Securing data - custom vs VPD vs another solution

Question

Hi we have a requirement in our project to secure data for entities like "cases" based upon attribute value like "dispute type". So if the attribute "dispute type" has a value "franchise"; an admin can go and create a group "franchise" so that Members of the “Franchise” group can VIEW all parts of all case records with a dispute type of “Franchise” but others cannot. Also we could control the permissions e.g VIEW, Edit CREATE for that group on thoserecord
Like this we could decide to secure "cases" based upon another value for dispute type. Also we could then secure data based upon another attribute.
Potential solutions:1) Custom
we use standard ADF grid to display all data to super admin. He can filter based upon the required attribute, all cases with the value for that attribute.
e.g filter on "dispute type" column and get all cases with "dispute type"= "franchise". We select all these cases and create an access control list (ACLs) a combination of group and permission and apply to these cases. The ACL resides in the database linked to the "cases". This could be normalized tables again. Like this we can filter records at run time and build the ACLs for the cases for which we need to link the groups based upon conditions.
At run time, we only need to check the ACL for a case to decide if the user has access to that based upon whether or not user is any of the group and the permissions then available.
This is on top of the standard ADF permissions
2) VPD - use virtual private data base to do this
3) Other solution
We need to know what could be best possible solution. Also would a VPD based solution be better here? would it allow flexibility like custom solution? also in terms of timelines and performance which is best match ..

Answer 1

Hi,
VPD for sure is a good solution if the same rules apply to multiple applications, not just one and not just ADF. My take on data security usually is to no query what users aren't allowed to see anyway. Data that is left in the database cannot be stolen on transit. For other options I can envision, is the use of discriminator columns as explained here: http://mjabr.wordpress.com/2011/06/17/using-discriminator-columns/ or polymorphic views (see sample 10 at https://blogs.oracle.com/smuenchadf/resource/examples#10) (doc: http://docs.oracle.com/cd/E25178_01/web.1111/b31974/bcadvvo.htm#CEGDCCCB)
You can then define security roles for the different application or enterprise roles that you check (in the case of ADF Security) using EL, Java or Groovy.
Frank
Ps.: Note that JDeveloper 12c will provide options to dynamically apply view criteria based on user security roles, in which case you get another option.