Automatic filter binding for row-level security in database systems

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for row-level security in database systems, the operations comprising:

• providing an initial query tree responsive to a query for querying a database system, the initial query tree comprising a set of view nodes;
• determining a sub-set of view nodes from the set of view nodes, each view node in the sub-set of view nodes being included in the sub-set of view nodes in response to metadata indicating that row-level security is to be applied;
• for a first view node in the sub-set of view nodes:
• identifying a first condition provider procedure that is to be executed,
• determining that the first condition provider procedure comprises a first set of input parameters comprising predefined input parameters, and in response:
• executing the first condition provider procedure using values for the first set of input parameters provided for the first view node to provide a first filter string, and
• inserting the first filter string into the initial query tree;
• providing a final query tree comprising the initial query tree and inserted filter strings;
• generating a query execution plan;
• executing, by an execution engine, the query execution plan to query a database and generate results responsive to the query;
• and
• returning the results.

A system, comprising:

• a computing device;
• and
• a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for row-level security in database systems, the operations comprising:
• providing an initial query tree responsive to a query for querying a database system, the initial query tree comprising a set of view nodes;
• determining a sub-set of view nodes from the set of view nodes, each view node in the sub-set of view nodes being included in the sub-set of view nodes in response to metadata indicating that row-level security is to be applied;
• for a first view node in the sub-set of view nodes:
• identifying a first condition provider procedure that is to be executed,
• determining that the first condition provider procedure comprises a first set of input parameters comprising predefined input parameters, and in response:
• executing the first condition provider procedure using values for the first set of input parameters provided for the first view node to provide a first filter string, and
• inserting the first filter string into the initial query tree;
• providing a final query tree comprising the initial query tree and inserted filter strings;
• generating a query execution plan;
• executing, by an execution engine, the query execution plan to query a database and generate results responsive to the query;
• and
• returning the results.