- PrivaceraCloud Release 7.4
- Enhancements and updates in PrivaceraCloud release 7.4
- Known Issues in PrivaceraCloud 7.4
- PrivaceraCloud User Guide
- Overview of PrivaceraCloud
- Connect applications with the setup wizard
- Connect applications
- About applications
- Connect Azure Data Lake Storage Gen 2 (ADLS) to PrivaceraCloud
- Connect Amazon Textract to PrivaceraCloud
- Athena
- Privacera Discovery with Cassandra
- Connect Databricks to PrivaceraCloud
- Databricks SQL
- Databricks SQL Overview and Configuration
- Planning and general process
- Prerequisites
- Databricks SQL with Privacera Hive
- Connect Databricks SQL application
- Grant Databricks SQL permissions to PrivaceraCloud users
- Define a resource policy
- Test the policy
- Databricks SQL PolicySync fields
- Configuring column-level access control
- View-based masking functions and row-level filtering
- Create an endpoint in Databricks SQL
- Databricks SQL Fields
- Databricks SQL Hive Service Definition
- Databricks SQL Masking Functions
- Databricks SQL Encryption
- Use a custom policy repository with Databricks
- Connect Databricks SQL to Hive policy repository on PrivaceraCloud
- Databricks SQL Overview and Configuration
- Connect Databricks Unity Catalog to PrivaceraCloud
- Connect S3 to PrivaceraCloud
- Prerequisites in AWS console
- Connect S3 application to PrivaceraCloud
- Enable Privacera Access Management for S3
- Enable Data Discovery for S3
- S3 AWS Commands - Ranger Permission Mapping
- S3
- AWS Access with IAM
- Access AWS S3 buckets from multiple AWS accounts
- Add UserInfo in S3 Requests sent via Dataserver
- Control access to S3 buckets with AWS Lambda function on PrivaceraCloud
- Dremio Plugin
- DynamoDB
- Connect Elastic MapReduce from Amazon application to PrivaceraCloud
- Connect EMR application
- EMR Spark access control types
- PrivaceraCloud configuration
- AWS IAM roles using CloudFormation setup
- Create a security configuration
- Create EMR cluster
- How to configure multiple JSON Web Tokens (JWTs) for EMR
- EMR Native Ranger Integration with PrivaceraCloud
- Connect EMRFS S3 to PrivaceraCloud
- Files
- GBQ
- Google Cloud Storage
- Connect Glue to PrivaceraCloud
- Google BigQuery for PolicySync
- Connect Kinesis to PrivaceraCloud
- Connect Lambda to PrivaceraCloud
- Microsoft SQL Server
- MySQL for Discovery
- Open Source Apache Spark
- Oracle for Discovery
- PostgreSQL
- Connect Power BI to PrivaceraCloud
- Presto
- Redshift
- Snowflake
- Starburst Enterprise with PrivaceraCloud
- Starburst Enterprise Presto
- Trino
- Connect users
- Data access Users, Groups, and Roles
- UserSync
- Portal user LDAP/AD
- Datasource
- Okta Setup for SAML-SSO
- Azure AD setup
- SCIM Server User-Provisioning
- User Management
- Identity
- Access Manager
- Access Manager
- Resource Policies
- Tag Policies
- Scheme Policies
- Service Explorer
- Reports
- Audit
- About data access users, groups, and roles resource policies
- Security zones
- Discovery
- Classifications via random sampling
- Privacera Discovery scan targets
- Propagate Privacera Discovery Tags to Ranger
- Enable offline scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Real-time Scanning of S3 Buckets
- Enable Real-time Scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Discovery Realtime Scanning Using IAM Role
- Encryption
- Overview of Privacera Encryption
- Encryption schemes
- Presentation schemes
- Masking schemes
- Create scheme policies
- Privacera-supplied encryption schemes for the Privacera API
- Privacera-supplied encryption schemes for the Bouncy Castle API
- API date input formats
- Deprecated encryption formats, algorithms, and scopes
- Privacera Encryption REST API
- PEG API endpoint
- PEG REST API encryption endpoints
- Prerequisites
- Common PEG REST API fields
- Construct the datalist for the /protect endpoint
- Deconstruct the response from the /unprotect endpoint
- Example data transformation with the /unprotect endpoint and presentation scheme
- Example PEG API endpoints
- Make encryption API calls on behalf of another user
- Privacera Encryption UDF for masking in Databricks on PrivaceraCloud
- Privacera Encryption UDFs for Trino on PrivaceraCloud
- Syntax of Privacera Encryption UDFs for Trino
- Prerequisites for installing Privacera Crypto plug-in for Trino
- Download and install Privacera Crypto jar
- Set variables in Trino etc/crypto.properties
- Restart Trino to register the Privacera encryption and masking UDFs for Trino
- Example queries to verify Privacera-supplied UDFs
- Privacera Encryption UDF for masking in Trino on PrivaceraCloud
- Encryption UDFs for Apache Spark on PrivaceraCloud
- Launch Pad
- Settings
- Dashboard
- Usage statistics
- Operational status of PrivaceraCloud and RSS feed
- How to Get Support
- Coordinated Vulnerability Disclosure (CVD) Program of Privacera
- Shared Security Model
- PrivaceraCloud Previews
- Preview: File Explorer for S3
- Preview: File Explorer for Azure
- Preview: File Explorer for GCS
- Preview: Scan Generic Records with NER Model
- Preview: Scan Electronic Health Records with NER Model
- Preview: OneLogin setup for SAML-SSO
- Preview: Azure Active Directory SCIM Server UserSync
- Preview: OneLogin UserSync
- Preview: PingFederate UserSync
- Quickstart for Databricks Unity Catalog on PrivaceraCloud
- What do I need to do in my Databricks Workspace?
- Where is the sample dataset in my Databricks Workspace?
- What should I do in the PrivaceraCloud web portal?
- Access use-case - How do I give a user access to a table or restrict from running a SQL select query?
- Access use-case - How do I restrict a user from seeing contents of a column in the result of a SQL select query?
- Column masking use-case - How do I restrict a user from seeing contents of a column by masking the values in the result of a SQL select query?
- Access use-case - How do I disallow a user from seeing certain rows of a table?
- PrivaceraCloud documentation changelog
Microsoft SQL Server
This topic describes how to connect Microsoft SQL (MS SQL) application to PrivaceraCloud.
Connect MS SQL application
Go the Setting > Applications.
In the Applications screen, select MS SQL.
Enter the application Name and Description, and then click Save.
You can see Access Management and Data Discovery with toggle buttons.
Note
If you don't see Data Discovery in your application, enable it in Settings > Account > Discovery. For more information, see Discovery.
Enable Access Management for MS SQL
Click the toggle button to enable Access Management for MS SQL.
In the BASIC tab, enter the values in the give fields and click Save. For property details and description, see table below:
Note
Make sure that the other properties are advanced and should be modified in consultation with Privacera.
Basic fields
Table 12. Basic fieldsField name
Type
Default
Required
Description
MSSQL JDBC URL
string
Yes
Specifies the JDBC URL for the Microsoft SQL Server connector.
Use the following format for the JDBC string:
jdbc:sqlserver://<JDBC_SQLSERVER_URL_WITH_PORT_NUMBER>
MSSQL jdbc username
string
Yes
Specifies the JDBC username to use.
MSSQL jdbc password
string
Yes
Specifies the JDBC password to use.
MSSQL master database
string
master
Yes
Specifies the name of the JDBC master database that PolicySync establishes an initial connection to.
MSSQL authentication type for the database engine
string
SqlPassword
Yes
Specifies the authentication type for the database engine. The following types are supported:
If the user specified by MSSQL jdbc username is a local user, specify:
SqlPassword
If the user specified by MSSQL jdbc username is a Microsoft Azure Active Directory user, specify:
ActiveDirectoryPassword
Default password for new mssql user
string
Yes
Specifies the password to use when PolicySync creates new users.
MSSQL resource owner
string
No
Specifies the role that owns the resources managed by PolicySync. You must ensure that this user exists as PolicySync does not create this user.
If a value is not specified, resources are owned by the creating user. In this case, the owner of the resource will have all access to the resource.
If a value is specified, the owner of the resource will be changed to the specified value.
The following resource types are supported:
Database
Schemas
Tables
Views
Enable policy enforcements and user/group/role management
boolean
true
Yes
Specifies whether PolicySync performs grants and revokes for access control and creates, updates, and deletes queries for users, groups, and roles. The default value is
true
.Enable access audits
boolean
false
Yes
Specifies whether Privacera fetches access audit data from the data source.
If specified, you must specify a value for the MSSQL Audits storage URL setting.
MSSQL Audits storage URL
string
No
Specifies the URL for the audit logs provided by the Azure SQL Auditing service. For example:
https://test.blob.core.windows.net/sqldbauditlogs/test
Advanced fields
Table 13. Advanced fieldsField name
Type
Default
Required
Description
Databases to set access control policies
string
No
Specifies a comma-separated list of database names for which PolicySync manages access control. If unset, access control is managed for all databases. If specified, use the following format. You can use wildcards. Names are case-sensitive.
An example list of databases might resemble the following:
testdb1,testdb2,sales db*
.If specified, Databases to ignore while setting access control policies takes precedence over this setting.
Schemas to set access control policies
string
No
Specifies a comma-separated list of schema names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive.
Use the following format when specifying a schema:
<DATABASE_NAME>.<SCHEMA_NAME>
If specified, Schemas to ignore while setting access control policies takes precedence over this setting.
If you specify a wildcard, such as in the following example, all schemas are managed:
<DATABASE_NAME>.*
The specified value, if any, is interpreted in the following ways:
If unset, access control is managed for all schemas.
If set to
none
no schemas are managed.
Tables to set access control policies
string
No
Specifies a comma-separated list of table names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive.
Use the following format when specifying a table:
<DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME>
If specified,
ignore.table.list
takes precedence over this setting.If you specify a wildcard, such as in the following example, all matched tables are managed:
<DATABASE_NAME>.<SCHEMA_NAME>.*
The specified value, if any, is interpreted in the following ways:
If unset, access control is managed for all tables.
If set to
none
no tables are managed.
Databases to ignore while setting access control policies
string
No
Specifies a comma-separated list of database names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all databases are subject to access control.
For example:
testdb1,testdb2,sales_db*
This setting supersedes any values specified by Databases to set access control policies.
Schemas to ignore while setting access control policies
string
No
Specifies a comma-separated list of schema names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all schemas are subject to access control.
For example:
testdb1.schema1,testdb2.schema2,sales_db*.sales*
This setting supersedes any values specified by Schemas to set access control policies.
Regex to find special characters in user names
string
[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]
No
Specifies a regular expression to apply to a username and replaces each matching character with the value specified by the String to replace with the special characters found in user names setting.
If not specified, no find and replace operation is performed.
String to replace with the special characters found in user names
string
_
No
Specifies a string to replace the characters matched by the regex specified by the Regex to find special characters in user names setting.
If not specified, no find and replace operation is performed.
Regex to find special characters in group names
string
[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]
No
Specifies a regular expression to apply to a group and replaces each matching character with the value specified by the String to replace with the special characters found in group names setting.
If not specified, no find and replace operation is performed.
String to replace with the special characters found in group names
string
_
No
Specifies a string to replace the characters matched by the regex specified by the Regex to find special characters in group names setting.
If not specified, no find and replace operation is performed.
Regex to find special characters in role names
string
[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]
No
Specifies a regular expression to apply to a role name and replaces each matching character with the value specified by the String to replace with the special characters found in role names setting.
If not specified, no find and replace operation is performed.
String to replace with the special characters found in role names
string
_
No
Specifies a string to replace the characters matched by the regex specified by the Regex to find special characters in role names setting.
If not specified, no find and replace operation is performed.
Persist case sensitivity of user names
boolean
false
No
Specifies whether PolicySync converts user names to lowercase when creating local users. If set to
true
, case sensitivity is preserved.Persist case sensitivity of group names
boolean
false
No
Specifies whether PolicySync converts group names to lowercase when creating local groups. If set to
true
, case sensitivity is preserved.Persist case sensitivity of role names
boolean
false
No
Specifies whether PolicySync converts role names to lowercase when creating local roles. If set to
true
, case sensitivity is preserved.Manage user from portal
boolean
false
No
Specifies whether PolicySync maintains user membership in roles in the Microsoft SQL Server data source.
Manage group from portal
boolean
false
No
Specifies whether PolicySync creates groups from Privacera in the Microsoft SQL Server data source.
Manage role from portal
boolean
false
No
Specifies whether PolicySync creates roles from Privacera in the Microsoft SQL Server data source.
Users to set access control policies
string
No
Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive.
If not specified, PolicySync manages access control for all users.
If specified, Users to be ignored by access control policies takes precedence over this setting.
An example user list might resemble the following:
user1,user2,dev_user*
.Groups to set access control policies
string
No
Specifies a comma-separated list of group names for which PolicySync manages access control. If unset, access control is managed for all groups. If specified, use the following format. You can use wildcards. Names are case-sensitive.
An example list of projects might resemble the following:
group1,group2,dev_group*
.If specified, Groups be ignored by access control policies takes precedence over this setting.
Roles to set access control policies
string
No
Specifies a comma-separated list of role names for which PolicySync manages access control. If unset, access control is managed for all roles. If specified, use the following format. You can use wildcards. Names are case-sensitive.
An example list of projects might resemble the following:
role1,role2,dev_role*
.If specified, Roles be ignored by access control policies takes precedence over this setting.
Users to be ignored by access control policies
string
No
Specifies a comma-separated list of user names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all users are subject to access control.
This setting supersedes any values specified by Users to set access control policies.
Groups be ignored by access control policies
string
No
Specifies a comma-separated list of group names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all groups are subject to access control.
This setting supersedes any values specified by Groups to set access control policies.
Roles be ignored by access control policies
string
No
Specifies a comma-separated list of role names that PolicySync does not provide access control for. You can specify wildcards. Names are case-sensitive. If not specified, all roles are subject to access control.
This setting supersedes any values specified by Roles to set access control policies.
Prefix of mssql roles for portal users
string
priv_user_
No
Specifies the prefix that PolicySync uses when creating local users. For example, if you have a user named
<USER>
defined in Privacera and the role prefix ispriv_user_
, the local role is namedpriv_user_<USER>
.Prefix of postgres roles for portal group
string
priv_group_
No
Specifies the prefix that PolicySync uses when creating local roles. For example, if you have a group named
etl_users
defined in Privacera and the role prefix isprefix_
, the local role is namedprefix_etl_users
.Prefix of postgres roles for portal role
string
priv_role_
No
Specifies the prefix that PolicySync uses when creating roles from Privacera in the Microsoft SQL Server data source.
For example, if you have a role in Privacera named
finance
defined in Privacera and the role prefix isrole_prefix_
, the local role is namedrole_prefix_finance
.Use mssql native public group for public group access policies
boolean
false
No
Specifies whether PolicySync uses the Microsoft SQL Server native public group for access grants whenever a policy refers to a public group. The default value is false.
Set access control policies only on the users from managed groups
boolean
false
No
Specifies whether to manage only the users that are members of groups specified by Groups to set access control policies. The default value is false.
Set access control policies only on the users/groups from managed roles
boolean
false
No
Specifies whether to manage only users that are members of the roles specified by Roles to set access control policies. The default value is false.
Enforce MSSQL native row filter
boolean
false
No
Specifies whether to use the data source native row filter functionality. This setting is disabled by default. When enabled, you can create row filters only on tables, but not on views.
Enforce masking policies using secure views
boolean
true
No
Specifies whether to use secure view based masking. The default value is
true
.Enforce row filter policies using secure views
boolean
true
No
Specifies whether to use secure view based row filtering. The default value is
true
.While Microsoft SQL Server supports native filtering, PolicySync provides additional functionality that is not available natively. Enabling this setting is recommended.
Create secure view for all tables/views
boolean
true
No
Specifies whether to create secure views for all tables and views that are created by users. If enabled, PolicySync creates secure views for resources regardless of whether masking or filtering policies are enabled.
Default masked value for numeric datatype columns
integer
0
No
Specifies the default masking value for numeric column types.
Default masked value for text/varchar datatype columns
string
<MASKED>
No
Specifies the default masking value for text and string column types.
Secure view name prefix
string
No
Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name.
If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is
dev_
, then the secure view name for a table namedexample1
isdev_example1
.Secure view name postfix
string
_secure
No
Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name.
If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is
_dev
, then the secure view name for a table namedexample1
isexample1_dev
.Secure view schema name prefix
string
No
Specifies a prefix string to apply to a secure schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name.
If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is
dev_
, then the secure view schema name for a schema namedexample1
isdev_example1
.Secure view schema name postfix
string
No
Specifies a postfix string to apply to a secure view schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name.
If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is
_dev
, then the secure view name for a schema namedexample1
isexample1_dev
.Enable dataadmin
boolean
true
No
This property is used to enable the data admin feature. With this feature enabled you can create all the policies on native tables/views, and respective grants will be made on the secure views of those native tables/views. These secure views will have row filter and masking capability. In case you need to grant permission on the native tables/views then you can select the permission you want plus data admin in the policy. Then those permissions will be granted on both the native table/view as well as its secure view.
Users to exclude when fetching access audits
string
No
Specifies a comma separated list of users to exclude when fetching access audits. For example:
"user1,user2,user3"
.Custom fields
Table 14. Custom fieldsCanonical name
Type
Default
Description
load.resources
string
load_from_database_columns
Specifies how PolicySync loads resources from Microsoft SQL Server. The following values are allowed:
load
: Load resources from Microsoft SQL Server with a single SQL query.
sync.interval.sec
integer
60
Specifies the interval in seconds for PolicySync to wait before checking for new resources or changes to existing resources.
sync.serviceuser.interval.sec
integer
420
Specifies the interval in seconds for PolicySync to wait before reconciling principals with those in the data source, such as users, groups, and roles. When differences are detected, PolicySync updates the principals in the data source accordingly.
sync.servicepolicy.interval.sec
integer
540
Specifies the interval in seconds for PolicySync to wait before reconciling Apache Ranger access control policies with those in the data source. When differences are detected, PolicySync updates the access control permissions on data source accordingly.
audit.interval.sec
integer
30
Specifies the interval in seconds to elapse before PolicySync retrieves access audits and saves the data in Privacera.
ignore.table.list
string
Specifies a comma-separated list of table names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all tables are subject to access control. Names are case-sensitive. Specify tables using the following format:
<DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME>
This setting supersedes any values specified by Tables to set access control policies.
user.name.case.conversion
string
lower
Specifies how user name conversions are performed. The following options are valid:
lower
: Convert to lowercaseupper
: Convert to uppercasenone
: Preserve case
This setting applies only if Persist case sensitivity of user names is set to
true
.group.name.case.conversion
string
lower
Specifies how group name conversions are performed. The following options are valid:
lower
: Convert to lowercaseupper
: Convert to uppercasenone
: Preserve case
This setting applies only if Persist case sensitivity of group names is set to
true
.role.name.case.conversion
string
lower
Specifies how role name conversions are performed. The following options are valid:
lower
: Convert to lowercaseupper
: Convert to uppercasenone
: Preserve case
This setting applies only if Persist case sensitivity of role names is set to
true
.user.filter.with.email
string
Set this property to true if you only want to manage users who have an email address associated with them in the portal.
masked.date.value
string
null
Specifies the default masking value for date column types.
secure.view.name.remove.suffix.list
string
Specifies a suffix to remove from a table or view name. For example, if the table is named
example_suffix
you can remove the_suffix
string. This transformation is applied before any custom prefix or postfix is applied.You can specify a single suffix or a comma separated list of suffixes.
secure.view.schema.name.remove.suffix.list
string
Specifies a suffix to remove from a schema name. For example, if a schema is named
example_suffix
you can remove the_suffix
string. This transformation is applied before any custom prefix or postfix is applied.You can specify a single suffix or a comma separated list of suffixes.
perform.grant.updates.max.retry.attempts
integer
2
Specifies the maximum number of attempts that PolicySync makes to execute a grant query if it is unable to do so successfully. The default value is
2
.audit.initial.pull.min
integer
30
Specifies the initial delay, in minutes, before PolicySync retrieves access audits from Microsoft SQL Server.
load.audits
string
load
Specifies the method that PolicySync uses to load access audit information.
The following values are valid:
load
: If your data source is Microsoft SQL Server, set this value to use SQL queries to load access audit information.load_aws
: If your data source is Amazon RDS for SQL Server, set this value to load access audit information.load_synapse
: If your data source is Microsoft Azure Synapse, set this value to load access audit information.
load.users
string
load
Specifies how PolicySync loads users from Microsoft SQL Server. The following values are valid:
load
load_db
external.user.as.internal
boolean
false
Specifies whether PolicySync creates local users for external users.
manage.group.policy.only
boolean
false
Specifies whether access policies apply to only groups. If enabled, any policies that apply to users or roles are ignored.
In the ADVANCED tab, you can add custom properties.
Using the IMPORT PROPERTIES button, you can browse and import application properties.
Enable Data Discovery for MS SQL
Click the toggle button to enable the Data Discovery for your application.
In the BASIC tab, enter values in the following fields.
JDBC URL
JDBC Username
JDBC Password
In the ADVANCED tab, you can add custom properties.
Using the IMPORT PROPERTIES button, you can browse and import application properties.
Click the TEST CONNECTION button to check if the connection is successful, and then click Save.
Add data source
To add a resources using this connection as Discovery targets, see Discovery Scan Topics.