What is the application-level impact of enabling database Runtime Permission Checking ? - Progress Community

Loading

Skip to Main Content

What is the application-level impact of enabling database Runtime Permission Checking ?

What is the application-level impact of enabling database Runtime Permission Checking ? How does database Runtime Permission Checking affect application performance ?

Oct 8, 2013
Knowledge

Title

What is the application-level impact of enabling database Runtime Permission Checking ?

URL Name

000043689

Article Number

000166560

Environment

Product: OpenEdge Version: 10.x, 11.x OS: All supported platforms

Question/Problem Description

What is the application-level impact of enabling database Runtime Permission Checking ?

How does database Runtime Permission Checking affect application performance ?

Does application code need to be recompiled to allow Runtime Permission Checking ?
If a database has schema permissions set and the Runtime Permission Checking is enabled, what needs to be done on the ABL side ?

Steps to Reproduce

Clarifying Information

Admin > Database Options > Use Runtime Permissions Checking

Error Message

Defect Number

Enhancement Number

Cause

Resolution

When Runtime Permission Checking is enabled:

What stays the same:

Runtime Permissions Checking is in addition to the compile-time permissions checking. The features do not exclude each other.

There is no need to recompile the ABL code for Runtime Permissions Checking to take effect, the ABL client only relies on the connected database(s) to identify if permissions are checked at runtime or not.

The runtime permissions checking is well optimized, and does not have a notable performance impact. (None has been demonstrated or reported)

What changes:

Enabling Runtime Permissions Checking can introduce new permissions issues for specific users, as specific user accounts may lose access to data.

Example:
User A does not have write permissions on Table T.
User B does have write permissions on Table T.
User B compiles a procedure that updates Table T, and gives the r-code to User A.

With only compile-time permissions checking, User A can update Table T using the pre-compiled procedure, but is not able to compile the code themselves.
With Runtime Permissions Checking enabled, User A can no longer update Table T using the pre-compiled procedure.

Depending on the use case this may provide the required behaviour or introduce a runtime problem, so this needs to be tested and determined on a case-by-case basis.

Always take a database backup prior to undertaking any maintenance, especially in this area of security.

Workaround

Notes

References to Other Documentation:

OpenEdge Deployment: Managing ABL Applications, "Database table- and field-level security"

OpenEdge Development: Basic Database Tools, "Admin Menu Reference: Database options"

Progress Articles:

P125990, What does selecting the "Use Runtime Permissions Checking" database option mean?

15817, Database Security Enforced at Compile Time - Not at Runtime
P123211, Is there a way to suppress error (234) when user tries to access a table without the required access privilege ?

Keyword Phrase

Last Modified Date

3/14/2016 11:14 AM

OpenEdge DeploymentOpenEdge ArchitectureOpenEdge DevelopmentOpenEdge General DiscussionsOpenEdge Pro2OpenEdge RDBMS

Drop Files

Upload FilesOr drop files

Disclaimer

The origins of the information on this site may be internal or external to Progress Software Corporation (“Progress”). Progress Software Corporation makes all reasonable efforts to verify this information. However, the information provided is for your information only. Progress Software Corporation makes no explicit or implied claims to the validity of this information.

Any sample code provided on this site is not supported under any Progress support program or service. The sample code is provided on an "AS IS" basis. Progress makes no warranties, express or implied, and disclaims all implied warranties including, without limitation, the implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample code is borne by the user. In no event shall Progress, its employees, or anyone else involved in the creation, production, or delivery of the code be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample code, even if Progress has been advised of the possibility of such damages.

Loading

What is the application-level impact of enabling database Runtime Permission Checking ? - Progress Community