Java API for Data Security

Applies to: Kyvos Enterprise Kyvos Cloud (SaaS on AWS) Kyvos AWS Marketplace

Kyvos Azure Marketplace Kyvos GCP Marketplace Kyvos Single Node Installation (Kyvos SNI)

Overview

Apply Data Security to create security rules for a semantic model and assign those rules to a specific user/group. A Data Security rule will contain row-level security filters to which the user has access and column-level security fields to which the user does not have access.

Apply data security.
1. Add data security rule
2. Create row level dimension filter
3. Create column level fields
4. Add data security rule mapping for user
5. Add data security rule mapping for group

Example

Add data security rule
/** * method to add Data Security Rule on semantic model object * @param cubeObject: Object of type CubeObject. * @param ruleName: Name of the rule. * @param ruleDescription: Description of the rule. * @param rowLevelFilters: Filters to be applied for row level security. * @param columnLevelFields: Semantic model fields on which column level security has to be applied. * @param userInfo: Object of type UserInfo containing information about logged in user. * @return ResponseStatus: Object of type ResponseStatus. */ public ResponseStatus addDataSecurityRule(CubeObject cubeObject, String ruleName, String ruleDescription, List<com.kyvos.commons.entity.olap.viewer.Filter> rowLevelFilters, List<ColumnLevelSecurityField> columnLevelFields, UserInfo userInfo);
1. Create row level dimension filter
  /** * method to create the row level filters on given dimension and level by dimension name and level name. * @param dimensionName: Dimension name to be filter applied. * @param levelName: Level or Attribute name of the dimension. * @param operator: Operator to be applied e.g. CONTAINS, STARTSWITH. Operators are defined in {@link com.kyvos.commons.globals.Enums.AdhocConfigurations.Operators} class. * @param value: Filter value. * @return: Newly created Filter object. * @throws ISecurityException. */ public com.kyvos.commons.entity.olap.viewer.Filter createRowLevelDimensionFilter(CubeObject cubeObject, String dimensionName, String levelName, String operator, String value); /** * method to create the list of values of filter on given dimension and level by dimension name and level name. * @param dimensionName: Dimension name to be filter applied. * @param levelName: Level or Attribute name of the dimension. * @param valueList: List of Filter value strings. * @return: Newly created Filter object. * @throws ISecurityException. */ public com.kyvos.commons.entity.olap.viewer.Filter createRowLevelDimensionFilterByList(CubeObject cubeObject, String dimensionName, String levelName, String operator, List<String> valuesList);
2. Create column level fields
  /** * method to get column level field by dimension. * @param cubeObject: Object of type CubeObject. * @param dimensionName: Name of the dimension. * @return object of type ColumnLevelSecurityField. * @throws ISecurityException. */ public ColumnLevelSecurityField createColumnLevelFieldByDimension(CubeObject cubeObject, String dimensionName); /** * method to get column level field by measure. * @param cubeObject: Object of type CubeObject. * @param measureName: Name of the measure. * @return object of type ColumnLevelSecurityField. * @throws ISecurityException. */ public ColumnLevelSecurityField createColumnLevelFieldByMeasure(CubeObject cubeObject, String measureName); /** * method to get column level field by level. * @param cubeObject: Object of type CubeObject. * @param dimensionName: Name of the dimension. * @param levelName: Name of the level. * @return object of type ColumnLevelSecurityField. * @throws ISecurityException. */ public ColumnLevelSecurityField createColumnLevelFieldByLevel(CubeObject cubeObject, String dimensionName, String levelName); /** * method to get column level field by attribute. * @param cubeObject: Object of type CubeObject. * @param dimensionName: Name of the dimension. * @param attributeName: Name of the attribute. * @return object of type ColumnLevelSecurityField. * @throws ISecurityException. */ public ColumnLevelSecurityField createColumnLevelFieldByAttribute(CubeObject cubeObject, String dimensionName, String attributeName); /** * method to get column level field by hierarchy. * @param cubeObject: Object of type CubeObject. * @param dimensionName: Name of the dimension. * @param hierarchyName: Name of the hierarchy. * @return object of type ColumnLevelSecurityField. * @throws ISecurityException. */ public ColumnLevelSecurityField createColumnLevelFieldByHierarchy(CubeObject cubeObject, String dimensionName, String hierarchyName);
3. Add data security rule mapping for user
  /** * method to add data security rules mapping for a user. * @param cubeObject: Object of type CubeObject. * @param username: Name of the user. * @param rulesNameList: List of rules name. * @param userInfo: Object of type UserInfo containing information about logged in user. * @return object of type ResponseStatus. * @throws ISecurityException. */ public ResponseStatus addDataSecurityRulesMappingForUser(CubeObject cubeObject, String userName, List<String> rulesNameList, UserInfo userInfo);
4. Add data security rule mapping for group
  /** * method to add data security rules mapping for a group. * @param cubeObject: Object of type CubeObject. * @param groupName: Name of the group. * @param rulesNameList: List of rules name. * @param userInfo: Object of type UserInfo containing information about logged in user. * @return object of type ResponseStatus. * @throws ISecurityException. */ public ResponseStatus addDataSecurityRulesMappingForGroup(CubeObject cubeObject, String groupName, List<String> rulesNameList, UserInfo userInfo);

Sample Code

package com.kyvos.client.java;

import java.util.ArrayList;
import java.util.List;

import com.kyvos.client.common.Enums;
import com.kyvos.client.common.ResponseStatus;
import com.kyvos.client.common.UserInfo;
import com.kyvos.client.exception.ISecurityException;
import com.kyvos.client.init.ReportClient;
import com.kyvos.client.reportobjects.ReportObjectManager;
import com.kyvos.client.security.SecurityManager;
import com.kyvos.commons.entity.olap.viewer.Filter;
import com.kyvos.commons.entity.reportobjects.CubeObject;
import com.kyvos.commons.entity.reportobjects.ReportObjectException;
import com.kyvos.commons.exception.InterfaceInitException;
import com.kyvos.commons.security.DataSecurityRule.ColumnLevelSecurityField;
import com.kyvos.commons.security.DataSecurityRule.ColumnLevelSecurityMaskingInfo;

/**
 * Demonstrates how to apply different types of data security rules on Kyvos semantic models:
 * - Row-level
 * - Column-level (DATA only or DATA_AND_METADATA)
 * - Masked data (static masking)
 * - Conditional masking (based on dimension filters)
 */
public class DataSecurityRuleExample {

    public static void main(String[] args) throws Exception {
        String cubeId = "16032701190267127072016117438809";
        
        //Define user info with your kyvos username and password
        UserInfo userInfo = new UserInfo("", "");

        // Initialize Kyvos client with property files
        ReportClient.init(
            "kyvosclient.properties",
            "globals.properties",
            true
        );

        CubeObject cubeObject = getCubeObjectById(cubeId, userInfo);

        // Apply different types of security rules
        applyRowLevelSecurityRule(cubeObject, userInfo);
        applyColumnDataAndMetadataRestriction(cubeObject, userInfo);
        applyColumnDataOnlyRestriction(cubeObject, userInfo);
        applyColumnMaskingRule(cubeObject, userInfo);
        applyConditionalMaskingRule(cubeObject, userInfo);
    }

    /**
     * Retrieves the semantic model based on cubeId.
     */
    private static CubeObject getCubeObjectById(String cubeId, UserInfo userInfo)
            throws ReportObjectException, InterfaceInitException {

        ReportObjectManager reportObjectManager = new ReportObjectManager();
        return (CubeObject) reportObjectManager.getReportObject(
                Enums.IRO.TYPE.ANALYTICAL,
                cubeId,
                true,
                userInfo,
                Enums.IRO.SUBTYPE.CUBE
        );
    }

    /**
     * Applies a row-level security rule to restrict rows where Segment = 'Consumer'.
     */
    public static void applyRowLevelSecurityRule(CubeObject cubeObject, UserInfo userInfo)
            throws ISecurityException {

        SecurityManager securityManager = SecurityManager.getInstance();

        // Define rule conditions
        String dimension = "CustomerName";
        String hierarchy = "H_CustomerName";
        String fieldType = "LEVEL";
        String field = "Segment";
        String value = "Consumer";

        Filter rowFilter = securityManager.createRowLevelDimensionFilter(
                cubeObject, dimension, field, "EQUAL_TO", value, hierarchy, fieldType
        );

        List<Filter> rowFilterList = new ArrayList<>();
        rowFilterList.add(rowFilter);

        String ruleName = "RowRule_Segment_Consumer";
        String description = "Restrict access to rows where Segment = 'Consumer'";

        ResponseStatus status = securityManager.addDataSecurityRule(
                cubeObject, ruleName, description, rowFilterList, new ArrayList<ColumnLevelSecurityField>(), userInfo
        );

        System.out.println("Row-level rule applied: " + status.getMessage());
    }

    /**
     * Applies column-level restriction (DATA_AND_METADATA) on Segment level.
     */
    public static void applyColumnDataAndMetadataRestriction(CubeObject cubeObject, UserInfo userInfo)
            throws ISecurityException {

        SecurityManager securityManager = SecurityManager.getInstance();

        String dimension = "CustomerName";
        String hierarchy = "H_CustomerName";
        String fieldType = "LEVEL";
        String field = "Segment";

        ColumnLevelSecurityField colField = securityManager.createColumnLevelField(
                cubeObject,
                dimension,
                fieldType,
                field,
                com.kyvos.commons.globals.Enums.ColumnLevelSecurityRestriction.DATA_AND_METADATA.name(),
                null,
                hierarchy
        );

        List<ColumnLevelSecurityField> colFields = new ArrayList<>();
        colFields.add(colField);

        String ruleName = "ColumnRule_DataAndMetadata";
        String description = "Restrict both data and metadata for Segment";

        ResponseStatus status = securityManager.addDataSecurityRule(
                cubeObject, ruleName, description, new ArrayList<Filter>(), colFields, userInfo
        );

        System.out.println("Column (DATA_AND_METADATA) rule applied: " + status.getMessage());
    }

    /**
     * Applies column-level restriction (DATA only) on Segment level.
     */
    public static void applyColumnDataOnlyRestriction(CubeObject cubeObject, UserInfo userInfo)
            throws ISecurityException {

        SecurityManager securityManager = SecurityManager.getInstance();

        String dimension = "CustomerName";
        String hierarchy = "H_CustomerName";
        String fieldType = "LEVEL";
        String field = "Segment";

        ColumnLevelSecurityField colField = securityManager.createColumnLevelField(
                cubeObject,
                dimension,
                fieldType,
                field,
                com.kyvos.commons.globals.Enums.ColumnLevelSecurityRestriction.DATA.name(),
                null,
                hierarchy
        );

        List<ColumnLevelSecurityField> colFields = new ArrayList<>();
        colFields.add(colField);

        String ruleName = "ColumnRule_DataOnly";
        String description = "Restrict only data visibility for Segment";

        ResponseStatus status = securityManager.addDataSecurityRule(
                cubeObject, ruleName, description, new ArrayList<Filter>(), colFields, userInfo
        );

        System.out.println("Column (DATA only) rule applied: " + status.getMessage());
    }

    /**
     * Applies static masking rule to Segment field (e.g., replaces value with '*').
     */
    public static void applyColumnMaskingRule(CubeObject cubeObject, UserInfo userInfo)
            throws ISecurityException {

        SecurityManager securityManager = SecurityManager.getInstance();

        String dimension = "CustomerName";
        String hierarchy = "H_CustomerName";
        String fieldType = "LEVEL";
        String field = "Segment";

        ColumnLevelSecurityMaskingInfo maskingInfo = new ColumnLevelSecurityMaskingInfo(
                com.kyvos.commons.globals.Enums.ColumnLevelSecurityMaskType.FIX, "*", "", null
        );

        ColumnLevelSecurityField colField = securityManager.createColumnLevelField(
                cubeObject,
                dimension,
                fieldType,
                field,
                com.kyvos.commons.globals.Enums.ColumnLevelSecurityRestriction.MASK_DATA.name(),
                maskingInfo,
                hierarchy
        );

        List<ColumnLevelSecurityField> colFields = new ArrayList<>();
        colFields.add(colField);

        String ruleName = "ColumnRule_MaskData";
        String description = "Mask Segment field with '*'";

        ResponseStatus status = securityManager.addDataSecurityRule(
                cubeObject, ruleName, description, new ArrayList<Filter>(), colFields, userInfo
        );

        System.out.println("Column masking rule applied: " + status.getMessage());
    }

    /**
     * Applies conditional masking on measure 'Sum Sales' when Segment = Consumer.
     */
    public static void applyConditionalMaskingRule(CubeObject cubeObject, UserInfo userInfo)
            throws ISecurityException {

        SecurityManager securityManager = SecurityManager.getInstance();

        String measure = "Sum Sales";
        String fieldType = "MEASURE";
        String maskValue = "0";

        List<Filter> conditionalFilters = new ArrayList<>();

        String dim = "CustomerName";
        String hierarchy = "H_CustomerName";
        String level = "Segment";
        String operator = "EQUAL_TO";
        String value = "Consumer";

        Filter conditionFilter = securityManager.createRowLevelDimensionFilter(
                cubeObject, dim, level, operator.toUpperCase(), value, hierarchy, "LEVEL"
        );

        conditionFilter.setRelation(com.kyvos.commons.globals.Enums.FilterRelation.and);
        conditionFilter.setStartEnclosure("(");
        conditionFilter.setEndEnclosure(")");

        conditionalFilters.add(conditionFilter);

        ColumnLevelSecurityMaskingInfo maskingInfo = new ColumnLevelSecurityMaskingInfo(
                com.kyvos.commons.globals.Enums.ColumnLevelSecurityMaskType.FIX, maskValue, "", conditionalFilters
        );

        ColumnLevelSecurityField colField = securityManager.createColumnLevelField(
                cubeObject,
                "",
                fieldType,
                measure,
                com.kyvos.commons.globals.Enums.ColumnLevelSecurityRestriction.CONDITIONAL_MASK_DATA.name(),
                maskingInfo,
                ""
        );

        List<ColumnLevelSecurityField> colFields = new ArrayList<>();
        colFields.add(colField);

        String ruleName = "ConditionalMask_SumSales";
        String description = "Mask 'Sum Sales' to 0 where Segment = Consumer";

        ResponseStatus status = securityManager.addDataSecurityRule(
                cubeObject, ruleName, description, new ArrayList<Filter>(), colFields, userInfo
        );

        System.out.println("Conditional masking rule applied: " + status.getMessage());
    }
}