Delphix Products

we have a requirement from a client where we need to mask tables from 2 schemas. parent is in one schema and child is in another. both schema belong to same database. both schemas have different users having access ONLY to their schemas. user of child table schema does not have access to the master table and vice versa.

Is there a way we can do masking in delphix without tweaking the permissions for both the child table as well as for the master table?

As far as I know you cannot automatically handle cross-schema constraints. You need a connector, ruleset and job per schema. What you can do is use pre-scripts to drop the PK/FK constraint in both schemas, then mask them using the same deterministic uniqueness preserving algorithm (for example dlpx-core:CM Alpha-Numeric) and afterwards use post-scripts to re-enable the constraints in both schemas, I have already implemented that a couple of times, little work to configure but works fine.

I doubt tweaking permissions would work as the connector is always schema specific.

we have a requirement from a client where we need to mask tables from 2 schemas. parent is in one schema and child is in another. both schema belong to same database. both schemas have different users having access ONLY to their schemas. user of child table schema does not have access to the master table and vice versa.

Is there a way we can do masking in delphix without tweaking the permissions for both the child table as well as for the master table?

Thank you Tino. But there are couple of constraints in our scenario. There is no single user who has access to both the schemas. so we have to use one user one schema and second there is no FK between the master and child. The client is treating them as master and child but really there is no relation between them. So what we are currently doing is temporary granting access to schema (with master) to the child schema user and them revoking that in another job.

there masking requirement is unique. they want to mast the child column with a constant string value concatenated with a ID value from the master. like ('constant'+ID_value). so i don't think we can use any of the delphix alogorithim our of the box. so we are using SQL scripts . i know you said to use some toolkit from delphix but we could not get hold of it

As far as I know you cannot automatically handle cross-schema constraints. You need a connector, ruleset and job per schema. What you can do is use pre-scripts to drop the PK/FK constraint in both schemas, then mask them using the same deterministic uniqueness preserving algorithm (for example dlpx-core:CM Alpha-Numeric) and afterwards use post-scripts to re-enable the constraints in both schemas, I have already implemented that a couple of times, little work to configure but works fine.

I doubt tweaking permissions would work as the connector is always schema specific.

we have a requirement from a client where we need to mask tables from 2 schemas. parent is in one schema and child is in another. both schema belong to same database. both schemas have different users having access ONLY to their schemas. user of child table schema does not have access to the master table and vice versa.

Is there a way we can do masking in delphix without tweaking the permissions for both the child table as well as for the master table?

I reached out to customer success to identify who is managing your account. If there is an active engagement I will try to reach out directly and arrange a session. As stated earlier the UTILITY plugin can do what you are looking for. I assume the ID_value is a column of the same table, correct ? 

Thank you Tino. But there are couple of constraints in our scenario. There is no single user who has access to both the schemas. so we have to use one user one schema and second there is no FK between the master and child. The client is treating them as master and child but really there is no relation between them. So what we are currently doing is temporary granting access to schema (with master) to the child schema user and them revoking that in another job.

there masking requirement is unique. they want to mast the child column with a constant string value concatenated with a ID value from the master. like ('constant'+ID_value). so i don't think we can use any of the delphix alogorithim our of the box. so we are using SQL scripts . i know you said to use some toolkit from delphix but we could not get hold of it

As far as I know you cannot automatically handle cross-schema constraints. You need a connector, ruleset and job per schema. What you can do is use pre-scripts to drop the PK/FK constraint in both schemas, then mask them using the same deterministic uniqueness preserving algorithm (for example dlpx-core:CM Alpha-Numeric) and afterwards use post-scripts to re-enable the constraints in both schemas, I have already implemented that a couple of times, little work to configure but works fine.

I doubt tweaking permissions would work as the connector is always schema specific.

we have a requirement from a client where we need to mask tables from 2 schemas. parent is in one schema and child is in another. both schema belong to same database. both schemas have different users having access ONLY to their schemas. user of child table schema does not have access to the master table and vice versa.

Is there a way we can do masking in delphix without tweaking the permissions for both the child table as well as for the master table?

Hi Tio: I think the below example will give more info . As i said in my earlier there is no relation between the so called master and child and no user who can access both the schemas. each schema has their own individual users who are owners of their respective schemas. Hope this helps.

I reached out to customer success to identify who is managing your account. If there is an active engagement I will try to reach out directly and arrange a session. As stated earlier the UTILITY plugin can do what you are looking for. I assume the ID_value is a column of the same table, correct ? 

Thank you Tino. But there are couple of constraints in our scenario. There is no single user who has access to both the schemas. so we have to use one user one schema and second there is no FK between the master and child. The client is treating them as master and child but really there is no relation between them. So what we are currently doing is temporary granting access to schema (with master) to the child schema user and them revoking that in another job.

there masking requirement is unique. they want to mast the child column with a constant string value concatenated with a ID value from the master. like ('constant'+ID_value). so i don't think we can use any of the delphix alogorithim our of the box. so we are using SQL scripts . i know you said to use some toolkit from delphix but we could not get hold of it

As far as I know you cannot automatically handle cross-schema constraints. You need a connector, ruleset and job per schema. What you can do is use pre-scripts to drop the PK/FK constraint in both schemas, then mask them using the same deterministic uniqueness preserving algorithm (for example dlpx-core:CM Alpha-Numeric) and afterwards use post-scripts to re-enable the constraints in both schemas, I have already implemented that a couple of times, little work to configure but works fine.

I doubt tweaking permissions would work as the connector is always schema specific.

we have a requirement from a client where we need to mask tables from 2 schemas. parent is in one schema and child is in another. both schema belong to same database. both schemas have different users having access ONLY to their schemas. user of child table schema does not have access to the master table and vice versa.

Is there a way we can do masking in delphix without tweaking the permissions for both the child table as well as for the master table?