Restricting compile privilege to a particular IP

version ==> 10.0.2.0.4
For our production DB, we want the privilege to compile any code (SPs, Packages, Functions, Triggers) to be restricted only to our lead developer.
Our current plan to implement this:
His/her machine's IP will be stored in a table and an AFTER DDL trigger will be fired which will do a lookup in this table. If the IP is absent in the table then RAISE_APPLICATION_ERROR.
But, what is privilege for compiling DB codes?

user872043 wrote:
Our current plan to implement this:
His/her machine's IP will be stored in a table and an AFTER DDL trigger will be fired which will do a lookup in this table. If the IP is absent in the table then RAISE_APPLICATION_ERROR.Extremely unsafe security method. It will literally take me 5 minutes to circumvent that - by launching a DoS attack on his IP and assuming that IP as my own and connect to the database to enjoy all the privs allowed to that IP address.
It almost never make sense to apply IP level security in the application layer.
Also consider the fact that there is no explicit "+compile+" priv to assign. The "+create procedure+" priv coves that aspect. Also, invalidated PL/SQL code can be automatically compiled when used by a caller.
You also mentioned production database - what on earth are developers, including the lead, doing on a production database? That should be restricted to the operational people and only the ops person responsible for that specific app schema in production, should have the password for that schema and the ability to apply a patch/update script to it.. A script that you developers did under the guidance and supervision of the dev lead.
It seems to me that your workflow processing and methods are a problem here - and one of the very worse things to do is to attempt to solve such a problem technically, and not fixing the actual business or operational process itself.

Similar Messages

Restricted session privilege in 9i and 10g

We recently upgraded from 9.2.0.7 to 10.2.0.3. Oracle 9i allowed a user with RESTRICTED SESSION priv to connect (sqlplus user /@db) when the database was in restricted mode as it should. However, our Oracle 10g database will not allow a user with RESTRICTED SESSION privilege to log in after 'alter system enable restricted session' is executed. The DBA role does not work nor does granting the system privs CREATE SESSION and RESTRICTED SESSION directly to the user. The error I get when trying to log on is ORA-12526. Any advice on how to remedy this would be much appreciated.
what is the alternative to achieve the same in 10g other than locally?
Thanks,
Vishal

From 10g doc (Oracle® Database Administrator's Guide):
Typically, all users with the CREATE SESSION system privilege can connect to an open database. Opening a database in restricted mode allows database access only to users with both the CREATE SESSION and RESTRICTED SESSION system privilege. Only database administrators should have the RESTRICTED SESSION system privilege. Further, when the instance is in restricted mode, a database administrator cannot access the instance remotely through an Oracle Net listener, but can only access the instance locally from the machine that the instance is running on.

Restrict an iview for a particular set of users

Hi,
I would like to restrict an iview for a particular set of users.
Please let me know how to do that
Points will be rewarded for sure for the helpful answer
Thanks
Bala Duvvuri

Hello,
Option 1: create a separate role and assign to those set of users.
Option2: if its custom developed iview(PAR/Webdynpro java), by using (UME service AP)java code we can find those users and we can restrict content of iview(create a uinique group and while executing iview , if the user belongs to this group show a message u don't have authorization to execute this iview).
To me option is good and easy.
Regards
malli.....

Can't download Acrobat Pro because of "restrictive access privilege" on Mac

I am prevented from downloading Acrobat Pro because of "restrictive access privilege" on a Mac Mavericks folder ("Applications", where else?), yet I have allowed "Read & Write". I will not install anywhere else, so need assistance. Thanks.

Mickey McFly please make sure you are downloading to your download folder or another folder besides your Applications folder. Once Adobe Acrobat is downloaded you then can install the software to your Applications folder.

Restricted admin privileges

Hi,
I am guessing not...but, is there any way to setup restricted admin privileges so an account only has privileges to bounce the server?
Thanks.

>
I am guessing not...but, is there any way to setup restricted admin privileges so an account only has privileges to bounce the server?
>
Indeed, there was the sysoper privilege invented for that purpose.
SQL> grant sysoper to fred;
SQL> connect fred/pwoffred as sysoper;
SQL> shutdown immediateKind regards
Uwe
http://uhesse.wordpress.com

Restricting data entry to a particular language in the form

Hi,
I created a multilingual form in which all the fields of the form are in a particular language . Now am trying to restrict data entry in the form to that language at the client side only . Say if it is a form in french, can we restrict the data entry to french only . The approach i was trying to implement was adding a script against the change event of all data fields and see if the characters lie in the range of the language unicode character set . But have not been successful in it yet . Can anybody help me find some way or provide any sample for it ?
Thanks

Hello, I'm German
Probably you can restrict the characters used for text entry, so for example ü is allowed in the German form but not in French.
But you will NEVER be able to restrict the users staying only writing French in French forms 100%.
1) You sometimes, not often, do encounter letters that are not typical for the language. (Though it can appear in any kind of word, it's quite regular for names.)
2) Let's say I fill the French form. I encounter a problem when I type in the word "Müller". This word wouldn't be French at all. The text will be delted and probably given an error message. Well... I learn out of this error message. Next time I'll type Mueller. ^^
(I knew several pages were people were restricted to talk English by forbidding letters that were not used in English very often... That didn't stop us violating that rule. The only error that really bugged us wasn't the restriction in not using letters that don't exist in English but the "please don't swear or insult so." error that kept appearing for ex. when we used the German word for "that" (= "dass"). They just didn't like the last 3 letters.)
3) Many countries have the same or include other countries unicodes. For example English could be written in the German form or in the French form.
4) You can't get out the syslanguage as far as I know. This would be a great hint which language the person is using.
5) I don't think you can use the spellcheck in any way... great violation against spellchecking could also be a hint for another language.
I know a quite big internetcommunity which did try to accomplish the same as you do. After about 2 years and a lot of experiments they stopped their efforts and were content by popping up the random error-messages warning that you don't have to insult, just like those other communities mentioned above. ^^ (Though they tried to restrict the insulting parts to the language used that didn't work out. Too many people knew how to insult in other languages ;D or which words were similar to insults.)
People just never do what they are supposed to do and are quite nasty finding workarounds...
My advice to you would be:
Don't make the effort.
Sorry for not being able to provide you with a solution, but the opposite.
Lisa

To restrict a object to a particular Group in the Universe

Hi,
I have a object which should be restricted only to a particular group.So when i define the universe we have to have explicit security that will restrict access to this object information from reports and from ad-hoc queries.I should restrict the object only to the particular group by a role based security.
Please help me out in this case.
Thanks in advance,
Madan

Hi Madan,
U can restrict the Object to Particular group or User
In designer go to tools menu and click on manage security and
manage security restictions here u can add new restriction and
as well as add user or group.

To restrict a object to a particular Group at the Universe level

Hi,
I have a object which should be restricted only to a particular group at the universe level.So when i define the universe we have to have explicit security that will restrict access to this object information from reports and from ad-hoc queries.I should restrict the object only to the particular group by a role based security.
Please help me out in this case.
Thanks in advance,
Madan

Hi Madan,
Please follow the below steps:
(In Designer)
1) Open Island Resort Marketing universe or any universe in Designer.
2) Goto Tools -> Manage security -> Manage Access Restrictions.
3) Click on New option - > Give the Restriction name - >click on Rows tab - > Click on Add button (New Row Restriction window comes) -> give table name For example:"Resort_Country" in the Table text box, under the Where Clause "Resort_Country.COUNTRY = @Prompt ('Which country?u2019,u2019 A',, MONO,FREE)"-> Click OK -> Click Ok.
4) Click on Add user or group - >Select the user ->Ok.
5) Click on Apply -> Click OK.
6) Save the universe and export it into the repository.
7) Cretae the new report (webi/deski) from the user the one who belongs from this group.
Hope above steps will helps you.
Regards,
Deepti Bajpai

How to restrict Option values for a particular metadata in profile checkin

How to restrict Option values (drop down) for a particular metadata in profile checkin-
Metadata field Color is having options dropdown values (stored in table/views)-
Display name - Blue, Value=1
Display name - Red, Value=2
Display name - Yellow, Value=3
Display name - Green, Value=4
Display name - Black, Value=5
For a particular profile checkin form, for the metadata field Color I want the dropdown value consist of only top three options
Display name - Blue, Value=1
Display name - Red, Value=2
Display name - Yellow, Value=3
But this should be done on profile level only, should not impact the standrad checkin form and other profile checkin forms.
Please help me if any one having any suggestion to implement the above secnario
Thanks,
Sumit

Hi,
Into the rule containing the Color metadata, you can restrict the values of the list.
In "Has restricted list and pane", list the values 1, 2 and 3 (new line for each value) :
1
2
3
Romain.

Restricting Purchase order for a particular material type

Hi All,
How do I restrict a purchase order document type to be created for a particular material type.
For eample PO document type NB should allow to create for materials with the material type ROH only and restrict the other material types by issuing an error.
Many thanks in advance.
Regard,
Ravi

Hi Ravi,
This is not directly achievable in std. You will have to implement the check in a user exit, e.g. the BAdI ME_PROCESS_PO_CUST method PROCESS_ITEM.
But why this strange reqmt? Maybe there's another solution whuch would keep you in std?
BR
Raf

R12: How to Restrict Custom Responsibility to a particular Organization

Hi,
I have created a new responsibility say xx_resp.
I want it to restrict it to paraticualr one organization say ORG1.
whenver any user access any function under this responsibility he/she cannot query any other organization data except ORG1.
Please advise.
-Thanks
SJ

Hi Sj;
Please see below which could be helpful for your issue:
Restrict report to particular User
to restrict the reports based on user responsiblity
How to Restrict a Resp. to Specific Org. in Multi-Org. Setup within an OU
Value Set Restriction in a Report
Regard
Helios

How to restrict AUTHENTICATED_USERS privileges

It seems by default all Portal login user has privileges to create and manage application and content area.
How can I revoke these privileges from normal login user?

How the program will recognize the users which should not send.
System cannot recognize anything unless we code.
You must be knowing who are the users to be restricted, so better create a z table with those users
and eliminate them from your receiver internal table before triggering that FM.

Restricting LOV MAPS to a particular responsibilty

Dear Friends,
I have 3 lov s in my page ... MATERIAL , SUBINVENTORY AND LOCATOR.
I did a vo extension to get default values to SUBINVENTORY AND LOCATOR fields from another lov (MATERIAL )
I used few LOV MAPS and FORMVALUES.
Now i want to restrict this DEFAULTING to particular responsibilty level only .
Can any one help me in this regard .......HOW TO RESTRICT LOV MAPS AND FORM VALUES TO ONLY A PARTICULAR RESPONSIBILITY.
let me know for clarification, plz help.
Thanks
Aravinda

Dear Friends,
I have 3 lov s in my page ... MATERIAL , SUBINVENTORY AND LOCATOR.
I did a vo extension to get default values to SUBINVENTORY AND LOCATOR fields from another lov (MATERIAL )
I used few LOV MAPS and FORMVALUES.
Now i want to restrict this DEFAULTING to particular responsibilty level only .
Can any one help me in this regard .......HOW TO RESTRICT LOV MAPS AND FORM VALUES TO ONLY A PARTICULAR RESPONSIBILITY.
let me know for clarification, plz help.
Thanks
Aravinda

Restricting The DragSource to a particular area in JPanel

Hi everyone,
I have a JPanel which I have registered as a Drag Source as well as a a drop target. Now I have a header in the JPanel and need to restrict the Drag source to the rest of the JPanel except for the header.
Also there are various polygons drawn on the JPanel. The positions of these can be changed. I need to restrict the drag and drop to these polygons. ie if a drag is initiated on any blank space it should not continue and the drag cursor icon is to be disabled.
Can u give me ideas on how to go about this
Thanks

Hi everyone,
I have a JPanel which I have registered as a Drag Source as well as a a drop target. Now I have a header in the JPanel and need to restrict the Drag source to the rest of the JPanel except for the header.
Also there are various polygons drawn on the JPanel. The positions of these can be changed. I need to restrict the drag and drop to these polygons. ie if a drag is initiated on any blank space it should not continue and the drag cursor icon is to be disabled.
Can u give me ideas on how to go about this
Thanks

Is "parse as" the only way to restrict user privileges?

I have an application which is working in a schema blabla_owner.
Users do not need to log into this app, but I don't want them to be able to update data. Although I only have reports and no updateable forms or anything, my client is not very happy that all queries are implicitly done by the schema owner.
I read that "parse as" can be used, so we created a user blabla_read that can only read in the owner's schema and selected this user in the "parse as" attribute of the application, but unfortunately using this mechanism we need to grant the select privileges directly instead of through a role.
I tried changing the dad to use the readonly user but that is no use since the HTMLDB_PUBLIC_USER is only a dummy user and its privileges do not matter.
Is there another way of accomplishing the following:
- not requiring the users to log in
- be sure all queries are done by a user with readonly privileges only
- be able to use a role to grant privileges instead of doing this directly
Thanks

Not to put too fine a point on it, but as I said earlier An Apex application is no different than a "stored procedure" in that object privileges need to be granted directly to the parsing schema and not via a role
The reason for this might be that DBMS_SYS_SQL.PARSE_AS_USER, the underlying mechanism used by Apex to parse all SQLs requires object privileges to be granted directly to the "parse as" schema (for security reasons), but in any case whatever the reason, it is what is.
I have also "wished" many times that stored procedures/views would work with privileges granted through roles and not directly, but hey, what you gonna do?!

Restricting compile privilege to a particular IP

Similar Messages

Maybe you are looking for