Checking if a user has a role (FGAC)

Question

Hi!
I am implementing Fine Grained Access Control on a table and in my policy function I do not want to restrict the amount of result data on a select if the current user has a certain role (otherwise I want to).
My idea was to check USER_ROLE_PRIVS/ROLE_ROLE_PRIVS for the role, but the stored procedure runs with definer-rights, so that won't help.
Running the procedure with invoker-rights won't help either, since not the current user is the invoker of the policy function but the DB system (user sys?).
And finally, the definer of the policy function does not have DBA privs, so I can't select the DBA_* views to check if the current user has the role.
Is there another way to check if the current user that is known inside the policy function by the USER variable has a certain role?
Thanks for your help!
Marcus

Answer 1

Hi Frank,
thanks for your answer!
Frank Kulash wrote:
Policy functions are run by the user who queries or tries to do DML on the table.I don't see that this is happening. Here's my test case:CREATE OR REPLACE FUNCTION CU_is_member_of
(v_role IN VARCHAR2) RETURN NUMBER
AUTHID CURRENT_USER
is
v_res VARCHAR2(255);
begin
SELECT COUNT(*)
INTO v_res
FROM
(SELECT GRANTED_ROLE FROM USER_ROLE_PRIVS
UNION
select GRANTED_ROLE from role_role_privs)
WHERE UPPER(GRANTED_ROLE)=UPPER(v_role);
RETURN to_number(v_res);
end;
CREATE OR REPLACE FUNCTION POLIFUNC_PARTTYPES_WRITE
(p_schemaname IN varchar2, p_tablename IN varchar2)
RETURN VARCHAR2
IS
BEGIN
IF USER=p_schemaname
THEN RETURN '';
ELSE
BEGIN
if SYSWM_TOOL.CU_is_member_of('#ACT#WMT_MANAGE_PARTTYPES')=1
THEN RETURN ''; -- *****
ELSE
BEGIN
RETURN '1=0';
END;
end if;
end;
END IF;
END;
CALL SYS.DBMS_RLS.ADD_POLICY('SYSWM_TOOL', 'TBL_PARTTYPES', 'POL_PARTTYPES', 'SYSWM_TOOL', 'POLIFUNC_PARTTYPES_WRITE', 'select'); --TODO: SELECT->UPDATE,INSERT,DELETE
If the policy function is run by the user who queries, then I would expect that a user who has the role querying table TBL_PARTTYPES would see all entries since he would run into the line marked with *****.
SQL> select SYSWM_TOOL.CU_is_member_of('#ACT#WMT_MANAGE_PARTTYPES') FROM DUAL;
SYSWM_TOOL.CU_IS_MEMBER_OF('#ACT#WMT_MANAGE_PARTTYPES')
1
SQL> SELECT COUNT(*)
2 FROM
3 (SELECT GRANTED_ROLE FROM USER_ROLE_PRIVS
4 UNION
5 select GRANTED_ROLE from role_role_privs)
6 WHERE UPPER(GRANTED_ROLE)=UPPER('#ACT#WMT_MANAGE_PARTTYPES');
COUNT(*)
1
So, the current user has the role and the stored function CU_IS_MEMBER_OF works correctly. However:
SQL> select count(*) from syswm_tool.tbl_parttypes;
COUNT(*)
0
What am I missing here?
Marcus