使用扩展属性的SQL Server数据库中的动态行级安全性

Question

We have a requirement to provide customer access to a staging database so that they can extract their data into their own servers, but every table contains all customers data. All of the tables have a 'CustomerID' column. Customers should only see rows where the customerID is the same as theirs.

I am not looking for suggestions to create separate databases or views for each customer as both suggestions are high maintenance and low efficiency.

My solution has to work with:

• 100GB database
• 400 Tables
• Updates every 30 minutes from the core transaction database
• Quarterly schema changes (Application is in continuous Development).

Can anyone give me a definitive answer as to why the following method is not secure or will not work?:

I've set up a database user for each customer, with their customerID as an extended property.

I've created a view of every table that dynamically selects * from the table where the customerID column is the same as the extended property CustomerID of the logged in user. The code looks like this and appears to work well:

CREATE VIEW [CustomerAccessDatabase].[vw_Sales] 
AS SELECT * FROM [CustomerAccessDatabase].[Sales] 
WHERE [Sales].[CustomerID]= 
         (SELECT CONVERT(INT,p.value) AS [Value] 
         FROM sys.extended_properties
         JOIN sys.sysusers ON extended_properties.major_id=sysusers.[uid] 
         AND extended_properties.name = 'CustomerID' 
         AND sysusers.[SID]=(SELECT suser_sid())
         );
GO

To provide access to the views I've created a generic database role 'Customer_Access_Role'. This role has access granted to all of the table views, but access to the database tables themselves is denied.

To prevent users from changing their own customerID I've denied access to the extended properties like so:

USE [master];
GO
DENY EXEC ON sys.sp_addextendedproperty to [public];
GO
DENY EXEC ON sys.sp_dropextendedproperty to [public];
GO
DENY EXEC ON sys.sp_updateextendedproperty to [public];
GO

The end result is that I only need one database, and one set of permissions.

To add a new customer all I would need to do is create a new user with their customerID as an extended attribute and add them to the Customer_Access_Role. Thats it!

Answer 1

I am going to reiterate what everyone is stating already and sum it up.

1. You are making your job harder than it has to be.
2. Create a View, that is just their data and then give them Security access to that View.
3. Alternatively, extract all their data out of the "Core" database and into their own and give them the necessary access to that data.