Dynamic shared data object masking

1. A method comprising:

identifying a database object on a network site;

receiving, from a first client device of a first end-user of the network site, a share masking policy for modifying data in the database object, the share masking policy comprising a plurality of database user defined functions (UDFs) to initiate masking operations on the database object in response to one or more of a plurality of end-user role types of end-users requesting access to the database object on the network site, each of the plurality of end-user role types being mapped, by the first end-user of the network site, to a different database UDF of the plurality of database UDFs;

receiving a request to access the database object from a second client device of a second end-user;

determining that an end-user role of the second end-user matches one of the plurality of end-user role types in the share masking policy;

applying the one of the plurality of database UDFs on the database object to generate masked data; and

causing, on the second client device, a presentation of the masked data.

2. The method of claim 1 , wherein the request from the second client device comprises a query.

3. The method of claim 2 , wherein the query comprises a select statement, and wherein the select statement is applied to the masked data.

4. The method of claim 1 , wherein the database object is stored in a first database instance managed by the first end-user, wherein the masked data is hosted on a second database instance managed by the second end-user without copying the database object from the first database instance to the second database instance.

5. The method of claim 1 , wherein the database object comprises is a database view that includes data from one or more external tables that are read-only tables.

6. The method of claim 1 , wherein the share masking policy is received in structured query language (SQL) format and stored in a share masking database.

7. The method of claim 1 , wherein the share masking policy is mapped to the database object.

8. The method of claim 1 , wherein the plurality of database UDFs are SQL UDFs, and wherein the method further comprises:

receiving, from the first client device, the plurality of end-user role types in a SQL format;

receiving, from the first client device, the SQL UDFs to apply to the database object upon a request to the database object being received from at least one of the plurality of end-user role types; and

storing the plurality of end-user role types and corresponding SQL UDFs as the share masking policy for modifying data of the database object.

9. The method of claim 1 , wherein:

the share masking policy is a first share masking policy; and

the database object is a database view that is mapped to the share masking policy, the database view incorporating data from a database table that is mapped to a second share masking policy.

10. The method of claim 9 , wherein the second share masking policy is implemented on the database table to generate masked table data that is incorporated in the database view, wherein the database view that includes the masked table data is further masked according to the share masking policy to generate the masked data that is displayed on the second client device.

11. A system comprising:

one or more processors of a machine; and

a memory storing instructions that, when executed by the one or more processors, cause the machine to perform operations comprising:

identifying a database object on a network site;

receiving, from a first client device of a first end-user of the network site, a share masking policy for modifying data in the database object, the share masking policy comprising a plurality of database user defined functions (UDFs) to initiate masking operations on the database object in response to one or more of a plurality of end-user role types requesting access to the database object on the network site, each of the plurality of end-user role types being mapped, by the first end-user of the network site, to a different database UDF of the plurality of database UDFs;

receiving a request to access the database object from a second client device of a second end-user;

determining that an end-user role of the second end-user matches one of the plurality of end-user role types in the share masking policy;

applying the one of the plurality of database UDFs on the database object to generate masked data; and

causing, on the second client device, a presentation of the masked data.

12. The system of claim 11 , wherein the request from the second client device comprises a query.

13. The system of claim 12 , wherein the query comprises a select statement, and wherein the select statement is applied to the masked data.

14. The system of claim 11 , wherein the database object is stored in a first database instance managed by the first end-user, wherein the masked data is hosted on a second database instance managed by the second end-user without copying the database object from the first database instance to the second database instance.

15. The system of claim 11 , wherein the database object comprises is a database view that includes data from one or more external tables that are read-only tables.

16. The system of claim 11 , wherein the share masking policy is received in structured query language (SQL) format and stored in a share masking database.

17. The system of claim 11 , wherein the share masking policy is mapped to the database object.

18. The system of claim 11 , wherein the plurality of database UDFs are SQL UDFs, and wherein the operations further comprises:

receiving, from the first client device, the plurality of end-user role types in a SQL format;

receiving, from the first client device, the SQL UDFs to apply to the database object upon a request to the database object being received from at least one of the plurality of end-user role types; and

storing the plurality of end-user role types and corresponding SQL UDFs as the share masking policy for modifying data of the database object.

19. The system of claim 11 , wherein:

the share masking policy is a first share masking policy; and

the database object is a database view that is mapped to the share masking policy, the database view incorporating data from a database table that is mapped to a second share masking policy.

20. The system of claim 19 , wherein the second share masking policy is implemented on the database table to generate masked table data that is incorporated in the database view, wherein the database view that includes the masked table data is further masked according to the share masking policy to generate the masked data that is displayed on the second client device.

21. A machine-readable storage device embodying instructions that, when executed by a machine, cause the machine to perform operations comprising:

identifying a database object on a network site;

receiving, from a first client device of a first end-user of the network site, a share masking policy for modifying data in the database object, the share masking policy comprising a plurality of database user defined functions (UDFs) to initiate masking operations on the database object in response to one or more of a plurality of end-user role types requesting access to the database object on the network site, each of the plurality of end-user role types being mapped, by the first end-user of the network site, to a different database UDF of the plurality of database UDFs;

receiving a request to access the database object from a second client device of a second end-user;

determining that an end-user role of the second end-user matches one of the plurality of end-user role types in the share masking policy;

applying the one of the plurality of database UDFs on the database object to generate masked data; and

causing, on the second client device, a presentation of the masked data.

22. The machine-readable storage device of claim 21 , wherein the request from the second client device comprises a query.

23. The machine-readable storage device of claim 22 , wherein the query comprises a select statement, and wherein the select statement is applied to the masked data.

24. The machine-readable storage device of claim 21 , wherein the database object is stored in a first database instance managed by the first end-user, wherein the masked data is hosted on a second database instance managed by the second end-user without copying the database object from the first database instance to the second database instance.

25. The machine-readable storage device of claim 21 , wherein the database object comprises is a database view that includes data from one or more external tables that are read-only tables.

26. The machine-readable storage device of claim 21 , wherein the share masking policy is received in structured query language (SQL) format and stored in a share masking database.

27. The machine-readable storage device of claim 21 , wherein the share masking policy is mapped to the database object.

28. The machine-readable storage device of claim 21 , wherein the plurality of database UDFs are SQL UDFs, and wherein the operations further comprises:

receiving, from the first client device, the plurality of end-user role types in a SQL format;

receiving, from the first client device, the SQL UDFs to apply to the database object upon a request to the database object being received from at least one of the plurality of end-user role types; and

storing the plurality of end-user role types and corresponding SQL UDFs as the share masking policy for modifying data of the database object.

29. The machine-readable storage device of claim 21 , wherein:

the share masking policy is a first share masking policy; and

the database object is a database view that is mapped to the share masking policy, the database view incorporating data from a database table that is mapped to a second share masking policy.

30. The machine-readable storage device of claim 29 , wherein the second share masking policy is implemented on the database table to generate masked table data that is incorporated in the database view, wherein the database view that includes the masked table data is further masked according to the share masking policy to generate the masked data that is displayed on the second client device.