Calling set_context() outside after logon trigger?

Question

Hello all
I'm trying out and learning on using the application context so I tried out the tutorials from: Oracle® Database Security Guide 11g Release 1 (11.1) B28531-06 document (well, very similar examples that is)
I made a procedure which should retreive the employee_id based on the provided user_name (a logical user_name stored in a table) and set an (attribute, value) pair using the dbms_session.set_context()...
select employee_id into emp_id from user_pswd_table where user_name like p_user_name;
DBMS_SESSION.SET_CONTEXT('employee_id_ctx', 'employee_id', emp_id);
and (the tester) the call of the procedure looked like something like this:
declare usernm varchar2(30);
begin
usernm :='user_name_which_will_be_provided';
set_employee_id_pck.set_employee_id_ctx(usernm);
end;
but as it seams like it is only working if the call is made from the after logon on database trigger...if that's the case after the next log on I have the needed information retrieved with select sys_context(...) from dual, but if that's not the case if I call that procedure from anywhere else it results with no_data_found.
Could someone please explain to me why is that???
Thx in advance :D
Ildiko

Answer 1

Sorry Frank, the message for Ildiko.
You found below context example
Login with  user  scott :
-- creation table  dossiers
SQL> connect scott/tiger@oratest
Connected.
--creation de la table dossiers
CREATE TABLE DOSSIER(
  NO_DOS    NUMBER(6),
  DT_DOS    DATE,
  TYPE_DOS  VARCHAR2(50) CHECK (TYPE_DOS IN ('SECRET','NORMAL'))
--Insertions in table dossiers
SQL> insert into dossier values(1,trunc(sysdate),'SECRET');
1 row created.
SQL> insert into dossier values(2,trunc(sysdate),'SECRET');
1 row created.
SQL> insert into dossier values(3,trunc(sysdate),'SECRET');
1 row created.
SQL> insert into dossier values(4,trunc(sysdate),'NORMAL');
1 row created.
SQL> insert into dossier values(5,trunc(sysdate),'NORMAL');
1 row created.
SQL> commit;
Commit complete.
SQL> select * from dossier;
    NO_DOS DT_DOS    TYPE_DOS
         1 22-MAY-07 SECRET
         2 22-MAY-07 SECRET
         3 22-MAY-07 SECRET
         4 22-MAY-07 NORMAL
         5 22-MAY-07 NORMAL
-- Logon with  user sys :
-- Attribution  grants
grant execute on dbms_rls to scott;
grant execute on dbms_session to scott;
grant ADMINISTER DATABASE TRIGGER  to scott;
grant alter session to scott ;
--Logon with user system : 
--Création et attribution  rôles
Create role sec_employe ;
Create role sec_manager;
Grant select, update,insert, delete on scott.dossier to sec_employe ;
Grant select, update,insert, delete on scott.dossier to sec_manager;
Grant sec_manager to scott;
Grant create any context to scott;
grant create table to scott;
grant create procedure to scott;
-Logon with  user  scott :
-- Création context  package 
SQL> create or replace package pkg_dossier_context
  2   is
  3     procedure set_manager;
  4     procedure set_employe;
  5    end;
Package created.
SQL> create or replace package body pkg_dossier_context
  2       as
  3   procedure set_manager
  4      is
  5    begin
  6       dbms_session.set_context('scott_dossier','app_role','manager');
  7    end;
  8           --
  9    procedure set_employe
10       is
11     begin
12       dbms_session.set_context('scott_dossier','app_role','employe');
13     end;
14   end;
Package body created.
-- Création  context
SQL> create or replace context scott_dossier using pkg_dossier_context;
Context created.
-- Création du  package de sécurité
SQL> create or replace package pkg_dossier_sec
  2    as
  3       function dossier_predicate(schema_name in varchar2, object_name in varchar2)
  4         return varchar2;
  5   end;
Package created.
SQL> create or replace package body pkg_dossier_sec
  2     as
  3        function dossier_predicate(schema_name in varchar2,object_name in varchar2)
  4         return varchar2
  5         is
  6                 lv_predicate varchar2(1000):='';
  7         begin
  8                 if sys_context('scott_dossier','app_role') = 'manager' then
  9                         lv_predicate:='type_dos=''SECRET'''; -- a le droit de voir uniquement
                                          --     les dossiers de type SECRET
10                elsif sys_context('scott_dossier','app_role') = 'employe' then
11                        lv_predicate:='type_dos=''NORMAL'''; -- a le droit de voir uniquement
                                      --les dossiers de type NORMAL
12                 else
13                        lv_predicate:='1=2'; -- block access
14                end if;
15               return lv_predicate;
16        end;
17     end;
Package body created.
-- Add la policy (politique)
SQL> begin
2        dbms_rls.add_policy(
3                  object_schema => 'SCOTT',
4                  object_name => 'DOSSIER',
5                  policy_name => 'SCOTT_DOSSIER_POLICY',
6                  function_schema => 'SCOTT',
7                  policy_function => 'pkg_dossier_sec.dossier_predicate',
8                   statement_types => 'select, insert, update, delete',
9                   update_check => TRUE,
10                  enable => TRUE,
11                  static_policy => FALSE);
12   end;
PL/SQL procedure successfully completed.
-- Création du trigger on logon
SQL>  create or replace trigger scott_logon_trigger
  2     after logon on database
  3    declare
  4     NB VARCHAR2(30) ;
  5   begin
  6       select granted_role
  7        into nb
  8        from dba_role_privs
  9        where grantee='SCOTT' and granted_role='SEC_MANAGER' ;
10        pkg_dossier_context.set_manager;
11      exception
12         when no_data_found then
13         pkg_dossier_context.set_employe;
14   end;
Trigger created.
PL/SQL procedure successfully completed.
SQL> SELECT * FROM DOSSIER;
    NO_DOS DT_DOS    TYPE_DOS
         1 22-MAY-07 SECRET
         2 22-MAY-07 SECRET
         3 22-MAY-07 SECRET
Explication :
Scott a le rôle sec_manager donc il a le droit de voir uniquement  les dossiers  de type SECRET,
une clause de restriction  se rajoute à ma requête initiale,
elle devient :SELECT * FROM DOSSIERS  WHERE  type_dos='SECRET' ;
-- Connect with user system :  
SQL> revoke sec_manager from scott;
Revoke succeeded.
SQL> grant sec_employe to scott;
Grant succeeded.
--Connect with  user  scott :
SQL> connect scott/tiger@oratest;
Connected.
SQL> select * from dossier;
    NO_DOS DT_DOS    TYPE_DOS
         4 22-MAY-07 NORMAL
         5 22-MAY-07 NORMAL
--Pour enlever le policy
SQL>  begin
  2          dbms_rls.drop_policy(
  3           object_schema => 'SCOTT',
  4           object_name => 'DOSSIER',
  5           policy_name => 'SCOTT_DOSSIER_POLICY');
  6   end;
PL/SQL procedure successfully completed.
SQL> select * from dossier;
    NO_DOS DT_DOS    TYPE_DOS
         1 22-MAY-07 SECRET
         2 22-MAY-07 SECRET
         3 22-MAY-07 SECRET
         4 22-MAY-07 NORMAL
         5 22-MAY-07 NORMALEdited by: Salim Chelabi on 2008-12-16 10:54
Edited by: Salim Chelabi on 2008-12-16 11:26