HTMLDB, Database Users, Permissions

Question

I am working with a client that has an Oracle DB app that uses Forms 6i for the UI. We want to start using HTMLDB in addition to Forms. Currently, all the users have a database username and password, and user permissions are controlled by database roles and individual table permissions. The goal is to allow the users to login to HTMLDB with their db username and password so the existing db roles and permissions will be in effect.
I have my HTMLDB configuration setup without a PLSQL Username/Password in the marvel.conf file, and this allows users to login to the HTMLDB apps with their DB username and password. This works fine.
I have a report setup that selects from an employee table. Only a few roles have select permissions on this table. (I will also add that this table is in a schema that is mapped to the HTMLDB workspace) What I am finding is that, regardless of the permissions assigned to the logged in user, they can run this report.
Looking at the DB connections in Enterprise Manager, it shows the username of the logged in user, so it would apper that the webserver is connecting to the DB as I would expect. How is it that even non-privileged users can run this report?
If I login via sqlplus as the same user and attempt to run a select against this table, I get "ora-00942 table or view does not exist", so I am sure my permissions are correct. What am I missing?
Any help on this is greatly appreciated.
-Tony

Answer 1

Tony,
It is not your imagination, this is how things are 'sposed to work. At a Forms/HTML DB site we worked on, individual users were granted database roles, as you described. Forms controlled access to functionality by interrogating user_role_privs and would display access points to modules via menus in strict accordance with the connected user's privileges. In the back-end, however, the application executed in the super-user schema that had object privileges on everything. But user-level access control had already been accomplished by filtering what could be presented in the UI.
With HTML DB, your users are connected as their database account. This achieves authentication and obtains the value of USER from the database for :APP_USER. Those users have privileges on schema objects through roles. Roles are not enabled in stored procedures, which is the mechanism through which all database interaction is performed in HTML DB.
The minimum that you'll need to do is to establish row-level access control by using Oracle's Virtual Private Database feature, or VPD (aka, FGAC/RLS), which you can enable for every page request using the VPD application attribute. There will be an excellent how-to published very soon about that. (BTW, you don't need to connect using the database accounts to use this feature, in fact it's designed assuming the opposite situation.)
When you need to limit access to application components based on user privileges, you'll have to do much more. For example, you might build an authorization model based on user_role_privs. Ensure that all SQL against the application schema is performed through APIs. The APIs will run in the application schema which should own the objects and would therefore have all required object privileges. The authorization model will be implemented as an API that is called from HTML DB authorization schemes attached to pages, regions, processes, etc. Then you can do things like, if the current user is not a manager don't show them links to the 'Show My Employee Detail' page and don't let them run the page if they attempt to do so and also send someone an email if that happens.
Scott