Restrict SQL output by User

Question

In the sample sql below, I figured out how to be able to restrict output to terms that end with a 5 for a specific user and would like to know if there is a more compact way to write this or is this the best way. This sql will only list out terms that end with a 5 if the user = 'MYSELF', otherwise if a different user is logged in, then they would see all the terms within the range.
with ODP as
(select distinct user, case when user = 'MYSELF' then
                       substr(term,1,5)|| '5'
             else term
      end as ODPTerm
from status_table
where substr(term,6,1) = '5'
select distinct user, term, odpterm
from status_table
left outer join ODP
on term = ODPTerm
where (user = 'MYSELF' AND ODPTerm IS NOT NULL)
OR (user !='MYSELF' AND term between '201220' and '201245') There are many issues with how security was set up and the actual query will be used in an Oracle Report that is run via a URL. We were told that ITS prefers we create a separate report and restrict on term rather than trying to identify by user, however, that method would require we maintain several reports since users are able to enter parameters at run time. We thought that since at this point there are only two users (Non Employees) who need the restriction, this would be better at our end for report maintenance. The other reason is that eventually, we will be converting this report to another reporting tool, which would have a different security arrangement, so wouldn't be a long term issue about maintaining the hard coded user exclusion in the SQL statement.

Answer 1

Hi,
Here's one way of doing it:
SELECT DISTINCT
        user
,     term
,     term     AS odpterm
WHERE     (    user          = 'MYSELF'
     AND  SUBSTR (term, -1)     = '5'
OR     (    user          != 'MYSELF'
     AND  TERM          BETWEEN     '201220'
                         AND     '201245'
;If you'd care to post some sample data (CREATE TABLE and INSERT statements), then I could test this.
If you're using Oracle Enterprise Edition, then you can create a row-level security policy, such that limitations like this automatically apply to any query done on the table. Look up Virtual Private Database (or VPD ) and the Oracle-supplied package dbms_rls for more.
Edited by: Frank Kulash on Oct 26, 2011 6:47 PM