只有在存在过滤器过滤器的情况下才可以使用过滤器过滤器？

Question

我在SQL服务器上创建行级安全2014年

它能够丢弃过滤谓词上我的客户表是这样的：

ALTER SECURITY POLICY rls.tenantAccessPolicy 
    DROP FILTER PREDICATE ON dbo.Client, 
    DROP BLOCK PREDICATE ON dbo.Client 
GO 

但是，如果我连续两次执行该代码，我有错误

“安全策略'rls.tenantAccessPolicy'在表'dbo.Client'上不包含谓词。”

有没有一种方法可以在DROP存在时才删除它？

Answer 1

我找到了解决办法！我需要使用动态SQL才能工作，因为SECURITY POLICY关键字在SELECT之前执行，或者导致我的错误。

此代码只检查是否filter谓词是存在的，但因为我总是在同一时间加入filter和block，验证，我无所谓：

IF EXISTS(SELECT 1 
      FROM sys.security_predicates sp 
      WHERE sp.predicate_type = 0 -- filter_predicate 
       AND OBJECT_ID('rls.tenantAccessPolicy') = sp.object_id 
       AND sp.target_object_id = OBJECT_ID('dbo.Client')) 
BEGIN 
    DECLARE @Sql NVARCHAR(MAX); 

    SET @Sql = N'ALTER SECURITY POLICY rls.tenantAccessPolicy 
       DROP FILTER PREDICATE ON dbo.Client, 
       DROP BLOCK PREDICATE ON dbo.Client' 

    EXECUTE sp_executesql @Sql 
END 
ELSE 
BEGIN 
    SET @Sql = N'ALTER SECURITY POLICY rls.tenantAccessPolicy 
       ADD FILTER PREDICATE rls.fn_tenantAccessPredicateWithSuperUser(CompanyID) ON dbo.Client, 
       ADD BLOCK PREDICATE rls.fn_tenantAccessPredicateWithSuperUser(CompanyID) ON dbo.Client' 

    EXECUTE sp_executesql @Sql 
END 
GO 

Answer 2

我会使用的方法IF EXISTS和检查sys.security_predicates元数据表：

IF EXISTS(SELECT 1 
      FROM sys.security_predicates sp 
      WHERE sp.predicate_type = 0 -- filter_predicate 
      AND OBJECT_ID('rls.tenantAccessPolicy') = sp.object_id 
      AND sp.target_object_id = OBJECT_ID('dbo.Client')) 
BEGIN  
    ALTER SECURITY POLICY rls.tenantAccessPolicy 
     DROP FILTER PREDICATE ON dbo.Client; 
END; 
GO 

IF EXISTS(SELECT 1 
      FROM sys.security_predicates sp 
      WHERE sp.predicate_type = 1 -- block_predicate 
      AND OBJECT_ID('rls.tenantAccessPolicy') = sp.object_id 
      AND sp.target_object_id = OBJECT_ID('dbo.Client')) 
BEGIN 
    ALTER SECURITY POLICY rls.tenantAccessPolicy 
     DROP BLOCK PREDICATE ON dbo.Client;  
END; 
GO