DataMasque Portal

SAP ASE (Sybase) connections

DataMasque masks SAP Adaptive Server Enterprise (ASE, formerly Sybase) tables in place. The connection type is named SAP ASE (Sybase) in the Database type list.

Required privileges

A DataMasque connection for SAP ASE requires at least the following privileges:

  • SELECT and UPDATE on each table to be masked.
  • CREATE TABLE in the target database.
  • ALTER TABLE, CREATE INDEX, and DROP INDEX on each table to be masked, where triggers are managed or masks that keep values unique are used. ASE gives these to the table owner and the database owner only, so connect as the owner of the masked tables.
  • DELETE on each table targeted by a truncate_table task, where truncation tasks are used.
GRANT CREATE TABLE TO <user>
GO

GRANT SELECT, UPDATE ON <owner>.<table> TO <user>
GO

-- Required only where truncation tasks are used
GRANT DELETE ON <owner>.<table> TO <user>
GO

Notes:

  1. The system tables DataMasque reads during discovery (sysobjects, syscolumns, systypes, sysusers, sysindexes, sysreferences, and sysconstraints) are readable by any user of the database; no explicit grants are required.

  2. Repeat the table-level grants for each table to be masked.

Connection parameters
Database name The name of the database to mask.
Enable TLS/SSL (Advanced) Connect over TLS. See Encrypted connections.
TLS Server Name (Advanced) The DNS name that the server certificate must carry, when it is not the host name. Available when TLS is on.
Connect Timeout (Advanced) The number of seconds to wait for the connection to open, from 1 to 3600.
CA Certificate (Advanced) A CA certificate file set that the server certificate is verified against. Available when TLS is on.

Notes:

  1. The default port for SAP ASE connections is 5000 (used if no port is specified).

  2. There is no schema field. In SAP ASE, the schema of a table is its owner. A table name without an owner resolves to the table that the connection user owns, then to the one that dbo owns. Write owner.table to mask a table that another user owns.

  3. Name matching follows the sort order of the server. On a server with a binary sort order (for example utf8bin), names are case-sensitive: write owner, table, and column names exactly as they were created. DataMasque does not connect to a server whose sort order ignores accents.

Encrypted connections

To encrypt the connection, turn on Enable TLS/SSL in Advanced Settings. DataMasque always verifies the server certificate.

  • With no CA certificate selected, the certificate must be signed by a CA in the system trust store of DataMasque.
  • To trust a private CA, upload a ZIP file that contains the CA certificate as ca.pem on the Files page, with SAP ASE SSL ZIP, then select it in CA Certificate.
  • If the certificate carries a name other than the host name of the connection (for example the server name from the interfaces file), set TLS Server Name to that name.

Limitations

  • mask_unique_key tasks are not supported. Use the imitate_unique mask instead.

  • Subsetting is not supported.

  • build_temp_table tasks are not supported.

  • The from_blob mask is not supported.

  • Automatic index management is not supported on SAP ASE.

  • SAP ASE has no equivalent of an Oracle ROWID pseudo-column; rows are identified by declared keys.

  • Identity, timestamp, and computed columns cannot be masked. The ruleset generator can still create a rule for an identity or computed column; remove such a rule.

  • ASE stores an empty string in a char, varchar, or text column as a single space. Masks that validate their input see ' '.

  • In run_sql scripts, batches are separated by lines that hold only GO, as in isql. A repeat count (GO 5) is not supported.

  • SAP ASE 16.0 SP02 or later is required.

Unsupported key columns

Data Type Unsupported Format
text All
unitext All
image All
bit All
timestamp All
real All
float All
double precision All

Notes:

  • A column of a user-defined type is checked by the system type it is built on.