Setting Application Context Attributes for Enterprise Users Based on Roles

Question

Hello,
We have an Oracle 11g database with a table containing data from multiple sites (a SiteID field identifies the site for a record). Since application users can have access to different subsets of sites, we would like to use Oracle's Virtual Private Database feature to enforce row-level security on the table.
I did a successful proof-of-concept with database users. I created a role for each site (example: USER_SITE_A, USER_SITE_B, ...), and then assigned the appropriate site roles to each database user. I then created a package (run via a logon trigger) which set application context attributes for each site. If the current database user has been assigned a role for a given site, then the corresponding attribute named "SITE_PRIVILEGE_SiteID" is set to 'Y'... otherwise, it is set to 'N'. Here is the code which worked to set application context attributes for database users:
-- For each record in my RoleSitePrivileges table, set
--   an attribute named 'SITE_PRIVILEGE_<SiteID>'.
--   If the current user has been assigned a role matching
--   the value in the 'RoleName' field, set the corresponding
--   attribute to 'Y'... otherwise, set it to 'N'.
FOR iPrivRec IN (SELECT RoleName, SiteID
                   FROM RoleSitePrivileges
                   ORDER BY SiteID)
   LOOP
      SELECT COUNT(*)
        INTO roleExists
        FROM dba_role_privs
        WHERE granted_role = UPPER(iPrivRec.RoleName)
          AND grantee = USER;
      IF roleExists > 0 THEN
         DBMS_SESSION.set_context(
                     namespace   => 'my_ctx',
                     attribute   => 'SITE_PRIVILEGE_' || iPrivRec.SiteID,
                     value       => 'Y');
      ELSE
         DBMS_SESSION.set_context(
                     namespace   => 'my_ctx',
                     attribute   => 'SITE_PRIVILEGE_' || iPrivRec.SiteID,
                     value       => 'N');
      END IF;
   END LOOP;To finish things off, I created a security policy function for the table which returns the following:
RETURN 'SiteID IN (SELECT TO_NUMBER(SUBSTR(attribute, 15))
                     FROM session_context
                     WHERE attribute LIKE ''SITE_PRIVILEGE_%''
                        AND value = ''Y'')';This setup worked great for database users. I am now working to do a comparable proof-of-concept for enterprise users created in Oracle Internet Directory (OiD). I have Enterprise User Security (EUS) up and running with OiD, global roles created in the database, enterprise roles defined in EUS with global role assignments, and enterprise roles assigned to OiD users. The enterprise users are able to successfully login to the database, and I can see the appropriate global role assignments when I query the session_roles view.
I tried using the same application context package, logon trigger, and security policy function with the enterprise users that I had used with the database users. Unfortunately, I found that the application context attributes are not being set correctly. As you can see from the code above, the applicaiton context package was referencing the dba_role_privs view. Apparently, although this view is populated for database users, it is not populated for enterprise users.
I tried changing the application context package to use invoker's rights and to query the session_roles view instead of the dba_role_privs view. Although this package sets the attributes correctly when called manually, it does not work when called from the logon trigger. That was an oops on my part, as I didn't realize initially that a PL/SQL procedure cannot be called with invoker's rights from a trigger.
So, I am now wondering, is there another view that I could use in code called from a logon trigger to access the roles assigned to the enterprise user ? If not, is there a better way for me to approach this problem? From a maintenance standpoint, I like the idea of controlling site access from the LDAP directory service via role assignments. But, I am open to other ideas as well.
Thank you!

Answer 1

Hello,
We have an Oracle 11g database with a table containing data from multiple sites (a SiteID field identifies the site for a record). Since application users can have access to different subsets of sites, we would like to use Oracle's Virtual Private Database feature to enforce row-level security on the table.
I did a successful proof-of-concept with database users. I created a role for each site (example: USER_SITE_A, USER_SITE_B, ...), and then assigned the appropriate site roles to each database user. I then created a package (run via a logon trigger) which set application context attributes for each site. If the current database user has been assigned a role for a given site, then the corresponding attribute named "SITE_PRIVILEGE_SiteID" is set to 'Y'... otherwise, it is set to 'N'. Here is the code which worked to set application context attributes for database users:
-- For each record in my RoleSitePrivileges table, set
--   an attribute named 'SITE_PRIVILEGE_<SiteID>'.
--   If the current user has been assigned a role matching
--   the value in the 'RoleName' field, set the corresponding
--   attribute to 'Y'... otherwise, set it to 'N'.
FOR iPrivRec IN (SELECT RoleName, SiteID
                   FROM RoleSitePrivileges
                   ORDER BY SiteID)
   LOOP
      SELECT COUNT(*)
        INTO roleExists
        FROM dba_role_privs
        WHERE granted_role = UPPER(iPrivRec.RoleName)
          AND grantee = USER;
      IF roleExists > 0 THEN
         DBMS_SESSION.set_context(
                     namespace   => 'my_ctx',
                     attribute   => 'SITE_PRIVILEGE_' || iPrivRec.SiteID,
                     value       => 'Y');
      ELSE
         DBMS_SESSION.set_context(
                     namespace   => 'my_ctx',
                     attribute   => 'SITE_PRIVILEGE_' || iPrivRec.SiteID,
                     value       => 'N');
      END IF;
   END LOOP;To finish things off, I created a security policy function for the table which returns the following:
RETURN 'SiteID IN (SELECT TO_NUMBER(SUBSTR(attribute, 15))
                     FROM session_context
                     WHERE attribute LIKE ''SITE_PRIVILEGE_%''
                        AND value = ''Y'')';This setup worked great for database users. I am now working to do a comparable proof-of-concept for enterprise users created in Oracle Internet Directory (OiD). I have Enterprise User Security (EUS) up and running with OiD, global roles created in the database, enterprise roles defined in EUS with global role assignments, and enterprise roles assigned to OiD users. The enterprise users are able to successfully login to the database, and I can see the appropriate global role assignments when I query the session_roles view.
I tried using the same application context package, logon trigger, and security policy function with the enterprise users that I had used with the database users. Unfortunately, I found that the application context attributes are not being set correctly. As you can see from the code above, the applicaiton context package was referencing the dba_role_privs view. Apparently, although this view is populated for database users, it is not populated for enterprise users.
I tried changing the application context package to use invoker's rights and to query the session_roles view instead of the dba_role_privs view. Although this package sets the attributes correctly when called manually, it does not work when called from the logon trigger. That was an oops on my part, as I didn't realize initially that a PL/SQL procedure cannot be called with invoker's rights from a trigger.
So, I am now wondering, is there another view that I could use in code called from a logon trigger to access the roles assigned to the enterprise user ? If not, is there a better way for me to approach this problem? From a maintenance standpoint, I like the idea of controlling site access from the LDAP directory service via role assignments. But, I am open to other ideas as well.
Thank you!