Create a rule

A rule is a named set of rights: which data sources, which kinds of objects, optionally which individual tables, views, and procedures, and which methods. People, Windows accounts and groups, and SQL logins get rights only through rules; without a matching rule, nobody can reach anything.

In the Regeln (Rules) area, you create a rule with a name and add one attribute below it for each right. Then you assign the rule to people, accounts, or logins.

1. Open Regeln, select Neue Regel (New rule), fill in the form on the right, and go back to the tree:

   Field	What to enter
   Regel (Rule)	A descriptive name, for example fachdaten-lesen or fachdaten-pflege
   Nur lesen (Read-only)	Select this if the rule must never write, regardless of the methods below

2. Select the rule and choose Merkmal hinzufügen … (Add attribute). The “Merkmal der Regel” (Rule attribute) form opens with the rule already filled in. Pick the Merkmal (Attribute) from the list (a line below it explains what it does), enter the Wert (Value), and go back to the tree. Repeat for each attribute:

   Attribute	Values	Meaning
   Datenquelle (Data source) (database)	name of a data source, or *	Which data sources. Add one row per data source
   Objektart (Kind of object) (resource)	tables, views, functions, procedures, sql, admin, or *	Which kinds of objects. sql means your own SQL statements (pass-through), admin means administration; both must be named explicitly, because * doesn't include them
   Methode (Method) (verb)	GET, POST, PATCH, DELETE, or *	Which methods: GET reads, POST creates and runs procedures, PATCH changes, DELETE deletes

3. To limit the rule to individual objects, select the rule and start typing the object's name under Objekte (Objects) in the form; the suggestions come from the rule's data sources. Pick an object with Enter or a click. Under Ausgenommen (Excluded), list objects the rule should not reach. Each object is saved immediately.
   • Write an object as schema.name; schema.* stands for every object in a schema.
   • If the rule lacks the object's kind, the app adds it and tells you so: picking a view adds resource = views.
   • A view doesn't need rights to its tables. To publish only part of a table, create a view in the database and publish the view here.
   • Without objects, the rule applies to all objects of its kinds, as before.
4. Assign the rule to a person (in the person's form; see Create a person), to a Windows account or group, or to a SQL login.

In the screenshot: (1) rule with its attributes, (2) form of the rule.

Result: When you save, the service checks the rule against its entire configuration and applies it immediately.

Examples

• Rights add up. If a person has several rules, they can do everything any of them allows. A read-only rule doesn't restrict another rule. If someone should only read, don't give them a rule that writes.
• Each rule is evaluated on its own. The data source from one rule and the method from another don't combine into a right.
• SQL Server has the final say inside the database. A rule opens the way over HTTP; what's allowed in the database is decided by the permissions of the login the request runs under.
• People don't see what their rules don't reach. In Access, Excel, and Power BI, the other tables are simply missing from the list. A rule with your own SQL statements (sql) can't be limited to individual objects; the service rejects objects on such a rule when you save.
• Deleting a rule: Remove its assignments first; the service won't delete a rule that a person still has.

• Connect a data source
• Reference: Rights: rules and scope, section “Scope per alias” (data service documentation), Rights: rules and scope, section “Rights per object” (data service documentation), HTTP: administration (reference), section “Right and first administrator” (data service documentation)