Resource for Forms/Database Security

Question

My company is taking the Oracle plunge in the next 2 weeks and I really need to find some good books, or resources to get off on the right foot.
The first thing I would like to deal with is security. I need to figure out how to allow some users to update a field while denying other users. I need to know what kind of information I will need to know.
Right now the scope of the project is to create an applictaion in Forms and Reports to run the business. Then we will also be working with HTMLDB, Designer, Portals, and other Oracle tools. So the problem is that I can create a table in the database to hold security settings, but I want the settings for Roles and Access rights to persist through all objects.
Can ALL of the security be done on the database itself???? or will we need to do coding on the Forms and Reports also??
Basically I need someone to point me to the right resource to start implementing security on the database and Forms, since that is the first step (in my opinion) in developing a good application.

Answer 1

All security can be done in the database. However, you probably want to have the security rules in your Forms as well. If your Forms are totally open for any action (insert, update, delete), the user will only get an error message when hitting the Save button. Only then are the database securities checked.
Usually the Form also checks if a user is allowed, e.g., to update a record. If not, in the Form you will set the record to non-updateable. That way the user immediately gets an error message, even before trying to save the changes.
Another approach is to have only ONE database user with all privileges for the application. Application users and authorization rules are stored in application tables. When you start the application, you automatically log in with a database username and password that are hidden or encoded in some way. Then the user logs in with the username and password that are stored in the application. This approach is very common in web environments.
I need to figure out how to allow some users to update a field while denying other usersI would never go as far as applying security on field level. That may become an administrative nightmare.