ERR-1013 when viewing APEX page

Question

Hey all,
I setup a security policy on one of our data tables to limit the data based on the user that is logged into the APEX application. The users click on a tab to take them to our main query screen (which queries the secure table) and receive this error:
"Error ERR-1013 No privilege for attempted operation by user MONDSHDB. Requires role 5938220274789078, please contact your application administrator."
When they click "Ok" on the error screen, then click the same tab that gave them the error then the page loads correctly.
It seems to happen randomly, but it could just be something that I don't understand. The error can't be recreated consistently, but it is happening. Today I witnessed 8 different users get the error, but then it went away.
The parsing schema of the application is APPL_USER.
Here is the policy function_
FUNCTION DOCUMENT_TABLE_POLICY (object_schema IN VARCHAR2 DEFAULT NULL
,object_name IN VARCHAR2 DEFAULT NULL)
RETURN VARCHAR2 IS
v_nt_seq NUMBER;
BEGIN
IF user IN ('APPL_USER','CR_USER') OR INSTR(user, 'ITFC_') = 1 THEN
RETURN NULL;
END IF;
IF V('APP_USER') IS NOT NULL THEN
IF V('F_NT_SEQ') IS NOT NULL THEN
v_nt_seq := V('F_NT_SEQ');
ELSE
BEGIN
SELECT NT_SEQ
INTO v_nt_seq
FROM APPL_USERS
WHERE UPPER(NT_ID) = UPPER(V('APP_USER'));
EXCEPTION
WHEN OTHERS THEN
IF user IN ('APPL_USER','CR_USER') OR INSTR(user, 'ITFC_') = 1 THEN
RETURN NULL;
ELSE
RETURN '1=0';
END IF;
END;
END IF;
RETURN '(DOCUMENT_TYPE, MANAGED_BY_ELEMENT, PROGRAM_CODE, CONTRACT_NUMBER) IN (SELECT DISTINCT R.DOCUMENT_TYPE, USL.ELEMENT, USL.PROGRAM_CODE, USL.CONTRACT_NUMBER FROM APPL_USERS_SECURITY_LINK USL, APPL_SECURITY_ROLES R WHERE R.SECURITY_ROLE_SEQ = USL.SECURITY_ROLE_SEQ AND USL.NT_SEQ = ' || TO_CHAR(v_nt_seq) || ')';
END IF;
--UNAUTHORIZED USERS CAN SEE NO DATA
RETURN '1=0';
END;
I applied the policy to the table by doing_
BEGIN
DBMS_RLS.ADD_POLICY(
object_schema => 'APPL_USER'
,object_name => 'APPL_DOCUMENT'
,policy_name => 'APPL_DOCUMENT_POLICY'
,function_schema => 'APPL_USER'
,policy_function=> 'APPL_SECURITY.DOCUMENT_TABLE_POLICY'
END;
Any idea what this error means or what is causing it?
Can I change my policy function to prevent this?
Thanks,
Jonathan Hart
APEX 3.1.1
Oracle DB 10.2.0.3.0

Answer 1

Hey all,
I setup a security policy on one of our data tables to limit the data based on the user that is logged into the APEX application. The users click on a tab to take them to our main query screen (which queries the secure table) and receive this error:
"Error ERR-1013 No privilege for attempted operation by user MONDSHDB. Requires role 5938220274789078, please contact your application administrator."
When they click "Ok" on the error screen, then click the same tab that gave them the error then the page loads correctly.
It seems to happen randomly, but it could just be something that I don't understand. The error can't be recreated consistently, but it is happening. Today I witnessed 8 different users get the error, but then it went away.
The parsing schema of the application is APPL_USER.
Here is the policy function_
FUNCTION DOCUMENT_TABLE_POLICY (object_schema IN VARCHAR2 DEFAULT NULL
,object_name IN VARCHAR2 DEFAULT NULL)
RETURN VARCHAR2 IS
v_nt_seq NUMBER;
BEGIN
IF user IN ('APPL_USER','CR_USER') OR INSTR(user, 'ITFC_') = 1 THEN
RETURN NULL;
END IF;
IF V('APP_USER') IS NOT NULL THEN
IF V('F_NT_SEQ') IS NOT NULL THEN
v_nt_seq := V('F_NT_SEQ');
ELSE
BEGIN
SELECT NT_SEQ
INTO v_nt_seq
FROM APPL_USERS
WHERE UPPER(NT_ID) = UPPER(V('APP_USER'));
EXCEPTION
WHEN OTHERS THEN
IF user IN ('APPL_USER','CR_USER') OR INSTR(user, 'ITFC_') = 1 THEN
RETURN NULL;
ELSE
RETURN '1=0';
END IF;
END;
END IF;
RETURN '(DOCUMENT_TYPE, MANAGED_BY_ELEMENT, PROGRAM_CODE, CONTRACT_NUMBER) IN (SELECT DISTINCT R.DOCUMENT_TYPE, USL.ELEMENT, USL.PROGRAM_CODE, USL.CONTRACT_NUMBER FROM APPL_USERS_SECURITY_LINK USL, APPL_SECURITY_ROLES R WHERE R.SECURITY_ROLE_SEQ = USL.SECURITY_ROLE_SEQ AND USL.NT_SEQ = ' || TO_CHAR(v_nt_seq) || ')';
END IF;
--UNAUTHORIZED USERS CAN SEE NO DATA
RETURN '1=0';
END;
I applied the policy to the table by doing_
BEGIN
DBMS_RLS.ADD_POLICY(
object_schema => 'APPL_USER'
,object_name => 'APPL_DOCUMENT'
,policy_name => 'APPL_DOCUMENT_POLICY'
,function_schema => 'APPL_USER'
,policy_function=> 'APPL_SECURITY.DOCUMENT_TABLE_POLICY'
END;
Any idea what this error means or what is causing it?
Can I change my policy function to prevent this?
Thanks,
Jonathan Hart
APEX 3.1.1
Oracle DB 10.2.0.3.0