[Security] Row-level security in ADF

Question

Hi all,
I want to implement row-level security in my application, the scenario is like this:
There are several users that connect to the application
These users are authenticated in some way (XML file, OID, DB)
When each user wants to access (Select, Update, Delete) an ADF Table, either updatable or read-only, a predefined 'where condition' based on that table and the operation the user wants to do, must be concatenated to his DML, transparent from the user.
So if for example a user queries the Emp Salary table only records with salary < 10K/Month will be fetched from the underlying table. This should be done automatically and not hard-coded in the application.
I have tried VPD and it has some useful features but my problems are:
1) Where and how to define the 'where conditions'?
2) How to attach the 'where conditions' to the executing DML?
3) What is the best way to make DB know which user is really executing DMLs? (Not a single Application Server admin user)
4) What is the best authentication approach?
Any helps will be really appreciated.
S/\EE|)

Answer 1

Hi,
yes you can. Database proxy user is setup in the prepare session method as well and EUS can be configured to take the J2EE username to then re-connect the app to teh database schema
    public void prepareSession(SessionData SessionData)
       super.prepareSession(SessionData);
       oconn = ((PrxyTransactionImpl)this.getDBTransaction()).getPrxyConnection();
       // Specify the user that connects through the proxy user and its roles
       Properties prop = new Properties();
       prop.put(OracleConnection.PROXY_USER_NAME,"hr");
       //prop.put(OracleConnection.PROXY_ROLES, roles);
       String appContext = "Begin ctxhrpckg.set_userinfo('"+getApplicationUserName()+"'); END;";
       java.sql.CallableStatement st= null;
      // Open the proxy session (DB-authenticated users)
      try
        oconn.openProxySession(OracleConnection.PROXYTYPE_USER_NAME, prop);
        st = getDBTransaction().createCallableStatement(appContext,0);
        st.execute();
      catch (SQLException e)
        e.printStackTrace();
package oracle.sample.dbprxy.adfbc;
import oracle.jbo.server.DBTransactionImpl2;
import oracle.jbo.server.DatabaseTransactionFactory;
* TransactionFactory that returns PrxTransactionImpl, which is a subclass of
* DBTransactionImpl2
* @author Frank Nimphius
public class PrxyDatabaseTransactionFactory extends DatabaseTransactionFactory
  public PrxyDatabaseTransactionFactory()
    super();
   * Override the create method to return an instance of PrxyTransactionImpl instead
   * of DBTransactionImpl2
   * @return PrxyTransactionImpl
  public DBTransactionImpl2 create()
    return new PrxyTransactionImpl();
package oracle.sample.dbprxy.adfbc;
import oracle.jbo.server.DBTransactionImpl2;
import oracle.jdbc.OracleConnection;
public class PrxyTransactionImpl
  extends DBTransactionImpl2
  public PrxyTransactionImpl()
    super();
   * The DBTransactionImpl2 does not expose the connection in a public
   * method. This class is a wrapper to expose the connection to the
   * BC app, so it can be accessed in the ApplicationModuleImpl class
   * @return OracleConnection - SQL Connection
  public OracleConnection getPrxyConnection()
    return (OracleConnection) this.getJdbcConnection();
}Note that for EUS ApplicationModule pooling should be disabled
Frank