Securing Data Access In Same Schema

Dear All Experts,
Please guide us to Securing the Data Access In Same Schema in Oracle Forms & Reports.
Currently our application (Based on Oracle Forms , DB & AS 10g) is running for 6 COMPANIES in same schema. All the 6 COMPANY's employee can access the other COMPANY's Data.
Please give us any idea to Secure the Data Access as we want that if any Employee have the Rights of one or two COMPANIES then he can only access the data of those companies instead of all the companies.
How can we got it using same Oracle Form & Reports...?
Please guide....
Thanks
Eidy

Hello,
<p>Did you check out the Virtual Private Database feature ? </p>
Francois

Similar Messages

How to permit multiple workspaces to access the same schema?

Hello,
When creating a new workspace (version 3.2), I am getting the following warnings:
"Warning: The requested schema already exists. Warning: The requested schema is already assigned to one or more workspaces. Please ensure that giving multiple workspaces access to the same schema is permitted by the security policies at your site before approving this request."
How do I "ensure that giving multiple workspaces access to the same schema is permitted"?
What are the advantages/disadvantages of doing so?
Thanks,
Gabor

The correct answer to it would have been: I use manual provisioning.I didn't ask a detailed enough question. What I am wondering is how you are set up to to workspace provisioning at your site. In apex_admin, if you navigate to Home>Manage Service>Instance Settings there is a radio group like:
Provisioning Status:
0 Manual - An administrator manually creates each workspace
0 Request - Link displayed on login page enabling users to request workspaces
0 Email Verification - Workspace created after email address is verified by the user
The help text for this is:
Provisioning Status:
Determines how the process of provisioning (or creating) a workspace works for your development instance. Options include:
    * Manual - An Application Express administrator manually creates new workspaces and notifies the Workspace administrator of the login information.
    * Request - Users request workspaces directly in a self-service fashion. Selecting this option displays a link on the Login page enabling users to request a workspace. When a user requests a workspace, each request is submitted to a queue for approval.
    * Email Verification - Works similar to Request except each user receives an initial email containing a link. Clicking this link validates the user's email address before the request is processed.
Note: To enable users to request a workspace using a link on the Login page, you must choose Request or Email Verification. If you select Manual, no link appears on the login page.How is yours set up?
As to the first original question (How do I "ensure that giving multiple workspaces access to the same schema is permitted"?), I still do not know.Whether it is permitted or not is a decision made by the apex site administrator who approves/declines workspace requests. Whether it ought to be permitted is a different question and is really same as your second question which involves issues you said you are now starting to understand better. So I think we've covered your original questions. If not, please elaborate.
As to the last subject (How did the hidden workspace get created and how do I get rid of id? What happens if I don't?), this happened at work, so I can only tell you more on Monday (luckily...). Until then, here is what I remember. The work space was created, which is proven by the fact that when I want to create a new workspace with the same name, I am getting an error, which says that a workspace with that name already exists. However, I cannot delete the workspace, since it show up nowhere.No hidden workspace got created. I'm pretty sure the request is just in the queue waiting to be approved/declined. In the meantime a workspace with the same name cannot be requested.
By the way, how do you quote some text here? I just put a '>' in the first character position before the text to quote. You can also use the " rich text icon above the text pane.
Scott

Security data access protection

Hello,
I would like to protect my 10gr2 database from the os superuser (root power). Does exist a configuration that permit to obtain this goal ?
Thanks for your answers
Fabrice

Root is a system administrator, a superuser. It can do everything.
Why You want to disable it or restrict its power?
You will not be able to administrate the server anymore.
Either trust the root and set strong passwords, enable audit, restrict login to root from remote shell, don't share root password around etc or fire Your sysadmin if he is doing stupid things.

Please help! Multiple users accessing the same data sets

Hi all,
Can anyone provide a bit of insight in to a question I have?
We have two users that require to see the same set of data in the BPC Excel interface at the same time. The information is employees and date.
User 1 would like to see All Employee SignedData for 1 month, and User 2 would like to see just a slice of the Employees for 1 month.
If both of the Users are logged in at the same time, what will happen in terms of SAP 'locking' the data set? I am aware of Data Access Profiles to restrict their access to particular Master Data but there will be the requirement for users to see (maybe just in read-only), data that is shared between both Users.
Will it throw up an error or can I make it so that users have 'read only' access?
Any advice would be very much appreciated!
Nick

Hi Nick,
No issue with that at all.
They can even both have write access. If they try to update the exact same record at the same time BPC will just keep writing Delta records.
User A enters 10
User B enters 20
User A refreshes and will get 20
User B refreshes and also gets 20

I have a production mobile Flex app that uses RemoteObject calls for all data access, and it's working well, except for a new remote call I just added that only fails when running with a release build. The same call works fine when running on the device

I have a production mobile Flex app that uses RemoteObject calls for all data access, and it's working well, except for a new remote call I just added that only fails when running with a release build. The same call works fine when running on the device (iPhone) using debug build. When running with a release build, the result handler is never called (nor is the fault handler called). Viewing the BlazeDS logs in debug mode, the call is received and send back with data. I've narrowed it down to what seems to be a data size issue.
I have targeted one specific data call that returns in the String value a string length of 44kb, which fails in the release build (result or fault handler never called), but the result handler is called as expected in debug build. When I do not populate the String value (in server side Java code) on the object (just set it empty string), the result handler is then called, and the object is returned (release build).
The custom object being returned in the call is a very a simple object, with getters/setters for simple types boolean, int, String, and one org.23c.dom.Document type. This same object type is used on other other RemoteObject calls (different data) and works fine (release and debug builds). I originally was returning as a Document, but, just to make sure this wasn't the problem, changed the value to be returned to a String, just to rule out XML/Dom issues in serialization.
I don't understand 1) why the release build vs. debug build behavior is different for a RemoteObject call, 2) why the calls work in debug build when sending over a somewhat large (but, not unreasonable) amount of data in a String object, but not in release build.
I have't tried to find out exactly where the failure point in size is, but, not sure that's even relevant, since 44kb isn't an unreasonable size to expect.
By turning on the Debug mode in BlazeDS, I can see the object and it's attributes being serialized and everything looks good there. The calls are received and processed appropriately in BlazeDS for both debug and release build testing.
Anyone have an idea on other things to try to debug/resolve this?
Platform testing is BlazeDS 4, Flashbuilder 4.7, Websphere 8 server, iPhone (iOS 7.1.2). Tried using multiple Flex SDK's 4.12 to the latest 4.13, with no change in behavior.
Thanks!

After a week's worth of debugging, I found the issue.
The Java type returned from the call was defined as ArrayList. Changing it to List resolved the problem.
I'm not sure why ArrayList isn't a valid return type, I've been looking at the Adobe docs, and still can't see why this isn't valid. And, why it works in Debug mode and not in Release build is even stranger. Maybe someone can shed some light on the logic here to me.

Compare Table Data on 2 different databases having same schema

I need to compare data in all the tables in 2 different databases having same schema.
If there is any difference in data in any table on Database1 and Database2 then I need to update/insert/delete the rows in my table in Database2.
So Database1 is my source database and Database2 is my sync database. I cannot use expdp tables as I am not having sufficient privileges to the database server.
Also I cannot drop and recreate the tables as they are huge.
Can anyone please guide me how to compare data and to write a script to comapre the changes in say Database1.Table1 and Database2.Table1 and then accordingly do inserts/updates/deleted on Database2.Table1?
Thanks

Karthick_Arp wrote:
Do you have a DBLink? If youes you can do this.
1. Login into the Database-2 and run this code.
begin
for i in (select table_name from user_tables)
loop
execute immediate 'truncate table ' || i.table_name;
end loop;
end;This will empty all the tables in your Database-2. Now what you need is to just populate the data from Database-1This might result in error, if any of the tables have referential integrity on them.
From 10g documentation :
Restrictions on Truncating Tables
You cannot individually truncate a table that is part of a cluster. You must either truncate the cluster, delete all rows from the table, or drop and re-create the table.
You cannot truncate the parent table of an enabled referential integrity constraint. You must disable the constraint before truncating the table. An exception is that you can truncate the table if the integrity constraint is self-referential.
If a domain index is defined on table, then neither the index nor any index partitions can be marked IN_PROGRESS.I would go for normal MERGE. Also change the cursor to select table names by first modifying the child tables and then the parent table.

Securing data from dba access , like Credit Card Details

Hello ,
is there any way of hiding CC details from all users in db level except specifc users
enrypting cc data like oracle hashed passwords
for ex,
case (1)
user 1 ( has access to these details )
select acc#,customer_name from cc_details
output : it will show all the details decrypted
case (2)
user 2 : ( doesnt have access )
select acc#,customer_name from cc_details
output : it will show all the details encrypted
both in db level , like using sqlplus or toad
any idea!
thanks and regards,

Hi, Peter,
You wrote:
Can you please document the problems you mention for Patch Sets/ CPU?
What are the vulnerabilities? Search Alex's Web site but didn't find anything in regards to >DBVault.I've told about these
http://dms.aladdin.ru/file.php?id=d7eb03f7f47ec3c68f4b1f1fe3317119
http://dms.aladdin.ru/file.php?id=88cf1d7a962eddf7e57e2447d1e5b207
and may be this
http://dms.aladdin.ru/file.php?id=232eb8ed58d04295bb3920dbe805358d
(Note: The link will be valid until 26 Jun 2008 GMT).
In reg's to reading data from datafile, that's where TDE comes into the picture; then no-one can read from data file directly.
There is no user who owns TDE; TDE is enabled on a database-wide level. So the >normal data owner (who is the only who should have full access to his own data with >DBVault) can use TDE to encrypt; no extra privileges needed.I’ve told about the user who is the owner of the database wallet (usually SYS). He can temporary disable encryption, takes the data, then restore encryption.
DBVault and TDE should be the perfect match for 'securing data from dba access , like >Credit Card Details'In other words we have yet another administrator (DV owner) instead of the good old SYS :)
And I have a question: in case the protection with DV of some tables was made from the SYS, can he make (in example) full backup or full export of the data (his ordinary administrative tasks)? If yes, then it isn't protection, if no, then...what?
The solution is somewhere else, I think

Data Access Service is unable to log audit events to the security event log

Hi,
Scenario: SCOM 2012 R2 UR4. (Windows 2012 R2)
Today SCOM have generated 4 alerts Data Access Service is unable to log audit events to the security event log.
The service account for "System Center Data Access Service" service is "Local System".
The users at "Generate security audits" are: LOCAL SERVICE and NETWORK SERVICE.
The question is:
how to resolve this alert? (Where look for to obtain more information to resolve this problem)
Thanks in advance!

Local system account is differet to local service account. Fo detail description of these accounts, pls. refer
LocalService Account
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684188(v=vs.85).aspx
LocalSystem Account
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684190(v=vs.85).aspx
Generate security audits which is under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment of Group policy, determines which accounts can be used by a process to add entries to the security log. This user right
is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers. By default, only the LocalSystem account has the privilege to be used by processes to generate security audits.
For identified the SDK account
1) open services.msc
2) From the system Center Data Access Service, you can see the SDK logon on as account
Roger

BI Data Access Set-based security

Hi,
My client is using EBS security feature “Data Access Set” for segment security. I'm looking for a tech note to implement this type of security from the OBIEE/OBIA side.
Any pointers on this topic would be very much appreciated,
Tarik Bouaziz.
Environment: OBIEE 11.1.1.5.0 on Solaris Sparc64, OBIA 7.9.6.3, EBS 12.1.3

Tarik,
If I don't mistake, the "Data Access Set" security on EBS 12 is based on the Ledger-Based Security in OBIA (2.6.4 Ledger-Based Security for Oracle EBS).
Gurus, thanks to confirm.
Hope it helps,
Benoît

MapViewer metadata problem - accessing spatial data in a different schema.

I have a MapViewer application that uses data from three different schemas.
1. Dynamic Themes come from schema A.
2. Static Themes come from schema B.
3. A newly added static theme in B whose data comes from schema C.
The mapviewer datasource points to schema B where the static themes, data and metadata are defined while the dynamic themes have their own datasource specified as part of addJDBCTheme(...).
To get the newly added map to work I've had to add a view in schema B that points to C instead of referencing directly the table and I've had to add the metadata twice, once for schema B and once for schema C.
If I put the metadata in just one of the two schemas I get the following errors.
08/11/21 13:58:57 ERROR [oracle.sdovis.ThemeTable] cannot find entry in ALL_SDO_GEOM_METADATA table for theme: AMBITOS_REST
08/11/21 13:58:57 ERROR [oracle.sdovis.ThemeTable] java.sql.SQLException: Invalid column index
OR
08/11/21 13:53:39 ERROR [oracle.sdovis.theme.pgtp] java.sql.SQLException: ORA-29902: error in executing ODCIIndexStart() routine
ORA-13203: failed to read USER_SDO_GEOM_METADATA view
It's not a big deal but I'd like to know if anyone else has has similar problems.
Saludos,
Lew.
Edited by: Lew2 on Nov 21, 2008 6:42 AM

Hi Lew,
if you are using a recent version (10.1.3.1 or later) there is no need to use a view and to create the metadata in both schemas.
You need to grant selection on tables between the schemas.
You can try the following. Assume you have the MVDEMO schema (from MapViewer kit) and SCOTT schema.
1) grant select on MVDEMO Counties table to SCOTT
SQL> grant select on counties to scott;
2) Now you are ready to create a predefined theme in schema SCOTT using the MVDEMO Counties table.
- Open MapBuilder and loads the SCOTT schema.
- On the Data navigator (bottom left tree), go to Geometry tables and you should see the MVDEMO node and the COUNTIES node inside it.
- Start a wizard to create a geometry theme based on this Counties table.
- At the end you should see that the base table name is MVDEMO.COUNTIES. Therefore MapViewer will use the metadata in MVDEMO schema and there is no need to replicate it in SCOTT schema.
Joao

Unable to connect to the Data Access service for this management server

Hate to raise a sleeping horse but was hoping someone might have some insight into why SCOM Report Server install is failing. I am using a domain account for SCOM 2012 R2 services in a distributive environment
with 2 management servers and 2 SQL servers…one for Ops db and one for DW db.
Install was failing on selecting the management server. Research led me to
Kevin Holman's site. I followed his doc and SPN are set per your config and can telnet to MGMT1 on 5723…firewall is off on all servers. I am a domain admin and scom.mgmt account (MSOMSdkSvc) is a local admin on the MGMT servers.
>setspn -l domain\scom.mgmt
Registered ServicePrincipalNames for CN=scom.mgmt,OU=Service Accounts,DC= domain,DC=net:
MSOMSdkSvc/SCOM-MGMT1
MSOMSdkSvc/SCOM-MGMT1.domain.net
MSOMSdkSvc/SCOM-MGMT2
MSOMSdkSvc/SCOM-MGMT2.domain.net
>setspn -l domain\scom-mgmt1
Registered ServicePrincipalNames for CN=SCOM-MGMT1,OU=SCOM,OU=INTERNAL,DC=domain,DC=net:
MSOMHSvc/SCOM-MGMT1.domain.net
TERMSRV/SCOM-MGMT1.domain.net
WSMAN/SCOM-MGMT1.domain.net
RestrictedKrbHost/SCOM-MGMT1.domain.net
HOST/SCOM-MGMT1.domain.net
MSOMHSvc/SCOM-MGMT1
TERMSRV/SCOM-MGMT1
WSMAN/SCOM-MGMT1
RestrictedKrbHost/SCOM-MGMT1
HOST/SCOM-MGMT1
>setspn -l domain\scom-mgmt2
Registered ServicePrincipalNames for CN=SCOM-MGMT2,OU=SCOM,OU=INTERNAL,DC=domain,DC=net:
MSOMHSvc/ SCOM-MGMT2.domain.net
MSOMHSvc/ SCOM-MGMT2
WSMAN/SCOM-MGMT2.domain.net
WSMAN/SCOM-MGMT2
        TERMSRV/SCOM-MGMT2.domain.net
TERMSRV/SCOM-MGMT2
RestrictedKrbHost/SCOM-MGMT2
HOST/CHH-SCOM-MGMT2
RestrictedKrbHost/CHH-SCOM-MGMT2.osi-asp.net
HOST/CHH-SCOM-MGMT2.osi-asp.net
>setspn -l domain\scom-ssrs
Registered ServicePrincipalNames for CN=SCOM-SSRS,OU=SCOM SQL,OU=SCOM,OU=CHH-INTERNAL,DC=domain,DC=net:
    WSMAN/SCOM-SSRS
WSMAN/SCOM-SSRS.domain.net
MSSQLSvc/SCOM-SSRS.domain.net
MSSQLSvc/SCOM-SSRS.domain.net:1433
    TERMSRV/SCOM-SSRS.domain.net
TERMSRV/SCOM-SSRS
RestrictedKrbHost/SCOM-SSRS
  HOST/SCOM-SSRS
RestrictedKrbHost/SCOM-SSRS.domain.net
HOST/SCOM-SSRS.domain.net
When I point to the MGMT server, I keep getting “Unable to connect to the Data Access service for this management server. Ensure the Data Access service is running and that the service, the management group, and setup are
all the same version”.
OpsMgrSetupWizard.log states…
Info:
:Could not connect to Management Server: scom-mgmt1.domain.net with exception: Threw Exception.Type: System.ArgumentException, Exception Error Code: 0x80070057, Exception.Message: Version string portion was too short or
too long.
Info:
:StackTrace:   at System.Version.TryParseVersion(String version, VersionResult& result) at System.Version..ctor(String version) at Microsoft.EnterpriseManagement.OperationsManager.Setup.Common.SetupHelpers.IsManagementServerCurrentVersion(String
managementServer) at Microsoft.EnterpriseManagement.OperationsManager.Setup.Common.SetupHelpers.CanConnectToManagementGroup(String managementServer)
When I searched on "Exception.Message: Version string portion was too short or too long" it led me to .Net strings in the reg. i deleted all refs to older versions (3.x) but still no good.
Bob

Well, I’m back to trying to get SCOM Report Server up and running. This time I decided to try the command line silent install and rely on logs to debug. But it still fails.
This is the script: SETUP /install /InstallPath:D:\Program Files\Microsoft System Center 2012 R2\Operations Manager /components:OMReporting /ManagementServer:<server>.<domain> /SRSInstance:<instance> /DataReaderUser:<domain>\<account>
/DataReaderPassword:******** /SendODRReports:0 /UseMicrosoftUpdate:0 /AcceptEndUserLicenseAgreement:1
When I run the script, I get a pop-up: “System CenterOperations Manager Setup has stopped working with the following:
Problem signature:
Problem Event Name:
CLR20r3
Problem Signature 01:
setupchainerui.exe
Problem Signature 02:
7.0.5000.0
Problem Signature 03:
522a5b85
Problem Signature 04:
mscorlib
Problem Signature 05:
4.0.0.0
Problem Signature 06:
53b4fc1e
Problem Signature 07:
e4d
Problem Signature 08:
5a
Problem Signature 09:
System.FormatException
OS Version:
6.1.7601.2.1.0.274.10
Locale ID:
1033
Additional Information 1:
4911
Additional Information 2:
49111a576c61a461b7f2900e4224563c
Additional Information 3:
a1e6
Additional Information 4:
a1e62e9c159c1d7601a31ccff83dbf94
App Event Log:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name=".NET Runtime" />
<EventID Qualifiers="0">1026</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-01-29T19:02:39.000000000Z" />
<EventRecordID>4999</EventRecordID>
<Channel>Application</Channel>
<Computer>SERVER NAME</Computer>
<Security />
</System>
- <EventData>
<Data>Application: SetupChainerUI.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception.
Exception Info: System.FormatException Stack: at Microsoft.SystemCenter.Essentials.SetupFramework.Program.Main()</Data>
</EventData>
</Event>
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-01-29T19:02:41.000000000Z" />
<EventRecordID>5000</EventRecordID>
<Channel>Application</Channel>
<Computer>SERVER NAME</Computer>
<Security />
</System>
- <EventData>
<Data>SetupChainerUI.exe</Data>
<Data>7.1.10226.0</Data>
<Data>522a5b85</Data>
<Data>KERNELBASE.dll</Data>
<Data>6.1.7601.18409</Data>
<Data>5315a05a</Data>
<Data>e0434352</Data>
<Data>000000000000940d</Data>
<Data>a64</Data>
<Data>01d03bf626a03a7a</Data>
<Data>C:\Users\USER NAME\AppData\Local\SCOM\Setup\SetupChainerUI.exe</Data>
<Data>C:\Windows\system32\KERNELBASE.dll</Data>
<Data>65be21be-a7e9-11e4-a4d7-005056966e1b</Data>
</EventData>
</Event>
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Windows Error Reporting" />
<EventID Qualifiers="0">1001</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-01-29T19:03:27.000000000Z" />
<EventRecordID>5001</EventRecordID>
<Channel>Application</Channel>
<Computer>SERVER NAME</Computer>
<Security />
</System>
- <EventData>
<Data />
<Data>0</Data>
<Data>CLR20r3</Data>
<Data>Not available</Data>
<Data>0</Data>
<Data>setupchainerui.exe</Data>
<Data>7.0.5000.0</Data>
<Data>522a5b85</Data>
<Data>mscorlib</Data>
<Data>4.0.0.0</Data>
<Data>53b4fc1e</Data>
<Data>e4d</Data>
<Data>5a</Data>
<Data>System.FormatException</Data>
<Data />
<Data />
<Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_setupchainerui.e_9724aaa8eec4ffba07c27fea369e612e949d75_5b269652</Data>
<Data />
<Data>0</Data>
<Data>65be21be-a7e9-11e4-a4d7-005056966e1b</Data>
<Data>0</Data>
</EventData>
</Event>
OpsMgrSetupWizard.log
[13:48:16]:
Error:     :Uncaught Exception: Threw Exception.Type: System.FormatException, Exception Error Code: 0x80131537, Exception.Message: Input string was not in a correct format.
[13:48:16]:
Error:     :StackTrace:
at System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal)
   at System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info)
   at System.Convert.ChangeType(Object value, Type conversionType, IFormatProvider provider)
   at Microsoft.SystemCenter.Essentials.SetupFramework.PropertyBagDictionary.GetProperty[T](String property)
   at Microsoft.EnterpriseManagement.OperationsManager.Setup.Common.SetupHelpers.ValidateBureaucraticSwitches()
   at Microsoft.EnterpriseManagement.OperationsManager.Setup.Common.RationalizeCommandLineArguments.ValidateSilentInstallCommandLineOptions()
   at Microsoft.EnterpriseManagement.OperationsManager.Setup.Common.RationalizeCommandLineArguments.Rationalize()
   at Microsoft.EnterpriseManagement.OperationsManager.Setup.Common.SetupHelpers.RationalizeGeneralInstall()
   at Microsoft.SystemCenter.Essentials.SetupFramework.Program.RationalizeInstall()
   at Microsoft.SystemCenter.Essentials.SetupFramework.Program.Main()
Any ideas? I feel like I’m just going in circles…Bob

How to implement Oracle user/role security with Access front end?

Hi,
We have successfully migrated our Access database tables to Oracle 10g using SQL developer. We've recreated all the users and roles(i.e., access groups) in Oracle and granted rights to tables.
In the Access front end database, in the Database window we have saved linked Oracle tables which replaced the Access tables. The forms, reports, queries run fine with the linked Oracle tables. All the linked table use one ODBC DSN to the Oracle database with the same Oracle user id.
We need to be able to authenticate users into the Oracle database and RE-link the tables based on their own unique user id. By during so we can allow users to use the Oracle standard user id/role and system privileges to control select, update, ect. rights to the database.
I've been able to use the VB code within Access to logon into the database with a unique id, but I have not been able to find out how to RE-link the tables to the unique user id using VB. There should be some way to relink tables dynamically, based on users login into the Access front end.
I don't know a great deal about Access projects, but I do know with SQL server allows login into your Access project and link tables dynamically.
Can someone give me some assistance or point me in the right direction?
Thanks in advance,
Larry

We had one of our programmers here come up with a VB code solution for re-linking table within Access. However the relinking takes 3-4 minutes for 100+ tables.
In an effort to help you understand the situation better, I will attempt to elaborate on the problem:
We have an Access 2003 application which currently has a front end using Access(forms, reports, queries, & VB code) and a MS Access 2003 backend.
We have migrated the backend tables to Oracle. However, we still have a need to maintain the front end in Access, since we have over 60 forms, 40 reports, 200+ queries in Access. Its easy to understand, we have a significant investment in the front end(Obviously, the plan is to migrate the front end also at some future date).
In order to utilized the existing front end, we have to validate and modify the current front end connections to the new Oracle backend. One of the features of Access is that you can "link" tables and save the link for runtime. Each Access table can have its own link which is a separate ODBC/JET connection. As such, each separate link has its own userid/database information.
The other issue with using the Access front-end is that Access utilizes a workgroup file to implement user and group security. The workgroup file contains all the users and which groups the users belong to in Access. Then within Access, you allow users access to object(tables, queries, ect) by their userid and or group. When users open an Access database with Access security enabled, they are required to log into Access. The login is authenticated by the workgroup file. Once, logged into Access, users have rights to Access objects based on their rights granted to their userid and groups they belong. The problem here is that when you remove the linked Access tables and replace them with linked Oracle tables, Access has knowledge about Oracle table rights granted to users; nor would you expect it to.
The dilema is the disconnect between Access and the fact Oracle utilizes a similar but much more sophisticated security model. It creates users and roles(which are similar to Access groups), and again this is independent of Access security.
Our solution was to still use the Access workgroup file security along with the Oracle security model. By using the Access userid and then creating a similar Oracle userid with similar table rights granted in Access, you could apply security within Access and also with the Oracle database.
For example, a user BOB logs into Access via the workgroup file, using VB code, Access then establishes a Oracle connection logining into Oracle using the same unique userid BOB into Oracle.
After connecting and validating user BOB into Oracle, then the Access tables are relinked to Oracle using the user BOB userid and table rights.
This Oracle userid has been granted table rights specific for this userid.This allows the user BOB to use the Access application and still be authenticated into the Oracle database.
The problem with this solution is that the relinking of the saved Access tables takes 3-7 minutes for about 100+ tables. This is not acceptable for users each time they log into the application.
Our current alternative is to use one Oracle userid to login each user, and use Access form restrictions/security to allow/prevent users from updating/viewing data. Obviously, this is not the optimal solution in respect to security, but it at least allows us to control access to the data(via the forms) by using one logon required for each user, and quick startup time for the application.
I understand SQL server does a better job in integration, but we use Oracle which is what I am trying to work with.
Larry

Security error accessing ur unable to load wsdl

HI
I am using a webservice(.net webservice) that is on my
localhost and using it in flex application that is also on my
system. Means both the webservice and flex application are on the
same system.
But when i gives the reference of the webservice using the
system ip and run the application by the flex builder it generates
the error as:
mx.messaging.messages::ErrorMessage)#0
body = (Object)#1
clientId = "DirectHTTPChannel0"
correlationId = "24CD6542-F141-1A05-BA35-00A108CB30A0"
destination = ""
extendedData = (null)
faultCode = "Channel.Security.Error"
faultDetail = "Destination: DefaultHTTP"
faultString = "Security error accessing url"
headers = (Object)#2
messageId = "CC123DF0-0E6C-05FF-7894-00A109676283"
rootCause = (flash.events::SecurityErrorEvent)#3
bubbles = false
cancelable = false
currentTarget = (flash.net::URLLoader)#4
bytesLoaded = 0
bytesTotal = 0
data = (null)
dataFormat = "text"
eventPhase = 2
target = (flash.net::URLLoader)#4
text = "Error #2170: Security sandbox violation:
http://localhost:3000/MYCIMS/flex_bin/Design.swf
cannot send HTTP headers to
http://myip/MyServer/AdminWS.asmx."
type = "securityError"
timestamp = 0
timeToLive = 0
I have put crossdomain.xml file in the root of the localhost
and made every changes possible in the crossdomain.xml file but the
application is not running.
Please somebody provide an effective solution, I have spend
lots of time to resolve the problem but its not being....
Thanks in advance
Gopi Saini

Have you seen this blog
"Crossdomain.xml" in ABAP Web AS Server cache

Accessing a different schema in Oracle

Hi,
I currently have a great deal of code that assumed it would have access to the same database schema as the logged on user e.g.
"Select * from TABLE_NAME" (no need to specify schema name).
I have found out that we will now be using a system where the user that logs on, will be granted select, update and delete priviledges on another schema. So now after setting up the connection, my code would have to read: "Select * from ANOTHER_SCHEMA.TABLE_NAME" where ANOTHER_SCHEMA is the schema that contains the tables.
My question is, since I would have to modify a great deal of code at this point, is there any way to change the user on an existing connection so that I would not have to manually affix the new schema name to all table references? I would have to be able to do this without logging on as this alternate user since we will not have the password for that user (for security reasons).
I have considered creating views in the initial schema that access the alternate schema (e.g CREATE VIEW TABLE_NAME AS SELECT * FROM ANOTHER_SCHEMA.TABLE_NAME), however I was wondering if there might be a better way to do this?

Yes he would have to change his code. I am just used to using "S_" and it is the standard Oracle naming convention for synonyms. (Also it makes it clear that you are referencing the table via a synonym rather than hitting the table directly.
Why not encode all table names in an abstract class.
Eg
package utils;
public class TableNames
public static final String TABLE_NAME1 = "S_TABLE_NAME1";
public static final String TABLE_NAME2 = "S_TABLE_NAME2";
//etc etc
This class can then be used in the building of sql statements. If the table name happens to change at any time then a change is only required in TableNames class.

The Date Accessed attribute is resetting to all the files in a folder

Hi all,
I have an issue that the "Date Accessed" attribute is often resetting to all the files in a folder if i open single file as this folder is from File server mapped as Drive to me. This is happening to all the users whoever connect to that fileserver
and i see same issue from RDP as well. is there any option to check which is resetting the "Date Accessed" attribute to all the files. The Date Access attribute is simillar to Date accessed and Date modified. We need to fix this issue as it is related
to security concern for us. The file server is windows 2008 R2 and the client machines are windows 7.
Side note: I can see that there is no software, antivirus, offline sycn is causing this issue.
Thank you,
Sampath
P.Sampath

Hi,
It seems that some specific process accessed the files and updated the attribute. You could configure auditing on the shared folder. Then you can go through the auditing log to check which process is doing the read operation on all these files.
Configuring Audit Policies
http://technet.microsoft.com/en-us/library/dd277403.aspx
Best Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Securing Data Access In Same Schema

Similar Messages

Maybe you are looking for