Creating security similar to Oracle Apps

Question

We have an application that has security similar to Oracle Apps. i.e. maintaining the users and roles (responsibilities) within our application. Discoverer has a special login mechanism for Oracle Apps users. Is there a way to configure Discoverer to work with other application which has similar secuirity mechanism?

Answer 1

Hi Maruthi
I'm afraid I have no documentation to point you at because this was done for a specific client and I have just not had the time to put together some generic documents. I can't use the client's documents because that would be unethical and has pictures of their data.
Nevertheless, here is an overview.
1. Look at all of the Oracle base tables and determine which ones have one of the following: ORG_ID, Set of Books ID (SOB_ID) or Chart of Accounts ID (COA_ID).
2. Look at the same tables and run some scripts such as this: SELECT COUNT(*) FROM TABLE
3. For all such tables that have more than say 200,000 rows add one partition for each ORG_ID, SOB_ID or COD_ID
4. As you know, when a user logs in using an Apps account, the system sets a SYS_CONTEXT variable identifying the ORG_ID that user has access to. This is fine for tables that have an ORG_ID, but for those which only have a SOB_ID or COA_ID you can't use the ORG_ID. Therefore, what you do is create a new table, let's call it ORG_ORGANIZATIONS, that links an ORG_ID with its associated SOB_ID and COA_ID. The table is indexed on the ORG_ID.
5. Create one function per type, thus one for ORG_ID, SOB_ID and COA_ID.
For ORG_ID - function named 'DP_ORG_SECFUNC, the heart of the function is:
select substr(userenv('CLIENT_INFO'),1,5) into x_org_id from dual;
v_statement := 'ORG_ID = '||x_org_id;
return (v_statement);
For SOB_ID - function named 'DP_SOB_SECFUNC, the heart of the function is:
select substr(userenv('CLIENT_INFO'),1,5) into x_org_id from dual;
SELECT SET_OF_BOOKS_ID INTO v_set_of_books_id
FROM ORG_ORGANIZATIONS WHERE ORG_ID = x_org_id;
v_statement := 'SET_OF_BOOKS_ID = '||v_set_of_books_id;
return (v_statement);
For COA_ID - function named 'DP_COA_SECFUNC, the heart of the function is:
select substr(userenv('CLIENT_INFO'),1,5) into x_org_id from dual;
SELECT SET_OF_BOOKS_ID INTO v_chart_of_accounts_id
FROM ORG_ORGANIZATIONS WHERE ORG_ID = x_org_id;
v_statement :='CHART_OF_ACCOUNTS_ID = '||v_chart_of_accounts_id;
return (v_statement);
6. Create a view for each table you want to protect. For example, here is the code that creates a view for AP_INVOICES_ALL
CREATE OR REPLACE VIEW DV_AP_INVOICES_ALL
AS SELECT * FROM AP_INVOICES_ALL ;
SHOW ERRORS
EXEC DBMS_RLS.ADD_POLICY('APPS', 'DV_AP_INVOICES_ALL', 'SecByOrg', 'APPS', 'DP_ORG_SECFUNC', 'SELECT');
Notice how this view is being protected by a policy that when anyone runs a SELECT against this view a VPD policy kicks in and calls the ORG security function.
7. Change all of your code that Discoverer is pointing at to use new views similar to the above.
I hope this helps
Best wishes
Michael Armstrong-Smith
URL: http://learndiscoverer.com
Blog: http://learndiscoverer.blogspot.com