Oracle VPD - RLS

Dear Experts,
We are implementing row level security at our organization to achieve Multi-Tenancy. Our DB Version is Oracle 11g release 2.
At the application we have multiple skew id's, which exists in the master table at the database. Using Oracle VPD we want to implement row level security for different dependant tables which has skew id column. From the front end if application user select the specific skew id we want the end user to select or view particular rows pertaininig to the skew id. These skew id's are not constant they are added or modified on adhoc basis.
We cannot create DB user's for mapping the VPD. I would appreciate, if you can give inputs with an example how to fulfill this requirement with an policy function , application context to understand what parameters need to be passed.
Awaiting for your reply. Thanks

Sorry - wrong forum. Although the forum title is multitenant this forum is for the 12c database version using the new multitenant architecture.
Please mark the thread ANSWERED and repost it in the SQL and PL/SQL forum.
PL/SQL
When you repost you need to provide some sample data to show what you need to do.
A standard parent/child table relationship would appear to do what you want: when a parent SKEW_ID is used it will ONLY link to child rows with that same SKEW_ID.
That is why you need to show an example of what you mean.

Similar Messages

VPD - RLS

Dear Experts,
We are implementing row level security at our organization to achieve Multi-Tenancy. Our DB Version is Oracle 11g release 2.
At the application we have multiple skew id's, which exists in the master table at the database. Using Oracle VPD we want to implement row level security for different dependant tables which has skew id column. From the front end if application user select the specific skew id we want the end user to select or view particular rows pertaininig to the skew id. These skew id's are not constant they are added or modified on adhoc basis.
Master Table - skew_master
skew_id,- Parent key
date,
mod,
label1
label2
location,
sector
All Dependent 20 tables have column - skew_id as foreign key
We cannot create DB user's for mapping the VPD. I would appreciate, if you can give inputs with an example how to fulfill this requirement with an policy function , application context to understand what parameters need to be passed.
Awaiting for your reply. Thanks

As I told you on the other forum there is NOTHING you need to do:
A standard parent/child table relationship would appear to do what you want: when a parent SKEW_ID is used it will ONLY link to child rows with that same SKEW_ID.
Just join the parent table to the child tabes you need for a query.
VPD has no application or use if you are just using a parent/child relationship like yours.

ODI and Oracle VPD

Hi,
In order to access the data in a Oracle VPD enabled database - user identity needs to be propagated (setting the client identifier or setting a oracle user defined context).
In ODI the "On Connect/Disconnect" in the physical data server definition may be used to invoke a pl/sql procedure at the connect time to set the Oracle user defined context.
Few questions:
1. If the load plan has multiple scenarios they will be executed in different Oracle sessions(one scenario - one DB session) will this "On Connect/Disconnect" procedure fire every time a new Oracle session is created?
Its executing just once so the context setting is not happening for all the scenarios.
2. Is there a way to run multiple scenarios in a single oracle session?
Thanks
Amit

Sounds like bug 14067871
Cheers
David

Help With FGAC (VPD, RLS...)

Hi all.
I'm trying to create a Discoverer Trigger to implement FGAC. The point is:
Discoverer DEMANDS you to create a DB function without any argument, returning integer (that won't be used anywhere), and register it in Disco. Adm. Edition. This is the easy part.
Then I created two db. functions. The first one configures Policies (INFO_SEC). The second one (this is the one I try to invoke in discoverer - EUL_TRIGGER$POST_LOGIN), simply creates the policy using DBMS_RLS package.
SQL> create or replace function info_sec( p_schema in varchar2) return varchar2
2 as
3 v_user varchar2(30);
4 begin
5 select sys_context('USERENV', 'SESSION_USER')
6   into v_user
7 FROM DUAL;
8    if (v_user = 'DWH_ADMIN' ) then
9      return '';
10    else
11      return 'upper(nm_emp) = '||v_user;
12    end if;
13 end;
14 /
Function created.
SQL> create or replace FUNCTION EUL_TRIGGER$POST_LOGIN RETURN INTEGER
2 as
3 begin
4 dbms_rls.add_policy
5 ( object_schema   => 'DWH_ADMIN',
6 object_name     => 'EMP_T',
7 policy_name     => 'POL_EMP',
8 function_schema => NULL,
9 policy_function => 'INFO_SEC',
10 statement_types => 'select, insert, update, delete' ,
11 update_check    => TRUE );
12   RETURN(10000);
13 end;
14 /
Function created.
SQL> select EUL_TRIGGER$POST_LOGIN FROM DUAL;
select EUL_TRIGGER$POST_LOGIN FROM DUAL
ERROR at line 1:
ORA-14552: cannot perform a DDL, commit or rollback inside a query or DML
ORA-06512: at "SYS.DBMS_RLS", line 308
ORA-06512: at "DWH_ADMIN.EUL_TRIGGER$POST_LOGIN", line 4I understand this is due to the insert that dbms_rls tries to perform in order to create the policy.
My question is if anyone has an alternative for setting this using pl/sql. I need to set the RLS policy in discoverer only, so, i MUST use Discoverer Triggers.
If you need more info about Discoverer Triggers, you cand find it in:
http://www.huihoo.com/oracle/docs/B25016_04/doc/dl/bi/B13916_04/appendix_b.htm
Anything you guys input here will be highly appreciate!
Regards,
Marcos

You do not want any part of a system which intends to apply different FGAC policies to the same Oracle user based on the application they are using. Assuming you managed to set things up so that each application was setting up its own FGAC policy, FGAC policies apply to the instance. So the policy that would apply to the Discoverer session, for example, could change when some other application created a session and set its own policy. This is a disaster waiting to happen.
Your policy function could look at information about the session to try to determine the application being used and tailor the policy accordingly. This is generally a bad idea since this information is being passed in by the client, meaninging that it is relatively easy to spoof a different application.
Justin

How to debug Oracle VPD Security Query?

Hi,
I have implemented vpd.
But I want to see what query Oracle is generating in back end while I am applying a simple select statement on the table.
I have searched in V$SQL, V$SQLAREA, it is not there.
So where I have to see?
Thanks,
Sunil Jena
Edited by: 990324 on Feb 27, 2013 6:06 AM

It sounds like you want to look at v$vpd_policy. The PREDICATE column will show you each predicate that has been applied by VPD to a particular SQL_ID and the POLICY column will tell you which policy applied that predicate.
Justin

Oracle VPD on Remote database using DBLINk

Hi All,
How can i apply row level security on a table that is available in another database using DBlink
we have two databases PDSSM and EVTA, and i would like to apply row level security on a table in EVTA from a schema in PDSSM using dblink. MXODSADM IS A SCHEMA IN EVTA AND MXEMBARGO IS A SCHEMA IN PDSSM. there is a dblink(EVTA.GMM.COM) between mxembargo and mxodsadm.
begin
dbms_rls.add_policy (
object_schema => 'MXODSADM',
object_name => 'vehicle_retail_sale',
policy_name => ' MXEMBARGO_EVTA_POLICY',
function_schema =>'MXEMBARGO',
policy_type => dbms_rls.SHARED_CONTEXT_SENSITIVE,
--policy_type => dbms_rls.STATIC,
policy_function => ' MXEMBARGO_EVTA_POLICY.MXEMBARGO_EVTA_PREDICATE',
statement_types => 'select, insert,update,delete',
update_check => TRUE,
enable => TRUE,
static_policy => TRUE
end;
I am a complete Database person and i need to do this in my application, can anyone provide me how can i do this using dblink.

wojpik wrote:
hello
I have one short question to you.
Is that possible to create view at remote database using dblink? Following syntax returns error
create view ViewName@DbLinkDame (ColumnName) as
(select 1 from dual )
"ORA-00905:missing keyword"
Is that possible at all?
And particulary - is that possible when remote database is MSSQL and I am using heterogeneous services?
I really appreciate your help
best regards
Wojtek
Edited by: wojpik on Oct 21, 2009 3:59 AMI doubt you would be able to fire any ddl through database link. You have to connect to remote database to run any ddl even if it is Oracle or some other database.
Regards
Anurag

Toplink and Oracle VPD

Our dba's have VPD set up which limits data depending on who is logged in. Can this be supported with Toplink in 'Server' mode, using Session beans with POJO's?
thanks,
craig
ps. if this is not supported, any suggestions?

Craig,
This is not currently an out of the box capability, but through TopLink's public API it has been successfully implemented at a couple of customer sites. These extensions to the TopLink persistence architecture have been done through our technical services team. Drop me an e-mail ([email protected]) and I'll connect you with the team to discuss your specific requirements and solution options.
There are a number of ways Label Security (VPD) can be used from Java with TopLink. The solution used so far involves a custom OCI connection pool that TopLink can switch the user at runtime on. Then depending on the granularity of your user security requirements the TopLink sessions (shared or isolated) can be overlaid using these shared connections. Your application will need to provide user credentials to TopLink so the connection can be properly switched and TopLink's session cache will need to ensure the trusted application only sees cached objects valid for the provided user.
We are working on adding this support more seamlessly for an upcoming release.
Doug

Issue with Referential Integrity check in Oracle VPD Policy

Hi,
Lets assume I have two tables - Customer and Order, with cust_id in Order table referring to primary key of Customer table.
Example Data;
Customer
cust_id Name
1 abc
2 def
3 ghi
Order
Order_id cust_id Order_type
1 1 A
2 2 A
3 1 B
Now I have policies defined on both the tables;
- for "Select, Insert, Update" queries on Customer table.
- for "Select" queries on Order Table.
Policy 1 on Order Table;
Irrespective of the user, predicate = 'Order_type = ''A'''
Policy 2 on Customer Table;
Irrespective of the user, predicate = '(select count(1) from order o where o.cust_id = customer.cust_id and o.order_type = ''B'') > 0'
My intention is to show only those customers who have atleast one order of type 'B'. And this policy works fine in case a user tries to read data from customer table. (for example, record for cust_id = 2 will not be returned as it don't have any orders of type "B")
However, when a user tries to insert record in Order Table, because of the existing referential integrity constraint, the Policy on Customer table is also getting triggered. And an exception is being raised "ORA-28113: policy predicate has error".
Could someone please explain why this is happening ?

I'm afraid, there is no such a mean.
At least I do not know about it.

Using VPD in combination with a user table?

I'm very new with VPD's. In fact, I don't know a thing about it yet (I know the philosophy behind it and the principle, but not the practical implementation). My question: Are VPD's always based on database-users? Our applications have a user-table now, where the access rights to applications are stored. Once a user is present in that table and has the necessary rights, he can login to the application. So we don't have an actual database-user for each "real-life" user, just an entry in a table.
Is it possible to use the system of VPD's (and maybe Oracle Label Security) with users stored in a table, instead of actual database users?

TomVD wrote:
My question: Are VPD's always based on database-users? No, they are not. You could for example put VPD policies on tables that restrict access after a certain time of the day (not caring which user attempts to access the data, using only SYSDATE and a given cut off access time).
TomVD wrote:
Is it possible to use the system of VPD's (and maybe Oracle Label Security) with users stored in a table, instead of actual database users?Yes you can.
VPD allows you to construct a predicate as you would like based on your requirements (you are basically appending a WHERE clause in to every query based on the logic you dictate on the objects and accesses you determine necessary).
Typically if you're running through a connection pool (as it sounds like you are) you would use an application context to set a specific value (the logging in user) and then validate that against your Users table in whatever fashion tickles your fancy
[Some Tutorials|http://www.google.ca/#hl=en&source=hp&q=oracle+vpd+tutorial&btnG=Google+Search&meta=&aq=0&oq=oracle+vpd+&fp=8e6c6930b7d53e73] may also be helpful
and of course .. [The Documentation|http://download.oracle.com/docs/cd/E11882_01/network.112/e10574/vpd.htm]

Performance tuning of Oracle 10 g

Dear Team ,
I am in need of tuning my Database against the performance .
I have visited lots of Web pages in Net for Performance tuning .
It shows some values for the Performance tuning , But I dont how to read the values
Wheather my database is good or it need to tuned again .
So kindly help me for good performance tuning in my Database (Oracle 10g)
Regards
Augustine

Hi Augustine;
I am in need of tuning my Database against the performance .
I have visited lots of Web pages in Net for Performance tuning .
It shows some values for the Performance tuning , But I dont how to read the values
Wheather my database is good or it need to tuned again .First step should be run ASH AWR report than check your CPU usage(also other parameter) from Oracle Enterprise Manager console.
Check top5 event and try to understand what is happining on ur database. Actualyy There is no specific answer for your question, just check report try to understand to what eat your source? when it happens?what is fruquence etc.. So just run report and observe it
Check below search
http://www.google.com.tr/search?q=Performance+tuning+of+Oracle+10&rls=com.microsoft:en-us&ie=UTF-8&oe=UTF-8&startIndex=&startPage=1&redir_esc=&ei=v0fxS8bTCtOrsAaYqfTbAg
There are many docs related performance.
Hope it helps
Regard
Helios

Reapply oracle policy

We are using Oracle VPD security feature, recently we encountered some problems, in several of our clients's database (8.1.7.3), we found that the oracle policy was not reapplied after we changed vpd user in a jdbc thin connection, following is the scenario:
We have a policy, looks like follows
ploicy
if user is A, return predicate A
if user is B, return predicate B
(1)
build up a thin connection
set user to A
create a prepared statement of sql "select * from order"
query
close connection
in (1), we did find that policy was applied and the predicate A
was returned.
(2)
build up a thin connection
set user to B
create a prepated statement of sql "select * from order"
query
close
in (2), we got wrong result, because policy was not applied, it
still use predicate A.
Any comments?
Thanks

the key is how you answer the question " how do you set your user ".
if you set user B by logging into db as user B, then the situation you descripted sounds like a bug, if I understand it right.
if you set by changing some variables inside the session, since the VPD engine does not know when you switch user, you could get old policy predicate if you reexecute the cursor or use PLSQL to rerun your static sql.
My suggestion is try out 9i that auto-reexecute the policy function.

Tuning VPD predicate

Hi,
I'm using VPD(RLS) to filter data based.
I have a performance issue due to the VPD predicate my VPD function generate.
I have two tables:
- MARKER which is the table I want to secure and contains a primary key named marker_id and a filed use by VPD name VPD_IS_PUBLIC.
- DATASECURITY which is the table containing security information and tells to VPD wich data can be seen for a given role.
I put the script at the end of the message.
If you look to the code, the VPD function can return two predicates:
VPD_IS_PUBLIC=1
or
VPD_IS_PUBLIC=1 or marker_id in (select field_id from datasecurity where roleid=3)
The problem with the second query is that more I have data in my MARKER table more the query is slow.
This is because of "VPD_IS_PUBLIC=1 or" statement.
Is there another way to write that predicate?
Does someone can help me?
Cheers,
Sebastien
CREATE TABLE DATASECURITY
OBJECT_DB_ID NUMBER(10),
ROLEID NUMBER(10),
FIELD_ID NUMBER(10),
CREATION_DATE TIMESTAMP(6) WITH TIME ZONE DEFAULT systimestamp CONSTRAINT NN_DATASECURITY_CREATIONDATE NOT NULL,
CONSTRAINT PK_DATASECURITY
PRIMARY KEY
(OBJECT_DB_ID, ROLEID, FIELD_ID)
CREATE INDEX INDEX_DATASECURITY ON DATASECURITY
(FIELD_ID);
CREATE OR REPLACE TRIGGER TRG_AFT_INSERT_DATASECURITY
AFTER INSERT
ON DATASECURITY
REFERENCING NEW AS New OLD AS Old
FOR EACH ROW
DECLARE
BEGIN
UPDATE marker
SET vpd_is_public = 0
WHERE marker_id = :new.field_id;
END TRG_BEF_INSERT_DATASECURITY;
CREATE TABLE MARKER
MARKER_ID NUMBER(10) NOT NULL,
MARKER_TYPE_ID NUMBER(10),
MARKER_ACC VARCHAR2(50 BYTE),
VERSION VARCHAR2(10 BYTE),
DISPLAY_SYNONYM_ID NUMBER(10),
SPECIES_ID NUMBER(10) NOT NULL,
GERMPLASM_ID NUMBER(10),
LIBRARY_ID NUMBER(10),
DESCRIPTION VARCHAR2(2000 BYTE),
DATE_CREATED DATE,
DATE_UPDATED DATE,
VPD_IS_PUBLIC NUMBER(1) DEFAULT 1 CONSTRAINT NN_MARKER_VPD_IS_PUBLIC NOT NULL,
CONSTRAINT PK_MARKER
PRIMARY KEY
(MARKER_ID)
CREATE INDEX INDEX_MARKER ON MARKER
(VPD_IS_PUBLIC);
-- This function return the value stored in the session client info
CREATE OR REPLACE FUNCTION CSFDS.get_cwid
RETURN VARCHAR2
IS
retval VARCHAR2 (50);
BEGIN
DBMS_APPLICATION_INFO.READ_CLIENT_INFO (retval);
RETURN retval;
EXCEPTION
WHEN OTHERS
THEN
RAISE;
END get_cwid;
-- This function sets the value to the session client info
CREATE OR REPLACE FUNCTION CSFDS.set_cwid (cwid IN VARCHAR2)
RETURN NUMBER
IS
BEGIN
DBMS_APPLICATION_INFO.set_client_info (cwid);
RETURN 1;
EXCEPTION
WHEN OTHERS
THEN
RETURN 0;
END set_cwid;
-- This function is the vpd function.
-- It returns differents predicate according the value in the session client info
CREATE OR REPLACE FUNCTION CSFDS.vpd (sch_name IN VARCHAR2, tab_name IN VARCHAR2)
RETURN VARCHAR2
IS
retval VARCHAR2 (500) DEFAULT '' ;
l_roleid NUMBER DEFAULT 3 ;
BEGIN
IF GET_CWID = 'csfds'
THEN
retval := 'VPD_IS_PUBLIC=1 or ';
retval :=
retval
|| 'marker_id in (select field_id from datasecurity where roleid='
|| l_roleid
|| ')';
ELSE
retval := 'VPD_IS_PUBLIC=1';
END IF;
RETURN retval;
EXCEPTION
WHEN OTHERS
THEN
RAISE;
END vpd;
-- To create the VPD policy
BEGIN
SYS.DBMS_RLS.ADD_POLICY (
object_schema => 'CSFDS'
,object_name => 'MARKER'
,policy_name => 'TEST_VPD'
,function_schema => 'CSFDS'
,policy_function => 'VPD'
,statement_types => 'SELECT'
,policy_type => dbms_rls.dynamic
,long_predicate => FALSE
,sec_relevant_cols => 'MARKER_ID,MARKER_TYPE_ID,MARKER_ACC,VERSION,DISPLAY_SYNONYM_ID,SPECIES_ID,GERMPLASM_ID,LIBRARY_ID,DESCRIPTION,DATE_CREATED,DATE_UPDATED,VPD_IS_PUBLIC'
,sec_relevant_cols_opt => NULL
,update_check => TRUE
,static_policy => FALSE
,enable => TRUE );
END;
Edited by: sfrade on Mar 18, 2009 2:00 PM

Hi
Done using the following commands:
execute DBMS_STATS.gather_table_stats ( ownname => 'CSFDS', tabname => 'DATASECURITY', estimate_percent => DBMS_STATS.AUTO_SAMPLE_SIZE, method_opt => 'FOR ALL COLUMNS SIZE AUTO', cascade => TRUE );
execute DBMS_STATS.gather_table_stats ( ownname => 'CSFDS', tabname => 'MARKER', estimate_percent => DBMS_STATS.AUTO_SAMPLE_SIZE, method_opt => 'FOR ALL COLUMNS SIZE AUTO', cascade => TRUE );
and the plan for the following query
SELECT COUNT ( * )
FROM MARKER
WHERE marker_id in (SELECT FIELD_ID
FROM DATASECURITY
WHERE roleid = 1)
OR vpd_is_public = 1;
Plan
SELECT STATEMENT ALL_ROWSCost: 314 Bytes: 10 Cardinality: 1
     7 SORT AGGREGATE Bytes: 10 Cardinality: 1
          6 FILTER
               4 VIEW VIEW CSFDS.index$_join$_001 Cost: 314 Bytes: 176,780 Cardinality: 17,678
                    3 HASH JOIN
                         1 INDEX FAST FULL SCAN INDEX (UNIQUE) CSFDS.PK_MARKER Cost: 83 Bytes: 176,780 Cardinality: 17,678
                         2 INDEX FAST FULL SCAN INDEX CSFDS.INDEX_MARKER Cost: 89 Bytes: 176,780 Cardinality: 17,678
               5 INDEX SKIP SCAN INDEX (UNIQUE) CSFDS.PK_DATASECURITY Cost: 2 Bytes: 10 Cardinality: 1
By the way, how do you know that the stat were out of date?
Edited by: sfrade on Mar 20, 2009 8:54 AM

ORDS 3.0 - How to set VPD Context before executing SQL Template?

I need to set a couple of attributes in an Oracle Session Context before the SQL/PLSQL template handler is executed, as we rely on Oracle VPD/Row-Level-Security for the data access.
Is there a hook/functionality in ORDS 3.0 where I can register a PL/SQL (e.g. set_security_context(authenticated_user)) procedure, so this 'set_security_context' procedure is executed before and for each execution of a SQL/PLSQL template handler?

I tried to log the request at Oracle REST Data Services (ORDS) but I could only start a new discussion: Possibility to register Pre-/Post-Procedures for an SQL Template Handler
As I mentioned there, the PL/SQL handler approach works for me as long as I have no or only little data to send back to the client (e.g. put/post/delete succeeded or an error message why the call failed).
If I need to return a lot of data from the PL/SQL handler I would need to, as far as I understand, to marshal the data to JSON and write it to the response body in the PL/SQL handler.
I don't want to do the marshaling, because ORDS does it better.
However, this works for me:
I write a pipelined stored procedure that takes as input the attributes I need to set in the session context. I then can reference it in the SQL handler:
select * from table(my_pipelined_function(:USER, ....)
Now the JSON/HTTP response is created by ORDS again.
I still needed to code a couple of lines, but it is way better than duplicating the functionality already existing in ORDS.
With the hooks it would be perfect because I would not have to write any code (apart from the procedure to set the session context attributes), just configure the REST services in ORDS.

Toplink and VPD

Hi,
In a three-tier architecture, has anyone successfully implemented VPD in combination with Toplink and a ConnectionPool?
When all my web-users are connecting to the database with the same (connection pool) credentials, how, when and where do I tell my database who is really logged in (web-user) and thus how to set the specific VPD for that web-user?
Thanks. I already read another post on this forum mentioning that VPD support would be included in an upcoming release of TopLink.
Re: toplink and Oracle VPD
I also heard of a patch to download. Can anyone verify this?

Just to add an extra question: Is it true that when one is using chained Toplink actions in a request-response cycle that each action will fetch its own connection from the pool and thus for each time a connection is fetched the VPD needs to be set again?
This in contrast with BC4J, where all actions in a request-response cycle will share the same application module and thus the same connection.
Bottom line: how to configure Toplink so that for each fetched connection it tells the database: "Hey, its me again, please set the application context (VPD) to my own personal values, so I will only see my own records"?
. And to clean it up nicely: just before the connection is released to the pool: "Ok, I'm done, please reset the application context, so other users will not be bothered by my context".
Hard to believe nobody has tried this before.

HIPAA, Sarbanes-Oxley and Oracle Virtual Private Database

Is ORACLE VPD compatible with HIPAA, Sarbanes-Oxley?
Is ORACLE VPD incompatible with a certification?
Thanks in advance,
Alexandre Bailly

user8716187 wrote:
Is ORACLE VPD compatible with HIPAA, Sarbanes-Oxley?
Is ORACLE VPD incompatible with a certification?
This forum is used is discussions about Certifications issued by Oracle (OCA,OCP,OCE,OCP) to people who have satisified the Certification Requirements.
Sox etc are not disccused here.
The following link may or may not be useful [http://www.oracle.com/technology/deploy/security/index.html]
I suspect the database general forum mkay be the best place for your question ... others may know a better forum.
In general this is often discussed under security.
Also 11gR2 has features which may better support some aspect of socks compliance.

Oracle VPD - RLS

Similar Messages

Maybe you are looking for