, which enables user DBC to grant this privilege to any other user or role.

The rules and restrictions for granting the CONSTRAINT DEFINITION privilege are as follows:
  • You can only grant CONSTRAINT DEFINITION to another user or role if you also have the WITH GRANT OPTION privilege.
  • You cannot specify a target database object.
  • You cannot grant CONSTRAINT DEFINITION to PUBLIC.
You must have the CONSTRAINT DEFINITION privilege to use the following SQL DDL statements to create, modify, or SHOW row-level security constraints:
  • ALTER CONSTRAINT
  • CREATE CONSTRAINT
  • DROP CONSTRAINT
  • SHOW CONSTRAINT

    The CONSTRAINT ASSIGNMENT privilege also enables you to run a SHOW CONSTRAINT request.