Custom Data Security Configurations

This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here.

This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here.

✅ Enterprise: AWS, Azure, GCP, and On-Premises ✅ Marketplace: AWS, Azure, and GCP ✅ SaaS: AWS, Azure, and GCP ✅ Single Node Installation (SNI)

1. Overview

This section explains how to configure custom data security settings in Kyvos Manager to restrict access to semantic model data by implementing custom security mechanisms such as Custom Row-Level Security (RLS), Column-Level Security (CLS), and JDBC-based security.

The custom data security configuration lets you control access to semantic model data by defining custom row-level security, column-level security, and JDBC-based security for your Kyvos cluster.
You can define callback code to provide custom data security configurations depending on your business requirements.
You can specify Kyvos User preferences for Hadoop access as either Keytab Principal User with administrative rights or Kyvos Logged in User with specific access rights to perform activities as per the user's privileges. This user is used for all activities requiring Hadoop access by Kyvos, such as the semantic model process.

On this page:

1 1. Overview
2 2. Custom Row-Level Security (RLS)
3 3. Custom Column-Level Security (CLS)
4 4. Custom JDBC Security
5 5. Enable Custom Filter

2. Custom Row-Level Security (RLS)

2.1 Prerequisites

Upload the Custom RLS JAR from the Upload External Libraries page.
Add classpath such as com.kyvos.ClassName and provide an alias name, which will be visible on the Kyvos when selecting the Custom RLS JAR.
Restart Kyvos services after adding the JAR.

Sample code

Note

You can modify this code to create multiple types of Custom RLS per your business requirements. You can also upload a properties/JSON/CSV file by modifying the code and providing the path of a file (accessible to the JAR on the Analytical Server node) containing details related to Custom RLS.

@Override
public Filters getRLSFilter(String cubeID, String folderName, String cubeName, String userName,
			List<String> groupName, List<IQueriedFieldDetails> queriedFields,
			Map<String, ICubeFieldDetails> fieldNameToICubeFieldDetailsMap) throws RowLevelSecurityException {
		
		JSONArray jsonArr = new JSONArray();
		JSONObject jsonObj = new JSONObject();
			
		//Creating JSON for applying RLS
		json.put(EnumsRLSFilterPlugin.RLSJsonKeys.FIELD_DATA_TYPE,fieldNameToIRLSDetailsMap.get(fieldName).getFieldDataType());
		json.put(EnumsRLSFilterPlugin.RLSJsonKeys.FIELD_RELATION,"OR");
		json.put(EnumsRLSFilterPlugin.RLSJsonKeys.FIELD_DISPLAY_NAME,fieldNameToIRLSDetailsMap.get(fieldName).getFieldName());
		json.put(EnumsRLSFilterPlugin.RLSJsonKeys.FIELD_NAME,fieldNameToIRLSDetailsMap.get(fieldName).getFieldUniqueName());
		json.put(EnumsRLSFilterPlugin.RLSJsonKeys.FIELD_OPERATION,filtertype);
		json.put(EnumsRLSFilterPlugin.RLSJsonKeys.FIELD_VALUE,fieldValue);

		//Creating JSONArray from JSONObject
		jsonArr.add(jsonObj);
			
		clonedRLSFilters = RLSUtility.getRLSFiltersFromJSONArray(jsonArray, cubeID);
		return clonedRLSFilters;
}

2.2 Custom JAR-Based Row-Level Security

To upload JAR for custom row-level security, perform the following steps.

In the navigation bar, click Security > Data Security.
Select the Enable Custom Row Level Security checkbox.
Click Choose File and select the select the required Callback Jar from your system.
Click Upload for the JAR files containing a class that implements the RLS Provider interface for custom row-level security. You can upload multiple callback JAR files.
In the Callback Class Name field, provide a fully qualified class name, including the package name.
In the Alias field, provide an alias that will be displayed for the semantic model in the Data Security section.
Click Save.

2.3 Built-In Configuration-Based Row-Level Security

You can also use Kyvos' built-in configuration file to implement RLS, without uploading a custom JAR.

To enable built-in configuration-based RLS Security, configure the RLSConfiguration.json file, located at /kyvos/olapengine/conf/RLSConfiguration.json.

The RLSConfiguration.json file defines the actual row-level filtering behavior for each semantic model — including which users are allowed access when they are missing from the rules table (missingUserBehaviour), the filter expression used to generate the RLS filter (rlsRuleQuery), and the wildcard character that grants full column access (wildCardCharacter).

To enable built-in configuration-based RLS Security, navigate to Utilities > Manage Configuration Files.
In the Callback Class Name field, provide a fully qualified class name, including the package name.
In the Alias field, provide an alias that will be displayed for the semantic model in the Data Security section.
Click Save.

3. Custom Column-Level Security (CLS)

Note

You can configure custom column-level security only if SENTRY is configured as Hadoop Authorization.

To specify custom column-level security, perform the following steps.

Select the Enable Column Level Security checkbox to integrate externally configured column-level security into Kyvos.
From the Implementation Type drop-down, select any of the following:
1. Default: Select this option to use the Kyvos-defined column-level security implementation.
2. Custom: Select this option to integrate externally configured column-level security.
Use the Callback Jar field to upload the JAR files containing a class for an externally implemented column-level security interface. You can upload multiple callback JAR files.
In the Callback Class Name field, provide the class name, including the package name and implementing interface.
Click Save.

4. Custom JDBC Security

Note

You can configure custom JDBC security only if Hive is configured.

To specify custom JDBC security, perform the following steps.

Select the Enable Custom JDBC Security checkbox to define a custom JDBC security layer on your cluster.
Use the Callback Jar field to upload the JAR file containing a class for externally implemented JDBC security.
In the Callback Class Name field, provide the full name of the custom implementation class (including its package name) that implements the JDBC interface.
Click Save.

5. Enable Custom Filter

Kyvos supports a new MDX query function named CUSTOMKYVOSFILTER for handling large cohorts. To enable this custom filter, create a Java class and package it in a JAR file. Upload this JAR file, and specify the fully qualified class name, including the package name. For more information, refer to the Working with Large List of Filters in Kyvos section.

To enable the custom filter, perform the following steps.

On the Data Security page, select the Enable Custom Filter checkbox to enable the CUSTOMKYVOSFILTER filter in Kyvos to handle a large list of filter values.
Upload the Custom Filter Callback JAR file.
Specify the Callback Java Class name, providing the fully qualified class name, including the package name.
Click Save.
Restart the Analytical Server.