Can a view pass a restricting value to a function as 'IN' value ?

Question

An existing local view 'email_addresses' that used to just query an underlying, local, simple flat table - needs to be replaced.
IE: The old local view performed a "select username,user,email_address from owner.contacts"
It was called remotely, from within a procedure, over a db_link IE:"select * from from email_addresses@db_linkname where username = 'TOM' "
All was well.
The table of email addresses is now no longer available.
The replacement local view in reality, is to perform an LDAP A.D. query to get the email_address for the supplied username - passed as 'username'
in the 'where clause' - see above Example query.
The code for the AD query uses DBMS_LDAP and gets all atributes for a "sAMAccountName", loops through and keeps just the ones I'm interested in. ( I can supply the code for that too if needed.)
The function or procedure performing the dbms_ldap query could return a concatenated string, or a refcursor - whatever can be made to work with the new view (although a concatenated string would also need to be broken back into 3 columns - maybe using tilde as the field seperators?)
The new view will need to call a function or procedure to return the LDAP data , that itself will accept the limiting 'where' in a ad-hoc query .
The limiting 'where' clause is ALWAYS supplied to the view.
To make it easier for someone to help me , I have supplied the following code.
create table ldap_lookup
(username varchar2(50), name varchar2(50), email_address varchar2(50));
insert into ldap_lookup values('Tom','Thomas','[email protected]');
insert into ldap_lookup values('Dick','Richard','[email protected]');
insert into ldap_lookup values('Bill','William','[email protected]');
commit;
set pagesize 9999
set linesize 200
select * from ldap_lookup;
USERNAME                                           NAME                                               EMAIL_ADDRESS
Tom                                                Thomas                                             [email protected]
Dick                                               Richard                                            [email protected]
Bill                                               William                                            [email protected]
3 rows selected.
SQL> create view v_ldap_lookup as select * from ldap_lookup;
View created.
SQL>
Following is the the query I cannot change.
++++++++++++++++++++++++++++++++++++++++++++
SQL> select * from v_ldap_lookup where username = 'Tom';
USERNAME                                           NAME                                               EMAIL_ADDRESS
Tom                                                Thomas                                             [email protected]
1 row selected.
Great!
Varchar route:
===============
create or replace function f_ldap_lookup (username_in varchar2) return varchar2 as
c_test varchar2(2000);
begin
    select username||'~'||name||'~'||EMAIL_ADDRESS into c_test from v_ldap_lookup where upper(USERNAME)=upper(username_in);
    return c_test;
end;
select f_ldap_lookup('tom') from dual;
F_LDAP_LOOKUP('TOM')
[email protected]
1 row selected.
create or replace force view v_ldap_lookup_replcement
as
select f_ldap_lookup('username_in')username from dual;
View created.
SQL> select * from v_ldap_lookup_replcement where username = 'Tom';
no rows selected
Refcursor route:
==================
create or replace function f_ldap_lookup_rc (username_in varchar2) return sys_refcursor as
c_test sys_refcursor;
begin
    open c_test for select username,name,EMAIL_ADDRESS from v_ldap_lookup where upper(USERNAME)=upper(username_in);
    return c_test;
end;
SQL> select F_LDAP_LOOKUP_RC('tom') from dual;
F_LDAP_LOOKUP_RC('TO
CURSOR STATEMENT : 1
CURSOR STATEMENT : 1
USERNAME                                           NAME                                               EMAIL_ADDRESS
Tom                                                Thomas                                             [email protected]
1 row selected.
1 row selected.
SQL> create or replace force view v_ldap_lookup_replcement1
  2  as
  3  select f_ldap_lookup('username_in')username from dual;
View created.
SQL> select * from v_ldap_lookup_replcement1 where username = 'tom';
no rows selectedIs it POSSIBLE to pass through the new view's limiting 'where' value to the underlying function?
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Or will I have to 'Bite-the-bullet' and modify every remote procedure that called the old view, and change it to perform a remote function call via db-link?

Answer 1

vsmith wrote:
Any simple instructions for say:
User does "sqlplus LanLoginName@tnsalias" on their PC (with 10g client tools installed) and it will connect to a Unix DB without any password prompts. Er.. not in our part of the corporate world. SQL*Plus, or MS-Access, or TOAD access to a production database by end-users? That's simply not on.
The DB somehow checks their Lan username from v$process or somewhere against a call to dbms_ldap, and if all's well NOT kill the session? Possible, but not very secure - as that can be spoofed. Not easily (beyond the means of your normal end-user), but you do not need to bind a unique NetBIOS name on that client for the driver to pass that across as part of its connection string. So I'm not sure how comfortable the security people would be with such a solution.
Also, a session cannot kill itself. So it will need to schedule a job or use a DBMS_PIPE or similar to request another process to kill it.
It seems to me that the listener would need to accept the connection attempt and call the dbms_ldap somehow. Maybe that's what OID does. - but only for Kerberos tickets that have been issued from the AD and now passed on from the Client PC.The Listener does not authenticate the Oracle username and password for a session - it is simply there to basically listen for connections and hand these off to dedicated server processes or dispatchers (if shared server is used). So the Listener works on transport level and not application level (e.g. like dealing with encryption of the transport layer).
But then I've never used the Listener with Kerebos/LDAP so I could be wrong here as to the Listener doing authentication....
Yes, a coded application could connect as 'dummy' first, ask from Ldap chacks to be done, set session contexts etc, but what about dumb old sql*plus?In that case, after connecting the same step as the app server needs to be made - a call to the PL/SQL unit that performs the authorisation. Only, without the app layer, there is now no authentication of username and password.
You could built that into PL/SQL too... but then there's the problem with using standard OCI that will result in a clear text username and password being send across the network (as a PL/SQL anonymous block call). Which then requires an encrypted connection between client and server.
This stuff just goes in circles...Yeah.. but I think that is in part that many corporate level security requirements are not realistic and do not meet the actual requirement of securing the network, and most importantly, safeguarding the valid users on it.
Especially if the security is base primarily around Microsoft's concept and implementation of how security should work. That is a recipe for using proprietary stuff that can only seamlessly integrate with other Microsoft products. Microsoft does not only dislike the concept of open standards, they purposefully avoid it, or worse, corrupt it.
Can you give a very quick overview of the NTLM method?Dirty. Not that secure IMO (look for a hacker paper called "+CIFS - Common Insecurities Fail Scrutiny+" by hobbit - old, but in many ways still applicable).
Apache can be build with a NTLM authentication module (just as it supports mod_sso and mod_ldap ) and this allows your app tier (3 tier architecture) to use Apache to do the dirty deed. And that's the extent of how we support NTLM.
Long time ago when still using Oracle v7 on Windows, I recall there was a means to use NTLM authentication with Oracle... no idea how it is supported today and whether or not it requires additional options to be purchased.
Any idea how to duplicate "AD 'Group' accounts of SQL Server" - in Oracle - without buying the Advanced Security Option?Equally long time since I last use SQL-Server.. :-)
I suggest that you consider another forum here on OTN to bounce these questions around. Most members here are here for the SQL and PL/SQL party... security is not exactly an issue that many of us deal with in any extensive way. Thus I doubt that you will get real useful answers here for your problem..