Encrypt stored procedure
Hi,
How I can ENcrypt stored procedure in oracle?
Thanks.
One caveat that the documentation doesn't emphasize nearly strongly enough IMHO is the fact that there is no way to unwrap wrapped code, so you have to make sure that everything is in external source control.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC
Similar Messages
-
Get error message from a nested/encrypted stored procedure
Hi,
I have an encrypted procedure, that is used inside my 'own' complex procedure as:
Begin try
Begin tran
Do a lot
insert into #tmp exec xp_encryptedSP
Do a lot more
commit tran
end try
begin catch
print ERROR_MESSAGE()
rollback tran
end catch
Some error occur on the insert into #tmp exec xp_encryptedSP row, and in this case it's correct that the error occur, but:
If I run only exec xp_encryptedSP in query analyzer, I can see the root cause error message,
but in my complex procedure all I get is:
Cannot use the ROLLBACK statement within an INSERT-EXEC statement.
I have tried to enclose the insert into #tmp exec xp_encryptedSP in an own try block, but all I get is the message above.
Please help
/Magnus
Magnus BurkNo, the error message has nothing to do with the fact that the procedure obfuscated. It is a limitation of INSERT-EXEC. A quite silly one, since a consequence of the error is that the transaction is rolled back...
There are better ways to share data between stored procedures, but most of them assumes that you can change the procedure you call, and obviously this is not possible since this is a vendor procedure.
So it looks like you are in for heavy artillery, that is the CLR. See here for an example:
http://www.sommarskog.se/share_data.html#CLR
I should warn you in advance that error handling when the CLR is involved is also a very difficult thing.
Erland Sommarskog, SQL Server MVP, [email protected] -
PowerShell - scripting - skip Encrypted\CLR Stored Procedures
Hi all,
Forgot where I got the code below from but, how would I skip Encrypted\CLR procedures because, I get error below...
Message
Executed as user: Loginname A job step received an error at line 81 in a PowerShell script. The corresponding line is '
$MyScripter.Script($proc)|out-null'. Correct the script and reschedule the job. The error information returned by PowerShell is: 'Exception calling "Script" with "1" argument(s): "The StoredProcedure '[dbo].[myrpocname]'
cannot be scripted as its data is not accessible." '. Process Exit Code -1. The step failed.
#STORED PROCEDURES
if($procs -ne $null)
foreach ($proc in $procs)
#Assuming that all non-system stored procs have proper naming convention and don''t use prefixes like "sp_"
if ( $proc.Name.IndexOf("sp_") -eq -1 -and $proc.Name.IndexOf("xp_") -eq -1 -and $proc.Name.IndexOf("dt_") -eq -1)
$fileName = $proc.name
"Scripting SP $fileName"
$scriptfile = "$rootDrive\DatabaseScripts\$sqlDatabaseName\$strDate\StoredProcedures\$filename.sql"
New-Item $rootDrive\DatabaseScripts -type directory -force | out-null
New-Item $rootDrive\DatabaseScripts\$sqlDatabaseName -type directory -force | out-null
New-Item $rootDrive\DatabaseScripts\$sqlDatabaseName\$strDate -type directory -force | out-null
New-Item $rootDrive\DatabaseScripts\$sqlDatabaseName\$strDate\StoredProcedures -type directory -force | out-null
# SetScriptOptions
$MyScripter.Options.FileName = $scriptfile
#AppendTofile has to be ''true'' in order that all the procs'' scripts will be appended at the end
$MyScripter.Options.AppendToFile = "true"
$MyScripter.Script($proc)|out-null
Thanks
gv
SwordYou can exclude encrypted stored procedure using $_.IsEncrypted member.
$storedProcs = $db.StoredProcedures | Where-object { $_.schema -eq $schema -and -not $_.IsSystemObject -and -not $_.IsEncrypted}
$server = "localhost"
$database = "PowerSQL"
$output_path = "F:\PowerSQL\"
$schema = "dbo"
$storedProcs_path = "$output_path\StoredProcedure\"
[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.SMO") | out-null
$srv = New-Object "Microsoft.SqlServer.Management.SMO.Server" $server
$db = New-Object ("Microsoft.SqlServer.Management.SMO.Database")
$tbl = New-Object ("Microsoft.SqlServer.Management.SMO.Table")
$scripter = New-Object ("Microsoft.SqlServer.Management.SMO.Scripter") ($server)
# Get the database and table objects
$db = $srv.Databases[$database]
$storedProcs = $db.StoredProcedures | Where-object { $_.schema -eq $schema -and -not $_.IsSystemObject -and -not $_.IsEncrypted}
# Set scripter options to ensure only data is scripted
$scripter.Options.ScriptSchema = $true;
$scripter.Options.ScriptData = $false;
#Exclude GOs after every line
$scripter.Options.NoCommandTerminator = $false;
$scripter.Options.ToFileOnly = $true
$scripter.Options.AllowSystemObjects = $false
$scripter.Options.Permissions = $true
$scripter.Options.DriAllConstraints = $true
$scripter.Options.SchemaQualify = $true
$scripter.Options.AnsiFile = $true
$scripter.Options.EnforceScriptingOptions = $true
function CopyObjectsToFiles($objects, $outDir) {
if (-not (Test-Path $outDir)) {
[System.IO.Directory]::CreateDirectory($outDir)
foreach ($o in $objects) {
if ($o -ne $null) {
$schemaPrefix = ""
if ($o.Schema -ne $null -and $o.Schema -ne "") {
$schemaPrefix = $o.Schema + "."
$scripter.Options.FileName = $outDir + $schemaPrefix + $o.Name + ".sql"
Write-Host "Writing " $scripter.Options.FileName -ErrorAction silentlycontinue
$scripter.EnumScript($o)
# Output the scripts
CopyObjectsToFiles $storedProcs $storedProcs_path
Write-Host "Finished at" (Get-Date)
-Prashanth -
Encrypt / Decrypt Procedure in PL/SQL
Hi,
Is using WRAP the only way to Encrypt Stored Procedure Code in PL/SQL? The requirement is that for a Product Implementation, the client would be provided with code base and application owners do not wish to reveal the business logic embedded in the Stored Procedures & Packages.
-ChinmayThanks - will proceed with using WRAP then.
By the way - I found a nice writeup on WRAP Utility - http://www.databasejournal.com/features/oracle/article.php/3382331
~Chinmay -
Decrypt the Encrpted Stored procedure and views
Hi,
Anybody can help me, how to decrypt the encrypted stored procedure in SQL server.?They are not encrypted. They are obfuscated. ApexSQL can show you the source code with the wink of an eye.
But before you do that - if this is a vendor application, check your license agreement.
Erland Sommarskog, SQL Server MVP, [email protected] -
How to encrypt the source code of stored procedures ?
Is it possible to encrypt the source code of the stored procedures so no one can read the content. I want to deliver a compiled code not the source
Database 8i and later
thanks in advanceWrap Utility<br>
<br>
Nicolas. -
Stored procedure with encryption?
Hallo,
Is there a opportunity, to encrypt a stored procedure in Oracle 9i like in MS SQL Server?
Can I hide the content of a stored procedure, so not everbody is able to see the implementation?
When yes, how?
Best regards
Stephan SchneiderYou can hide your source by Wrapping. It is a very old feature of Oracle (probably it was there in Oracle 7.3 or before also).
http://download-west.oracle.com/docs/cd/A87860_01/doc/appdev.817/a77069/c_wrap.htm#1859 -
URGENT: Java stored procedure on oracle 92 database is not working
Hi,
I am having an issue regarding java stored procedures. I have created a java class that uses the bouncycastleprovider ( bcprov-jdk13-141.jar ) to encrypt strings. I tested against the version of the java virtual machine that comes bundled with oracle and it works perfectly. I then used JDeveloper to load the class on the database with the resolve, noverify and order flags checked and it shows no errors but when I try to execute the stored procedure it throws the following exception:
java.lang.ExceptionInInitializerError:
java.lang.SecurityException: Cannot set up certs for trusted CAs: java.net.MalformedURLException: no protocol: US_export_policy.jar
at javax.crypto.SunJCE_b.<clinit>(DashoA6275)
at javax.crypto.Cipher.a(DashoA6275)
at javax.crypto.Cipher.getInstance(DashoA6275)
at RijndaelEnhanced.encrypt(RijndaelEnhanced.java:57)
at RijndaelEnhanced.encrypt(RijndaelEnhanced.java:73)
I loaded jce1_2_2.jar, sunjce_provider.jar, bcprov-jdk13-141.jar. Also replaced the US_export_policy.jar, local_policy.jar with the unrestrictive version. I add the security provider dinamically with a call to Security.insertProviderAt(new org.bouncycastle.jce.provider.BouncyCastleProvider(), 2);
I also did a select on the user_objects table and all the classes are in VALID status.
When I run my application using the java virtual machine that is located under C:\Oracle\oracli9i\jdk\jre\bin directory it works fine but when I try to execute on the database it won't work. I found a bug that was if the jce1_2_1.jar file existed in the C:\Oracle\oracli9i\jdk\jre\lib\ext directory ( even if it's extension is renamed ) it won't work because the certification file had expired but I don't know if this has anything to do with this error.
Am I missing something?
Please I need an urgent solution to this problem.
Thanks in advance.
Bruno OliveiraSomeoneElse wrote:
Waaaaahhhhhhh!I was just thinking the same thing.... ya beat me to it...
To the OP:
As an up and coming DB Developer who now works for a small tech firm straight outta college, I can tell you for sure that you will definitely not get anywhere in your impatient life... look behind your back you miserable dude, your job might be in danger since ya got a bad attitude AND you can't figure out an error you are getting from a Java SP. So instead of helping you, I am going to simply tell you how you SHOULD act in a community of practice.
1. Be nice when looking for help
2. BE NICE WHEN LOOKING FOR HELP!!!
Pretty simple right?
Know what else is really simple? Looking at the topics of each board to make sure ya post in the right board! You people disgust me; somehow getting by in your professional career acting the way you do. I sure hope your "online" persona isn't a reflection of your real attitude towards people, almost pathetic and extremely immature.
Sorry bout the rant, it is Friday, I know :) Didn't get my coffee this morning. Have a good one all!
-Tim -
Calling Stored Procedure from JDBC MSSQL
Ok, I have a stored procedure on a MsSQL Server 2000 data base. I need to call it to encrypt/decrypt passwords, my problem is when I run it from Query Analyzer it works fine but not in JDBC land. Below I have included my code. I have read you need to use a callable statement, but my query has a proc call embedded in it, not just a proc call. Anyone know how this would be accomplished?
THanks in Advance
try {
// create an insert query
StringBuffer query = new StringBuffer();
// add strings and variables to query
query.append("INSERT INTO ");
query.append("users (Company, FirstName, LastName, Username, ");
query.append("Password, Email) ");
query.append("values(");
query.append("'" + form.getCompany() + "', ");
query.append("'" + form.getFirstName() + "', ");
query.append("'" + form.getLastName() + "', ");
query.append("'" + form.getUsername() + "', ");
query.append("dbo.fn_sys_encryptpwd('" + form.getPassword() + "', '" + key + "'), " );
query.append("'" + form.getEmail() + "')");
// get the datasource from the From the context
DataSource dataSource = ResourceLocator.getRCDataSource();
// open a connection
Connection conn = dataSource.getConnection();
// make a statement and execute it
CallableStatement statement = conn.prepareCall(query.toString()) ;
//Statement statement = conn.createStatement();
statement.execute();
// Insert has been performed...destroy the statement and connection.
statement.close();
conn.close();
}I tried with Statement first then I tried with the PreparedStatement, but neither one worked. I have inlcuded part of the stackTrace to give you an idea of my problem
Thanks
java.sql.SQLException: [Microsoft][SQLServer 2000 Driver for JDBC][SQLServer]Invalid object name 'dbo.fn_sys_encryptpwd'.
at com.microsoft.jdbc.base.BaseExceptions.createException(Unknown Source
at com.microsoft.jdbc.base.BaseExceptions.getException(Unknown Source)
at com.microsoft.jdbc.sqlserver.tds.TDSRequest.processErrorToken(Unknown
Source)
at com.microsoft.jdbc.sqlserver.tds.TDSRequest.processReplyToken(Unknown
Source)
at com.microsoft.jdbc.sqlserver.tds.TDSExecuteRequest.processReplyToken(
Unknown Source)
at com.microsoft.jdbc.sqlserver.tds.TDSRequest.processReply(Unknown Sour
ce)
at com.microsoft.jdbc.sqlserver.SQLServerImplStatement.getNextResultType
(Unknown Source)
at com.microsoft.jdbc.base.BaseStatement.commonTransitionToState(Unknown
Source)
at com.microsoft.jdbc.base.BaseStatement.postImplExecute(Unknown Source)
at com.microsoft.jdbc.base.BasePreparedStatement.postImplExecute(Unknown
Source)
at com.microsoft.jdbc.base.BaseStatement.commonExecute(Unknown Source)
at com.microsoft.jdbc.base.BaseStatement.executeInternal(Unknown Source)
at com.microsoft.jdbc.base.BasePreparedStatement.execute(Unknown Source)
at org.apache.tomcat.dbcp.dbcp.DelegatingPreparedStatement.execute(Deleg
atingPreparedStatement.java:168)
at com.retailcode.web.data.dao.LoginDAO.createLogin(LoginDAO.java:81)
at com.retailcode.web.submit.SubmissionServlet.postRegister(SubmissionSe
rvlet.java:226)
at com.retailcode.web.submit.SubmissionServlet.doPost(SubmissionServlet.
java:47)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:709)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:252)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:173)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
alve.java:213)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextV
alve.java:178)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.j
ava:126)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.j
ava:105)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVal
ve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
a:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java
:869)
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.p
rocessConnection(Http11BaseProtocol.java:664)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpo
int.java:527)
at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFol
lowerWorkerThread.java:80)
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadP
ool.java:684)
at java.lang.Thread.run(Unknown Source) -
How to create a stored procedure and use it in Crystal reports
Hi All,
Can anyone explain me how to create a stored procedure and use that stored procedure in Crystal reports. As I have few doubts in this process, It would be great if you can explain me with a small stored proc example.
Thanks in advance.If you are using MSSQL SERVER then try creating a stored procedure like this
create proc Name
select * from Table
by executing this in sql query analyzer will create a stored procedure that returns all the data from Table
here is the syntax to create SP
Syntax
CREATE PROC [ EDURE ] procedure_name [ ; number ]
[ { @parameter data_type }
[ VARYING ] [ = default ] [ OUTPUT ]
] [ ,...n ]
[ WITH
{ RECOMPILE | ENCRYPTION | RECOMPILE , ENCRYPTION } ]
[ FOR REPLICATION ]
AS sql_statement [ ...n ]
Now Create new report and create new connection to your database and select stored procedure and add it to the report that shows all the columns and you can place the required fields in the report and refresh the report.
Regards,
Raghavendra
Edited by: Raghavendra Gadhamsetty on Jun 11, 2009 1:45 AM -
How to use signed classes/Jars in Java Stored Procedure?
I am using java encryption API in my java application that I want to deploy as java stored procedure. The API is kept in the signed jar files.
The Application is running in the MS-DOS environment but not in Oracle8i.
It gives me following error.
java.lang.ExceptionInInitializerError: java.lang.SecurityException: Cannot set
up certs for trusted CAs
at javax.crypto.b.<clinit>([DashoPro-V1.2-120198])
at javax.crypto.KeyGenerator.getInstance([DashoPro-V1.2-120198])
at DesKey.GenerateKey(DesKey.java:63)
declare
ERROR at line 1:
ORA-29532: Java call terminated by uncaught Java exception:
java.lang.ExceptionInInitializerError
ORA-06512: at line 4
(Note: I have enabled the java output in SQL Plus editor otherwise it will give only the second part of error that starts from ERROR at line 1:)
please guide me how to solve this problem.
Salman HameedSalman,
If you do not get a reply on this forum, I recommend you post this question on the Oracle JVM discussion forum as well.
In addition, I would recommend checking the documentation for Oracle8i. The Oracle8i Java Developer's Guide, the Java Stored Procedures Guide, and the JDBC Developer's guide may have some information on this topic. You can get to this doc from the OTN Documentation page. Click on Oracle8i, then General Documentation, Release 2 (8.1.6), then scroll down to see the link for the Oracle8i Java Developer's documetation. All of the books mentioned above are available from that link. -
Stored procedure: how to return multline table
Environment: SQL Server 2008 R2, Windows
Tools: MSMS 2008 R2
Code:
CREATE PROCEDURE [dbo].[Cleanup]
(@id CHAR(12)
,@Date DATETIME
,@ID int OUT
,@Ln_ID CHAR(10) OUT
,@qcdate DATETIME OUT
,@P4 VARCHAR(8000)OUT
,@P9 VARCHAR(8000) OUT
,@P11 VARCHAR(8000) OUT
) WITH ENCRYPTION
AS
BEGIN
Update Table_mocha
SET P4=Replace(PE4,RTRIM(Cast(Q_ID as varchar(10))), '')
where id=@id and order_dt=@Date
Update Table_mocha
SET P4 = NullIf(P4,'')
where id=@id and order_dt=@Date
Update Table_mocha
SET P4=LTRIM(RTRIM(P4))
where id=@id and order_dt=@Date
SELECT @id=id, ln_id=@ln_id,@p4=p4, @p9=P9,@p11=P11
where id=@id and order_dt=@Date
Problem: having three updates would cause the database to lock. How would I pass input paramaters for those three updates in SP. How would I update multiple tables, how to avoid database lock, how to return multi-statment table - value (display
table contains multiple records)I prefer to use different stored procedures to do different things.
CREATE PROCEDURE [dbo].usp_updatedata
(@id CHAR(12)
,@Date DATETIME
AS
BEGIN
Update Table_mocha
SET P4=LTRIM(RTRIM(Nullif(Replace(PE4,RTRIM(Cast(Q_ID as varchar(10))), ''),'')))
where id=@id and order_dt=@Date
End
CREATE PROCEDURE [dbo].usp_getData
(@id CHAR(12)
,@Date DATETIME
AS
BEGIN
SET NOCOUNT ON;
SELECT id, ln_id,p4, P9,P11
where id=@id and order_dt=@Date
End -
Reconfigure in stored procedure
Hi,
I'm trying let my users reconfigure my server via a script, but get this error when trying to run as the end user:
Msg 15247, Level 16, State 1, Procedure sp_configure, Line 94
User does not have permission to perform this action.
Msg 5812, Level 14, State 1, Procedure MBMasterAllowConfigure, Line 18
You do not have permission to run the RECONFIGURE statement.
Msg 15123, Level 16, State 1, Procedure sp_configure, Line 51
The configuration option 'xp_cmdshell' does not exist, or it may be an advanced option.
Msg 5812, Level 14, State 1, Procedure MBMasterAllowConfigure, Line 21
You do not have permission to run the RECONFIGURE statement.
I have created a sqluser is master DB (sa_MBserverRole) for only this purpose. My procedure in master looks like this:
ALTER PROCEDURE [dbo].[MBMasterAllowConfigure]
WITH EXECUTE AS 'sa_MBserverRole'
AS
BEGIN
SET NOCOUNT ON;
EXEC sp_configure 'show advanced options', 1
RECONFIGURE
EXEC sp_configure 'xp_cmdshell', 1
RECONFIGURE
END
When logging in as the sa_MBserverRole user running:
use master
select suser_sname()
SELECT
FROM
fn_my_permissions(NULL,
'SERVER');
Giving the result:
sa_MBserverRole
server CONNECT SQL
server ALTER SETTINGS
server VIEW ANY DATABASE
Seems as it doesn't matter who I'm logged in as, since the procedure cannot run the reconfigure command anyhow.
I tried to read Erlands excellent article at http://www.sommarskog.se/grantperm.html#EXECUTE_AS but maybe it's too complicated for me.
Could someone help me?
Best regards /Magnus
Magnus BurkHi,
I have now succeeded to read and use your code/article. Thanks a lot!
I ended up with a trigger calling an SP instead of function, as you recommended Erland.
I used this complete code:
--STEP 1
-- If they exists, remove files C:\temp\cert\saMBCert.cer and C:\temp\cert\saMBCert.pvk
--STEP 2
-- This steps create all necessary users, cert, singings to make this work
/******************* P R I M A R Y D B ******************/
use Control_Test
DROP SIGNATURE FROM MB_CheckOtherDBDemo BY CERTIFICATE sa_MBCert
DROP USER sa_MB
DROP CERTIFICATE sa_MBCert
DROP PROCEDURE [dbo].[MB_CheckOtherDBDemo]
CREATE CERTIFICATE sa_MBCert
ENCRYPTION BY PASSWORD = 'My pwd 2014' WITH SUBJECT = 'cross DB cert',
START_DATE = '05/07/2014', EXPIRY_DATE = '10/31/2025';
CREATE USER sa_MB FROM CERTIFICATE sa_MBCert
GO
CREATE PROCEDURE [dbo].[MB_CheckOtherDBDemo]
AS
BEGIN
declare @sqlstring nvarchar(500)
set @sqlstring = N'select no from controldk_test.dbo.clientx'
exec sp_executesql @sqlstring
END
GO
GRANT SELECT ON clientx TO sa_MB
GRANT EXECUTE ON MB_CheckOtherDBDemo TO Lindgren
GRANT EXECUTE ON MB_CheckOtherDBDemo TO sa_MB
ADD SIGNATURE TO MB_CheckOtherDBDemo BY CERTIFICATE sa_MBCert
WITH PASSWORD = 'My pwd 2014'
BACKUP CERTIFICATE sa_MBCert TO FILE = 'C:\Temp\cert\saMBCert.cer'
WITH PRIVATE KEY (FILE = 'C:\Temp\cert\saMBCert.pvk' ,
ENCRYPTION BY PASSWORD = 'My pwd 2014',
DECRYPTION BY PASSWORD = 'My pwd 2014')
/******************* O T H E R D B ******************/
USE ControlDK_Test
DROP USER sa_MB
DROP CERTIFICATE sa_MBCert
CREATE CERTIFICATE sa_MBCert FROM FILE = 'C:\temp\cert\saMBCert.cer'
WITH PRIVATE KEY (FILE = 'C:\temp\cert\saMBCert.pvk',
DECRYPTION BY PASSWORD = 'My pwd 2014',
ENCRYPTION BY PASSWORD = 'My pwd 2014')
CREATE USER sa_MB FROM CERTIFICATE sa_MBCert
GRANT SELECT ON clientx TO sa_MB
GRANT SELECT ON objectx TO sa_MB
--STEP 3
-- This step is when changing the stored procedure
USE Control_Test
GO
ALTER PROCEDURE [dbo].[MB_CheckOtherDBDemo]
@objtype int, -- -1=cid, 1-8=object 1-8
@objval varchar(10)
AS
BEGIN
declare @sqlcrit varchar(100)
if @objtype not in (-1,1,2) return 0
if @objtype=-1 set @sqlcrit='clientx where no='+@objval
if @objtype in (1,2) set @sqlcrit='objectx where no='+cast(@objtype as char(1))+' and object='+@objval
declare @otherdb varchar(20)
if (select db_Name()) = 'Control' set @otherdb='ControlDK'
if (select db_Name()) = 'ControlDK' set @otherdb='Control'
if (select db_Name()) = 'ControlDK_Test' set @otherdb='Control_Test'
if (select db_Name()) = 'Control_Test' set @otherdb='ControlDK_Test'
declare @count int
DECLARE @ParamDefinition nvarchar(500)
SET @ParamDefinition = N'@countOUT int OUTPUT'
declare @sqlstring nvarchar(500)
set @sqlstring = N'select @countOUT = count(*) from '+@otherdb+'.dbo.'+@sqlcrit
exec sp_executesql @sqlstring, @ParamDefinition, @countOUT=@count OUTPUT
return @count
END
GO
ADD SIGNATURE TO MB_CheckOtherDBDemo BY CERTIFICATE sa_MBCert
WITH PASSWORD = 'My pwd 2014'
Everything seems to work as it should, and I am very happy.
My first question was about RECONFIGURE and xp_cmdshell. I am still using this (with a job every minute), and might change it in the future when time arises ( probably never:-)). Erland: What do you mean with clear the plan cache?
Thanks again, and have a nice weekend
/Magnus
Magnus Burk -
Securely calling stored procedure with APEX URL
I have a web server that needs to call a stored procedure on an Oracle database (v10.2.0.4.0-64bit), and to do so without storing schema credentials on the web server it has been recommended to call the procedure using a URL to APEX, and granting execute privileges on the package storing the procedure to APEX_PUBLIC_USER. However, this allows anyone on the network to call the procedure if they have the URL. Is there any way to make sure that either Apex or the procedure only responds directly to requests from the web server?
Nick,
Assuming you are talking about application server ( not web server ).
It is common practice to create new user on Oracle database (often called proxy user, so you don't have to use schema credentials). Grant this user privileges to call package you need. Then on application server store encrypted credentials for this new user.
Application (java or .net) then connects to Oracle using new user credentials and executes packaged procedure.
Using Apex is the same. You need to have Authentication enabled (hence to store user id and password). If not, it is not secure.
Making any application (including Apex) to respond to request from specific IP is possible by inspecting ip from request header (Apex : UTL_HTTP.GET_HEADER ).
There are problems however:
1.If connection is made by proxy, request ip can change.
2.Hackers can use "ip spoofing" to emulate request from permitted server.
Another option would be to set up proxy server rules, permitting traffic between selected servers only.
HTH
Thomas -
Calling stored procedure from Apex
I am a total newbie at Apex so any help would be appreciated. My situation:
I created Apex app with few forms and reports. Since I want to implement security for some tables, example:
Table Employee has columns email and credit_card_num. These 2 columns are encrypted using DBMS_CRYPTO.
My Oracle Database version in Oracle XE 11g Release 2.
So I have stored procedure and package for encryption and decryption using dbms_crypto.
When I add new employee in APEX form email and credit card number are passed as plain text and saved on that way in database.
1. How can I make it to be saved as encrypted value using package and procedures I've created in the database (to parse the inserted value to function)?
2. Since I am a total dummy and newbie at Apex can anyone explain me how does Apex really work? Is the inserted data sent in plain text or encrypted over network?
Thank you84e45717-06df-499e-a789-5312b7434a74 wrote:
1. How can I make it to be saved as encrypted value using package and procedures I've created in the database (to parse the inserted value to function)?
You have a few options. You can create a Process (after submit process) that calls your code.
For example, if your form is on Page 2 and you're saving the EMP table your process could look like this:
begin
app_util.emp_save_secure(p_EMPNO => :P2_EMPNO
, p_ename => :P2_ENAME
, p_deptno => :P2_DEPTNO);
end;
Here of course app_util is your own package (with any name you want) and emp_save_secure is the procedure that will receive the params to save.
You could also use the APEX wizard to create a form on the Procedure then edit the code as you need. It would be almost the same result, but probably less typing and less typos.
2. Since I am a total dummy and newbie at Apex can anyone explain me how does Apex really work? Is the inserted data sent in plain text or encrypted over network?
Thank you
Like any web page, if your connection is done with HTTPS then the data from the browser to the webserver will be encrypted and that's all completely transparent to you. If your call is HTTP then it will be done in clear text.
To setup an SSL connection that uses HTTPS you'll need to create a certificate on the server and configure HTTPS. This is better done by a DBA that knows what they are doing.
Thanks
-Jorge
http://rimblas.com/blog/
Maybe you are looking for
-
Format of Calendar (Monday in First Column)
When viewing the Calendar on my iPhone in month-view mode, the first column on the left is Monday, instead of Sunday. How do you reconfigure the view so that Sunday is the first column. My phone is a 3G running iOS 4.1.
-
i have been trying to create an apple ID for the past 2 days and cannot succeed : it states an unknown error has occurred and no ID is created. What to do?
-
How to get rid of mail number on e-mail icon?
How do I get rid of the red mail count number from e-mail icon?
-
Hi Experts, I need your suggestion in the following scenario regarding the mapping. We have a file to idoc scenario from third party system to SAP via XI in which one text is coming contains more than 70 chars, but as length in the idoc (sap side) is
-
Oracle XSLT Transformation not preserving space in text element
If we have a BPEL process which is calling a XSLT transformation contains the code similar as below: for Populating an element with white space only <tns:TargetField> <xsl:text disable-output-escaping="yes"> </xsl:text> <!--Note the whitespace , also