How to setup Security and Notification

Question

Hi, I have developed a small application for call logging. I would like to know the procedure for implementing security and about the notification settings.
As I am new to this field, Please explain in detail. Any screenshots showing the setups ([email protected]) would be highly appreciated.
The key features and procedures of the application -
a) Users will be given individual user ids and passwords to raise calls on a particular department
b) Each department has a call manager who will assign the call to a technician
c) The technician will resolve the call and update the status
d) The user will close the call and provide feedback
Structure -
1 table for maintaining users / employees - 1 Page - Report & Form
1 table to manage call manager department wise - 1 Page - Report & Form
1 table for calls (raise, assign, resolve) - multiple report and form pages (one for logging, one for assigning, one for resolving and one for feedback with only the relevant columns of the table) - I have created multiple forms so that a call cannot be modified by a subsequent user)
My Requirement:
1. The user should view only the calls raised by him/her (User1 should not view the calls raised by user2)
2. The technician should view the call raised by him/her (user role) and also can view the calls assigned to him/her
3. The Call manager can view the calls raised by him (user role) and also can view the calls raised on his department
4. Notification: E-mail should be fired at each event only to the concerned people attached to the call (user, call manager, technician)
Please guide me in setting up the above features.
Regards,
Sandeep

Answer 1

user4441274 wrote:
HiWelcome to the forum: please read the FAQ and forum sticky threads (if you haven't done so already), and update your profile with a real handle instead of "user4441274".
When you have a problem you'll get a faster, more effective response by including as much relevant information as possible upfront. This should include:
<li>Full APEX version
<li>Full DB/version/edition/host OS
<li>Web server architecture (EPG, OHS or APEX listener/host OS)
<li>Browser(s) and version(s) used
<li>Theme
<li>Template(s)
<li>Region/item type(s)
With APEX we're also fortunate to have a great resource in apex.oracle.com where we can reproduce and share problems. Reproducing things there is the best way to troubleshoot most issues, especially those relating to layout and visual formatting. If you expect a detailed answer then it's appropriate for you to take on a significant part of the effort by getting as far as possible with an example of the problem on apex.oracle.com before asking for assistance with specific issues, which we can then see at first hand.
My Requirement:
1. The user should view only the calls raised by him/her (User1 should not view the calls raised by user2)
2. The technician should view the call raised by him/her (user role) and also can view the calls assigned to him/her
3. The Call manager can view the calls raised by him (user role) and also can view the calls raised on his departmentThis is known as Fine Grained Access Control (FGAC) and is normally implemented using either views or Oracle's Virtual Private Database (VPD) feature.
If you're licensed to use an Enterprise Edition database and want to apply these restrictions across the entire application, or across multiple applications, then use Virtual Private Database (VPD). In APEX 4.1 you can set up/tear down the security context using the Initialization PL/SQL Code/Cleanup PL/SQL Code attributes. In earlier versions the set up attribute is termed Virtual Private Database (VPD), and there is no tear down option. (A somewhat out of date article on using VPD with APEX is available.)
Should you not be using EE, then you can roll your own VPD using parameterized views, again using the VPD security attribute to set the required application context.
4. Notification: E-mail should be fired at each event only to the concerned people attached to the call (user, call manager, technician)Build the application using PL/SQL package APIs that provide transactional procedures for raising, assigning, resolving calls etc. These will encapsulate all the required functionality, including sending email notifications when the transaction is complete. APEX form regions can be created on top of these API procedures.