Row-level Security over Multiple Tables

Question

Working on Oracle Database 10g Enterprise Edition 10.2.0.4.0 - 64bit
Say you have the following tables:
CREATE TABLE    faculty_course_term
    crn             CHAR(8),
    term            DATE,
    course_college  VARCHAR2(20 Char),
    course_depart   VARCHAR2(20 Char),
    faculty_id      NUMBER,
    fac_college     VARCHAR2(20 Char),
    fac_department  VARCHAR2(20 Char),
    fac_fname       VARCHAR2(20 Char),
    fac_lname       VARCHAR2(20 Char),
    CONSTRAINT      faculty_course_term_uk
        UNIQUE      (crn, term, faculty_id)
CREATE TABLE    course_term
    crn             CHAR(8),
    term            DATE,
    course_subject  VARCHAR2(20 Char),
    course_number   CHAR(4),
    course_section  VARCHAR2(5 Char),
    college         VARCHAR2(20 Char),
    department      VARCHAR2(20 Char),
    course_credits  NUMBER,
    CONSTRAINT      course_term_uk
        UNIQUE      (crn, term)
CREATE TABLE    student_course_term
    crn             CHAR(8),
    term            DATE,
    course_college  VARCHAR2(20 Char),
    course_depart   VARCHAR2(20 Char),
    student_id      NUMBER,
    stu_college     VARCHAR2(20 Char),
    stu_department  VARCHAR2(20 Char),
    earned_credit   NUMBER,
    CONSTRAINT      student_course_term_uk
        UNIQUE      (crn, term, student_id)
);These tables are summary tables that represent multiple other tables. These tables can be joined by the CRN and Term columns. There is not, however, any foreign keys between them.
You have made these tables available within a Subject Area on a repository. You now want to increase your user base for faculty, department heads, and college heads to access this data, but only the data that they have access to via their position.
So you have the following Requirements for your security:
Requirement 1:     Users with a Group_ID of 1 can see all data.
Requirement 2:     Users with a Group_ID of 2 can see all Faculty, Course
          and Student records within their College.
Requirement 3:  Users with a Group_ID of 2 can see Students records
          that are not in their College but are taking Courses in their
          College.
Requirement 4:     Users with a Group_ID of 3 can see all Faculty, Course
          and Student records within their Department.
Requirement 5:  Users with a Group_ID of 3 can see Students records
          that are not in their Department but are taking Courses in their
          Department.
Requirement 6:     All Users can see Course records that they teach (even if it is
          outside their Department or College), as well as all Students
          within those Courses.To meet this criteria, you setup a new table on the database:
CREATE TABLE    faculty_groups
    faculty_id      NUMBER,
    group_id        NUMBER,
    username        VARCHAR2(20 Char),
    fac_college     VARCHAR2(20 Char),
    fac_department  VARCHAR2(20 Char)
);And you setup your Session Initialization Blocks and Variables like this:
SELECT 'GROUP_ID', group_id
FROM faculty_groups
WHERE UPPER (username) = UPPER( 'VALUEOF(NQ_SESSION.USER)')
SELECT 'COLLEGE', fac__college
FROM faculty_groups
WHERE UPPER (username) = UPPER( 'VALUEOF(NQ_SESSION.USER)')
AND group_id = 2And so on for Department and Faculty_ID.
Now, meeting Requirement 1 is easy enough starting all your data filters with:
VALUEOF(NQ_SESSION."GROUP_ID") = 1
ORRequirements 2 and 4 are also easily met in the manner of:
VALUEOF(NQ_SESSION."GROUP_ID") = 2
AND
     "Courses Term"."FACULTY_COURSE_TERM"."COURSE_COLLEGE" =  VALUEOF(NQ_SESSION."COLLEGE")
     OR
     "Courses Term"."FACULTY_COURSE_TERM"."FAC_COLLEGE" =  VALUEOF(NQ_SESSION."COLLEGE")
)However, the hard part comes up with Requirements 3, 5 and 6. Using Requirement 6 on Student_Course_Term as an example, you need to identify the Faculty member that is teaching the Course using the Faculty_Course_Term table, then connect all related records to the Student_Course_Term table using the CRN and Term fields. But attempting the following data filter on the Student_Course_Term table results in a "No fact table exists at the requested level of detail" error:
OR
"Courses Term"."FACULTY_COURSE_TERM"."FACULTY_ID" = VALUEOF(NQ_SESSION."Faculty_ID")As well as trying:
OR
     "Courses Term"."FACULTY_COURSE_TERM"."FACULTY_ID" = VALUEOF(NQ_SESSION."Faculty_ID")
     AND
     "Courses Term"."FACULTY_COURSE_TERM"."CRN" = "Course Term"."STUDENT_COURSE_TERM"."CRN"
     AND
     "Courses Term"."FACULTY_COURSE_TERM"."TERM" = "Course Term"."STUDENT_COURSE_TERM"."TERM"
)Any suggestions? Does what I am attempting require physical foreign keys between the tables?
Edited by: Nick Clinite on May 21, 2013 1:34 PM

Answer 1

I'm not sure how that would help; by using the Faculty_ID Session Variable I can identify the CRN and Term of all courses a faculty member is teaching. But I don't think that has to do with the problem I am having?