Flex updates at a row level in a grid

I needs to updates row level in a grid for frequent basis, Also i don't want to Refresh the Grid.
Is there any method i can use ?
Using flex Grid -> updates at a row level in a grid

I mean DataGrid. I am trying to change the data rows based on realtime data feed.
First time i'll add all the Employees in the Grid. Later i'll get indivual request will change only Status column.
Is there is any other way i can update with out refresh in datagrid.
<mx:DataGrid
id="dg" height="260" width="900" x="0" y="20">
<mx:columns>
<mx:DataGridColumn headerText="EmpID" dataField="EmpID" width="10" visible="false"/>
<mx:DataGridColumn headerText="Emp Name" dataField="Emp Name" width="110"/>
<mx:DataGridColumn headerText="Status" dataField="Status" width="80"/>
</mx:columns>
</mx:DataGrid>

Similar Messages

How to update UDF based upon the row level dimensions.

Hello Experts,
I have made 4 new udf at Sales Order. Its displaying at Righthand side under General Category.
Now at row level im entering item detail, and other things with 4 profit center vaues.
So i want that if i enter value in those 4 proft center in row level then it should automatically update those 4 udf with that value.
It always happen in Add mode of SO, if SO open in update mode then i can update those udf with other values also, which can be differ then row level profit center values.
If we need to create any trigger or any query for that, then guide me for that.
Regards,

Hi Chintesh,
You can use the option of changing value when the exising column value changes. (also check the option refersh only option)
pls revert in case more help.
Regards,
Datta Kharat

Mutating error : row level BEFORE UPDATE trigger

Hi,
I had an issue on mutating terror(was trying to write a row level BEFORE update trigger), however i got it resolved after refering tom kytes web site. I thought i would share it with everyone, might be helpful for a few... Thanks!
I will be more than happy to learn on further better ways of resolving this issue.
Below I have posted the trigger that was causing this error and the work around for that issue, I created a package and three other triggers to replace row level BEFORE update trigger:
++trigger that was causing this issue:++
CREATE OR REPLACE TRIGGER C_F_BI
BEFORE INSERT ON CONTACT_FUNCTION FOR EACH ROW
declare
cursor function_code_cur ( cur_contact_id CONTACT.Contact_Id%type,
cur_function_type_code CONTACT_FUNCTION.Function_Type_Code%type)
is
select
cft.function_type_code,
cft.multiples_permitted
from
CONTACT_FUNCTION cf,
CONTACT c,
CONTACT_FUNCTION_TYPE cft
where
c.acct_id = (select acct_id from contact where contact_id = cur_contact_id)
and c.contact_id = cf.contact_id
and cf.function_type_code = cft.function_type_code
and cft.function_type_code = cur_function_type_code;
v_function_type_code contact_function_type.function_type_code%type;
v_multiples_permitted contact_function_type.multiples_permitted%type;
E_Multiples_Not_Permitted Exception;
begin
if not function_code_cur%isopen then
open function_code_cur(:new.contact_Id,:new.function_type_code);
end if;
loop
fetch function_code_cur into v_function_type_code, v_multiples_permitted;
exit when not function_code_cur%found;
end loop;
** if the fetch returns a v_multiples_permitted of 'Y' or no record is found, then it is
** ok to add the record. Otherwise raise an error because that function_type is already
** being used at the current acct.
if v_multiples_permitted = 'N' then
raise E_Multiples_Not_Permitted;
end if;
close function_code_cur;
EXCEPTION
when E_Multiples_Not_Permitted then
raise_application_error( -20001,'Multiples not allowed for function type ' ||
v_function_type_code || '. sqlerrm - ' || sqlerrm );
when others then
raise;
end;
++solution for above issue :++
create or replace package state_pkg
is
type ridArray_rec is record(rid rowid, cont_id number, cont_fn_type varchar2(20));
type ridArray is table of ridArray_rec index by binary_integer;
newRows ridArray;
empty ridArray;
end state_pkg;
create or replace trigger contact_function_bu1
before update on contact_function
begin
state_pkg.newRows := state_pkg.empty;
end;
create or replace trigger contact_function_bu2
before update ON CONTACT_FUNCTION FOR EACH ROW
DECLARE
I NUMBER:=0;
begin
I := state_pkg.newRows.count+1;
state_pkg.newRows( I ).rid := :new.rowid;
state_pkg.newRows( I ).cont_id := :new.contact_id;
state_pkg.newRows( I ).cont_fn_type := :new.function_type_code;
end;
create or replace trigger contact_function_bu
after update ON CONTACT_FUNCTION
declare
cursor function_code_cur ( cur_contact_id CONTACT.Contact_Id%type,
cur_function_type_code CONTACT_FUNCTION.Function_Type_Code%type,
rid2 rowid)
is
select
cft.function_type_code,
cft.multiples_permitted
from
CONTACT_FUNCTION cf,
CONTACT c,
CONTACT_FUNCTION_TYPE cft
where
c.acct_id = (select acct_id from contact where contact_id = cur_contact_id)
and c.contact_id = cf.contact_id
and cf.function_type_code = cft.function_type_code
and cft.function_type_code = cur_function_type_code
and cf.rowid = rid2;
v_function_type_code contact_function_type.function_type_code%type;
v_multiples_permitted contact_function_type.multiples_permitted%type;
E_Multiples_Not_Permitted Exception;
begin
for i in 1 .. state_pkg.newRows.count loop
if not function_code_cur%isopen then
open function_code_cur(state_pkg.newRows(i).cont_id, state_pkg.newRows(i).cont_fn_type, state_pkg.newRows(i).rid);
end if;
loop
fetch function_code_cur into v_function_type_code, v_multiples_permitted;
exit when not function_code_cur%found;
end loop;
** if the fetch returns a v_multiples_permitted of 'Y' or no record is found, then it is
** ok to add the record. Otherwise raise an error because that function_type is already
** being used at the current acct.
if v_multiples_permitted = 'N' then
raise E_Multiples_Not_Permitted;
end if;
close function_code_cur;
end loop;
EXCEPTION
when E_Multiples_Not_Permitted then
raise_application_error( -20001,'Multiples not allowed for function type ' ||
v_function_type_code || '. sqlerrm - ' || sqlerrm );
when others then
raise;
end;
/

It seems you could have solved the issue otherwise:
CREATE OR REPLACE TRIGGER c_f_bi
   BEFORE INSERT
   ON contact_function
   FOR EACH ROW
DECLARE
   v_function_type_code        contact_function_type.function_type_code%TYPE;
   v_multiples_permitted       contact_function_type.multiples_permitted%TYPE;
   e_multiples_not_permitted   EXCEPTION;
BEGIN
   BEGIN
      SELECT cft.function_type_code, cft.multiples_permitted
        INTO v_function_type_code, v_multiples_permitted
        FROM contact c, contact_function_type cft
       WHERE c.acct_id = (SELECT acct_id
                            FROM contact
                           WHERE contact_id = :NEW.contact_id)
         AND c.contact_id = :NEW.contact_id
         AND cft.function_type_code = :NEW.function_type_code;
   EXCEPTION
      WHEN NO_DATA_FOUND
      THEN
         v_function_type_code := :NEW.function_type_code;
         v_multiples_permitted := '?';
   END;
** if the query returns a v_multiples_permitted of 'Y' or no record is found, then it is
** ok to add the record. Otherwise raise an error because that function_type is already
** being used at the current acct.
   IF v_multiples_permitted = 'N'
   THEN
      RAISE e_multiples_not_permitted;
   END IF;
EXCEPTION
   WHEN e_multiples_not_permitted
   THEN
      raise_application_error (-20001,
                                  'Multiples not allowed for function type '
                               || v_function_type_code
                               || '. sqlerrm - '
                               || SQLERRM
   WHEN OTHERS
   THEN
      RAISE;
END;
/:p

After update row level trigger help

Hello,
I have to update some data on a table. I need to be able to undo the update just in case something goes wrong after update is comitted. I decided to keep track of updated rows by inserting new and old values on a audit table using UPDATE ROW LEVEL trigger. Everything working fine as I wished, but here is what I am having a problem in separating each bulk of update by a unique ID... I am not talking about any primary key or autogenerated sequence key here.
Audit table inserts values: primary key of table, old value before update, new value after update, and time stamp. Now, I want add one more field on the audit table that indentifies each bulk of UPDATE operation... I tried to use session ID, it works fine, but sometimes I may update two or three times, maybe around same time, on the same day from the same session (timestamp doesn't help me). In that case, each UPDATE operation inserts the same session ID on Audit table. I won't know which update operation populated which row of the audit table.
Can somebody give me how I can resolve this situation. Again, this has to be inside the trigger. Is there any other IDs that I can use? I would appreciate your help. Thanks,

Can you add a table level trigger in addition to your row level trigger? If so, you could do what you want in there. In the new trigger, formulate a unique value (such as session id || sysdate) and store it using dbms_application_info.set_module and set the MODULE to that value. Then, in your row level trigger code, execute dbms_application_info.read_module and pull the MODULE value and insert it into your audit table.
The use of session id || sysdate should be fine (and unique) in this context. You'd just have to know at what time the UPDATE batch occurred that you wanted to undo.
By the way, you could use LogMiner to do what I think you're trying to create with the use of your trigger code and table entries. Recall the Oracle keeps the undo and redo data for every row that is updated in the redo/archive logs. Using LogMiner, you could find and undo any change from any time. Just like your method, you'd have to know when the "bad" thing occurred in order to find the correct log and "mine" it, but all the functionality is there. There's a kinda old, but very good, article by Arup Nanda at http://www.oracle.com/technology/oramag/oracle/05-jul/o45dba.html that reviews how it all works. You may want to look at it to see if you can avoid re-inventing the wheel to meet your needs. Just a thought....
Karen

Row level trigger updating the entire table instead of affected rows

I am using orace 8.1.7. My problem is I have a row level trigger that should fire only once ( and insert a row in my auditing table). But it is doing it for the entire table. This only happens when I have more than two columns in an Update clause. Has anyone run into this problem before. Any help would be highly appreciated.
thanks,
dinesh

create or replace trigger contact_audit
before update or delete on contact
for each row
declare
v_audit_type char(1);
v_audit_item varchar2(64) := 'CONTACT';
v_acct_seqid number;
Begin
if inserting then
v_audit_type := 'I';
elsif updating then
v_audit_type := 'U';
elsif deleting then
v_audit_type := 'D';
end if;
select acct_seqid into v_acct_seqid
from account_contact
where email = :old.contact_email;
insert into audit_event ( id, audit_item, audit_type, audit_date, acct_seqid, col_1, col_2, col_3, col_4, col_5, col_6, col_7, col_8,
col_9, col_10, col_11, col_12, col_13, col_14, col_15, col_16, col_17, col_18, col_19, col_20)
values (audit_event_sq.nextval, v_audit_item, v_audit_type, sysdate, v_acct_seqid, :old.contact_email, :old.contact_type, :old.contact_last, :old.contact_first,
:old.title, :old.address1, :old.address2, :old.address3, :old.city, :old.state, :old.zip_code5, :old.zip_code4, :old.zip_code_barcode, :old.country, :old.phone_no,
:old.phone_ext, :old.receive_info_email_yn, :old.pwd_encrypted, :old.pwd_question, :old.pwd_answer);
End;

Capturing value in after insert or update row level trigger

Hi Experts,
I'm working on EBS 11.5.10 and database 11g. I have trigger-A on wip_discrete_jobs table and trigger-B on wip_requirement_operations table.When ever i create discrete job, it inserts record in both wip_discrete_jobs and wip_requirement_operations.
Note:2 tables are like master-child relation.
Trigger-A: After Insert.Row Level trigger on wip_discrete_jobs
Trigger-B:After Insert,Row Level trigger on wip_requirement_operations
In Trigger A:
I'm capturing wip_entity_id and holding in global variable.
package.variable:=:new.wip_entity_id
In Trigger B:
I'm using the above global variable.
Issue: Let's say i have create discrete job,it's wip_entity_id is 27, but the global variable is holding the previous wip_entity_id(26),not current value.It looks like before trigger A event is complete, trigger B is also in process, i think this could be the reason it's not storing the current wip_entity_id in the global variable.
I need your help how to have the current value in the global variable so that i can use that in the trigger B.
Awaiting response at the earliest.
Thanks

798616 wrote:
Hi Experts,
I'm working on EBS 11.5.10 and database 11g. I have trigger-A on wip_discrete_jobs table and trigger-B on wip_requirement_operations table.When ever i create discrete job, it inserts record in both wip_discrete_jobs and wip_requirement_operations.
Note:2 tables are like master-child relation.
Trigger-A: After Insert.Row Level trigger on wip_discrete_jobs
Trigger-B:After Insert,Row Level trigger on wip_requirement_operations
In Trigger A:
I'm capturing wip_entity_id and holding in global variable.
package.variable:=:new.wip_entity_id
In Trigger B:
I'm using the above global variable.
Issue: Let's say i have create discrete job,it's wip_entity_id is 27, but the global variable is holding the previous wip_entity_id(26),not current value.It looks like before trigger A event is complete, trigger B is also in process, i think this could be the reason it's not storing the current wip_entity_id in the global variable.
I need your help how to have the current value in the global variable so that i can use that in the trigger B.
Awaiting response at the earliest.
ThanksMy head hurts just thinking about how this is being implemented.
What's stopping you from creating a nice and simple procedure to perform all this magic?
Continue with the global/trigger magic at your own peril, as you can hopefully already see ... nothing good will come from it.
Cheers,

Pl sql row level locking with wait ?

Hi,
I am using oracle 10g.
I am new to Oracle locks. I have two tables Table1(id_no, employee, salary) and Table2(id_no, employee, salary).
I need to pull any requested row from Table1 into Table2 only once on demand. I have a procedure to pull data and there could be more than one requests try to call same procedure to pull a row from Table1 into Table2 at any given time.
I coded below to achieve row level lock. if one transaction gets row level lock on Table1 at 2, so other Transactions should wait till the lock is released at line 2 or 5 to avoid duplicates.
But below code is not working, I am getting duplicates when I call this using two concurrent java threads.
How do I control this concurrency issue so that I can avoid duplicate entries in Table2. Could any one please help?
1.begin
2.select 0 into emp_cnt
3.from Table1 where id=id_no
4.for update;
5.update Table1 set employee='xyz'
6.where id=id_no;
7.select count(*) into table2_cnt from Table2 where id=id_no;
8.if(table2_cnt =0) then
9.code to insert above row from Table1 to Table2;
10.end if;
11.commit;
12.End;
Edited by: 980916 on Jan 9, 2013 5:48 PM

Welcome to the forums and welcome to Oracle.
Lets establish one thing right from the beginning ... the Oracle Database is not a Microsoft product.
There is no general reason to use row level locks, you should not want to use row level locks, you don't need row level locks, and you will almost never have any valid reason to consider row level locks.
That said there are two situations were it may be necessary to lock a row prior to an update or delete (possibly in a merge) and in those cases you want to use the built-in SELECT FOR UPDATE syntax. (Demo here: http://www.morganslibrary.org/reference/deadlocks.html#dlfu). But we should be clear here ... one rarely needs to use this locking mechanism as the chances of a collision in a well designed application are essentially zero.
Also as you are new to Oracle please explore the dynamic performance view V$RESERVED_WORDS and do not name objects, columns, etc. with reserved word names not that there is an excuse in any product to name a column "ID." Something Joe Celko has railed about for decades and a tradition I think we should all follow.
In the case of your posted code example (btw please read the FAQ and learn how to use tags) the solution is SELECT FOR UPDATE if locking can be justified which is unlikely.
Edited by: damorgan on Jan 9, 2013 6:11 PM

How to get a row level share lock

Is it possible to acquire a row-level share lock, which would do all of the following?
1. Prevent others from updating that row.
2. Allow others to read that row.
3. Allow others to update other rows in the same table.
I have the following scenario where two transactions need to lock eachother out:
Set-up:
Insert into TABLE_A(value_a) values ('ok');
Insert into TABLE_B(value_b) values ('ok');
Transaction A:
Select value_b from TABLE_B
If value_b = 'ok', update TABLE_A set value_a = 'not ok'
Transaction B:
Select value_a from TABLE_A
If value_a = 'ok', update TABLE_B set value_b = 'not ok'
If transaction A runs first then the end result is "not ok" only in TABLE_A.
If transaction B runs first then the end result is "not ok" only in TABLE_B.
If the two transactions run concurrently, it is possible to get "not ok" in both tables. This is what I would like to prevent.
One way to get what I want is to use "select for update":
Transaction A:
Select value_a from TABLE_A for update
Select value_b from TABLE_B for update
If value_b = 'ok', update TABLE_A set value_a = 'not ok'
Transaction B:
Select value_a from TABLE_A for update
Select value_b from TABLE_B for update
If value_b = 'ok', update TABLE_B set value_a = 'not ok'
This way both transactions won't perform their update unless they know that the result if their select will still be the same after they commit. However, by using "select for update" Transaction A has gained an exclusive lock on the TABLE_B row. If a Transaction C with the same contents as Transaction A happens concurrently, then the two will block eachother even though all they both want is to read data from the same table.
Another way is to use "lock table", however using that would block out not only writes to a specific row, but writes to all rows in the table. (In my example there is only one row, but obviously that's just a simplified example.)
I have looked at the "serializable" isolation level, but that doesn't seem to help because the queries and updates involve more than one table.
I know that "reads don't block writes" is a fundamental part of the Oracle design that makes Oracle what it is, but is there any way I can explicitly make it happen anyway? Or can anyone see some other solution to what I'm trying to achieve?

Let me give a more real-world example to show what I'm talking about.
Imagine a simple bug-reporting OLTP application. Each bug has 3 fields:
1. Description
2. Resolution
3. Status (open/closed)
The application also has some rules:
A. If the Status is "closed", Description and Resolution cannot be changed.
B. In order to change the Status to "closed", both a Description and Resolution must be specified.
Now as long as only one person at a time updates a bug, everything is fine. However, if one person switches the Status to "closed" while another concurrently blanks out the Resolution you end up with a closed bug that has no Resolution. This is why some locking is necessary.
If Description, Resolution, and Status are all stored in the same table row, then it makes sense for each transaction to simply select the whole row FOR UPDATE, and then UPDATE it after it ensures all the rules are passed. However, in my fictional bug-reporting application they are all stored in separate tables. Now, the transaction that is making the change to Resolution could lock the row in the Status table FOR UPDATE (as everyone so far has suggested). Transactions making a similar change to the Description should then also lock the row in the Status table FOR UPDATE for the same reason. The end result of this is that Description changes and Resolution changes lock eachother out (can't happen concurrently, are serialized) when they don't need to be. Description changes and Resolution changes don't affect eachother, but because they both need to (exclusively) lock the same row, they are serialized.
If there was a way to acquire a share lock on the row in the Status table, then Description and Resolution changes would use that and not affect eachother. Status changes would still acquire an exclusive lock on the row, and would be blocked by (and block any further) concurrent Description and Resolution changes. This would be ideal.

Row level locks

Hi All,
Version - Oracle Database 10g Enterprise Edition Release 10.2.0.2.0
I have a card's data in a table. Whenver a two different sessions/threads selects the data sometimes they get the same card.
Now I need to lock the record. If Thred-1 selects then it will lock the first records and thread-2 must select the second record as the first record is locked by thread-1.
I have written a piece of code , at first session it locks one record and when second session select it selects no records.
I have takem MIN group function because I want the cards to be selected in order.
Can you please tell where is my code went wrong or need some changes. Data and code is given below.
SQL> SELECT * FROM crm_pps_cards_sz ORDER BY 1;
CARD_NO          PIN SERIAL_NUMBER DATE_CREATED DATE_MERGED DATE_ALLOCATED DATE_REGISTERED
6338079966430591 9985 9950013661    12/06/2011
6338079973369543 6858 9950013660    12/06/2011
6338079978994154 7144 9950013655    12/06/2011
6338079981471778 7631 9950013654    12/06/2011
6338079986365041 7849 9950013657    12/06/2011
SQL>
Thread - 1
Connected to Oracle Database 10g Enterprise Edition Release 10.2.0.2.0
Connected as crm
SQL> set serveroutput on
SQL>
SQL> DECLARE
2    l_rec crm_pps_cards_sz%ROWTYPE;
3    CURSOR c IS
4      SELECT * FROM crm_pps_cards_sz t WHERE t.card_no =
5      (SELECT MIN(card_no) card FROM crm_pps_cards_sz)
6      FOR UPDATE NOWAIT SKIP LOCKED;
7
8 BEGIN
9    OPEN c;
10    FETCH c
11      INTO l_rec;
12    CLOSE c;
13    dbms_output.put_line('Card Allocated ' || l_rec.card_no);
14
15 END;
16 /
Card Allocated 6338079966430591
PL/SQL procedure successfully completed
SQL>
Thread - 2
Connected to Oracle Database 10g Enterprise Edition Release 10.2.0.2.0
Connected as crm
SQL> set serveroutput on
SQL>
SQL> DECLARE
2    l_rec crm_pps_cards_sz%ROWTYPE;
3    CURSOR c IS
4      SELECT * FROM crm_pps_cards_sz t WHERE t.card_no =
5      (SELECT MIN(card_no) card FROM crm_pps_cards_sz)
6      FOR UPDATE NOWAIT SKIP LOCKED;
7
8 BEGIN
9    OPEN c;
10    FETCH c
11      INTO l_rec;
12    CLOSE c;
13    dbms_output.put_line('Card Allocated ' || l_rec.card_no);
14
15 END;
16 /
Card Allocated
PL/SQL procedure successfully completed
SQL> My concern is that it must allocate in the order
6338079966430591
6338079973369543
....

It is because MIN(ard_no) is able to find value from table which is locked by you thread 1 and thread 1 mentioned NOWAIT thus it thread 2 went out without getting anything.
Please check my reply to your duplicate thread "row level locking" .

How to implement row level security?

Hi all,
There is a database which is for 3 companies to use it and how to use row level security to make sure that they can only manipluate their own data? For example, "employee" table, for each company they just can see their own employees information. How to use dynamic view to do it?
Many Thanks
Amy

Here are two options to achieve what you want.
A. You can do this by coding, that's if you are ready to. Are you? If yes then try the steps below:
1. create a security codes table. Say for example
001 - company a
002 - company b
2. create a security table that will list all users and which company they should have access to. You can also implement this by roles.
3. alter all tables in the application schema to add a security code column. This will be a foreign key reference to table created in 1 above.
4. update all data in the tables according to which company they belong to.
5. write a procedure or package that does a validity check whenever a user requests for data. This procedure/package determines which company data the user has access/rights to.
With this, you should be able to achieve what you want if you do not want to spend on VPD and FGAC. The problem comes where there are users who would have cross access to data from both companies. In this regard, then you have to modify your security table a little bit to handle this.
B. This option i will admit is not so clean. You can also achieve this by two different views for every table in the application schema. And on each of these views, create a private synonym for every user. For illustration purposes:
Table name = Employee.
Create a view employee_a on employee
create a view employee_b on employee
Let's say you have users x and y. X has access to employees of company a and y has access to employees of company b. You can now create private synonyms for each of these users as follows:
create synonym employee on employee_a in x schema.
create synonym employee on employee_b on y schema.
This i have not tried but believe should work.
Hope one of these options serve your purpose.

I want a user to only be able to update/delete the rows they inserted

hi guys,
I have a table 2 users are inserting into. They can also update/delete the rows in the table. However, I do not want them to be able to update/delete the others users row. I only want them to have update/delete at the row level.
how can this be achieved?
thanks

Another idea if you really have just two (or a fixed set of N) users.
Does your table have a generic primary key (PK)?
You could use two (N) sequences having two (N) distinct sets of numbers as e.g user a is using sequences less than 1000000000, the other one values larger or equal to 1000000000.
create sequence <user_a>.pk_seq start with 0;
create sequence <user_b>.pk_seq start with 1000000000;An insert trigger uses <user_a>.pk_seq or <user_b>.pk_seq for generating the PK depending upon the current user for new records.
An update trigger allows updates only, if the PK of the record to be updated is in the range of sequences belonging to the current user.

Using "v" function in row-level triggers

I have row-level triggers that do
l_user := nvl(v('APP_USER'),user);
to get the user that is running the app and record that in the table or wherever.
Since it is a row-level trigger, the "v" function will be called for each and every row even though it is going to be the same.
Is there a way to avoid this repeated execution of the v function?
Thanks

To avoid calls to the V function, put the values in hidden database text items in the HTML DB page and allow the normal insert/update HTML DB process pass it to your triggers. Then you refer to their values in table triggers with the ":new" method. Doing it this way you remove your V function invocations from your table-level triggers so the triggers do not have to determine from what environment they were being fired.
Example: In our applications we track user ID and date/time for row creates and last row modifications. The HTML DB page has a default value of :APP_USER for the row create user ID text item and default of TO_CHAR(SYSDATE,'DD-MON-RR') for the row create date text item. It also has conditional computations with the same values for last row modification user ID and last row modification date.

How to apply row level security against the database administrator

I would like an advice in applying row level security against the database administrator. We need to prevent DBA from editing data in some table rows or have any indication that data was corrupted.
There is no problem in viewing the data so we considered one way hash function or digital signature which will be stored in the same table, but we see following disadvantages:
HASH - DBA may use the same hash function to update the stored data after he changes the sensitive row.
Digital signature - the is a need to manage and keep the private key in a safe place outside of DB
Is there additional ways to achieve the aim?

Does VPD helps to prevent from DBA to edit/view a data in specific rows?Yes.
If I correctly understand, DBA has full access to security policy used by VPD to control the access and can grant himself privileges that I don't want.You can to define which users can be exempt of the politics, for the context or by Grant EXEMPT.
This includes DBAs.
The simple fact of being DBA doesn't guarantee the exemption.
Everything goes to depend of the VPD config.

Row Level Security (VPD)

We are enhancing our corporate security model using VPD fine grain access to allow more flexible policies. This will provide different levels of row level access on each set of mart fact tables (Health Board level access on Mart A, GP Practice level on Mart B etc). We also want different column level security (masking) on common dimensions depending on which mart is being queried, e.g. a user might be allowed to see confidential patient columns when querying Mart A, but not on Mart B.
OID groups hold user attributes, and we can retrieve these via logon trigger and policy functions and then set user contexts accordingly.
When a query is submitted to the database (via Business Objects), it triggers the policy function on a particular mart fact table(s), which applies the particular row level constraint based upon the users context. So far so good. Problem is, when any dimension policy functions are being triggered (at the same time), they need to know which particular Mart is being queried, so that they can retrieve the correct user context to apply either confidential or non-confidential column masking.
I basically need a means of interrogating the SQL before (or as) it reaches the dimension policy functions, from which the function can identify the Mart from the named tables in the SQL FROM list. Is there a way of doing this, or some other mechanism entirely for delivering this level of access control?
One solution is to have a separate dimension view specific to each Mart. A particular view would join to a particular mart (in Business Objects), and the policy function amended for each. However we would rather avoid this as it could mean up to 20 + views for each dimension, and require a substantial maintenance overhead.
Thanks
Simon
Edinburgh

Why would you want a situation where USER1 cannot see any of the data in the table but owns a procedure that allows him to update any row in the table? That would basically defeat the purpose of using VPD-- if USER1 can circumvent the VPD policy in this procedure, USER1 can circumvent the policy in any procedure and can create procedures that allow him to view and manipulate the data.
Can you provide a bit more background about what problem you're trying to solve? Why does USER1 need to own the procedure if USER1 isn't allowed to see any of the data? Are you trying to write a procedure that will apply the caller's VPD policy (i.e. when USER2 calls the procedure, he can only update the rows that his VPD policy allows him to see)? Or do you want the procedure code to bypass the VPD policy entirely? Why are you fine with granting USER2 the ability to bypass the VPD policy but you are not OK granting USER1 that same privilege?
Justin

[Security]   Row-level security in ADF

Hi all,
I want to implement row-level security in my application, the scenario is like this:
There are several users that connect to the application
These users are authenticated in some way (XML file, OID, DB)
When each user wants to access (Select, Update, Delete) an ADF Table, either updatable or read-only, a predefined 'where condition' based on that table and the operation the user wants to do, must be concatenated to his DML, transparent from the user.
So if for example a user queries the Emp Salary table only records with salary < 10K/Month will be fetched from the underlying table. This should be done automatically and not hard-coded in the application.
I have tried VPD and it has some useful features but my problems are:
1) Where and how to define the 'where conditions'?
2) How to attach the 'where conditions' to the executing DML?
3) What is the best way to make DB know which user is really executing DMLs? (Not a single Application Server admin user)
4) What is the best authentication approach?
Any helps will be really appreciated.
S/\EE|)

Hi,
yes you can. Database proxy user is setup in the prepare session method as well and EUS can be configured to take the J2EE username to then re-connect the app to teh database schema
    public void prepareSession(SessionData SessionData)
       super.prepareSession(SessionData);
       oconn = ((PrxyTransactionImpl)this.getDBTransaction()).getPrxyConnection();
       // Specify the user that connects through the proxy user and its roles
       Properties prop = new Properties();
       prop.put(OracleConnection.PROXY_USER_NAME,"hr");
       //prop.put(OracleConnection.PROXY_ROLES, roles);
       String appContext = "Begin ctxhrpckg.set_userinfo('"+getApplicationUserName()+"'); END;";
       java.sql.CallableStatement st= null;
      // Open the proxy session (DB-authenticated users)
      try
        oconn.openProxySession(OracleConnection.PROXYTYPE_USER_NAME, prop);
        st = getDBTransaction().createCallableStatement(appContext,0);
        st.execute();
      catch (SQLException e)
        e.printStackTrace();
package oracle.sample.dbprxy.adfbc;
import oracle.jbo.server.DBTransactionImpl2;
import oracle.jbo.server.DatabaseTransactionFactory;
* TransactionFactory that returns PrxTransactionImpl, which is a subclass of
* DBTransactionImpl2
* @author Frank Nimphius
public class PrxyDatabaseTransactionFactory extends DatabaseTransactionFactory
public PrxyDatabaseTransactionFactory()
    super();
   * Override the create method to return an instance of PrxyTransactionImpl instead
   * of DBTransactionImpl2
   * @return PrxyTransactionImpl
public DBTransactionImpl2 create()
    return new PrxyTransactionImpl();
package oracle.sample.dbprxy.adfbc;
import oracle.jbo.server.DBTransactionImpl2;
import oracle.jdbc.OracleConnection;
public class PrxyTransactionImpl
extends DBTransactionImpl2
public PrxyTransactionImpl()
    super();
   * The DBTransactionImpl2 does not expose the connection in a public
   * method. This class is a wrapper to expose the connection to the
   * BC app, so it can be accessed in the ApplicationModuleImpl class
   * @return OracleConnection - SQL Connection
public OracleConnection getPrxyConnection()
    return (OracleConnection) this.getJdbcConnection();
}Note that for EUS ApplicationModule pooling should be disabled
Frank

Flex updates at a row level in a grid

Similar Messages

Maybe you are looking for