SSO - Discoverer and VPD

Question

Hi,
I have row-level-security implemented in the database and the policy applied to few tables in a schema. When I query this table logging into the db using Toad/sqlplus as different users I see the security policy applied and the right rows of data returned. This is good...
However, from discoverer... here's what we have. We have SSO enabled for discoverer. Created a public connection for user with "exempt policy". In other words the user doesn't have the policy applied and hence gets all the rows from the tables above said tables. The workbook is shared with users who should see different data. I have used CLIENT_IDENTIFIER and have a database logon trigger set to the client_id. For some reason only from discoverer I get a policy predicate user when logging in as the same user that's fine from toad/sqlplus. I have registered functions in the EUL. However, should I have eul_trigger$post_login in discoverer or the database trigger should do?
We are expecting this:
A workbook created with a public connection user (with exempot policy) shares with regular users. The regular users see what they need to see based on vpd policy. Also we want to implement the dashboard for these workbooks and we have SSO on portal as well.
I am not sure what am missing... If someone can help me with this, that's highly appreciated.
Thanks in advance,
-Esther

Answer 1

Hi Rod,
Firstly, I am not sure why you have exempt policy for your public connection user.
You can create a policy that uses the CLIENT_IDENTIFIER when the Discoverer user connects with the public user and uses the database user when a connection is made by other users.
Got rid of the exempt policy after your message... "policy that uses the CLIENT_IDENTIFIER when the Discoverer user connects with the public user ".. Would be great if you can pl elaborate on this point. Policy function that I have is pasted to the bottom of this message... I have a feeling this is what am missing... your help is highly appreciated!Alternatively, you could use a database trigger on your public connection user (or an eul_trigger$post_login) to check the CLIENT_IDENTIFIER and set a context to define the row-level-security to be implemented. Then you can use this context in your workbook conditions.
For now I'd prefer to take the policy route and not the trigger. If it works with policy that'd be great.Thanks a lot for your help!
-Esther
Policy code:
CREATE OR REPLACE PACKAGE BODY tgt_grp_role AS
FUNCTION get_tgt_grp_role (
p_schema IN VARCHAR2
,p_table IN VARCHAR2 )
RETURN VARCHAR2 AS
l_retstr VARCHAR2 ( 2000 );
l_user VARCHAR2 ( 120 );
BEGIN
/*If the user logged in is KPI or DISCOEUL_TRANSACTIONAL or DISCOEUL_HYBRID (i.e.EUL Owners)
          or public connection user, give access to all the KPI groups and all data. */
IF p_schema = USER
OR USER IN
( 'DISCOEUL_TRANSACTIONAL'
,'DISCOEUL_HYBRID'
,'KPI_DASHBOARD_USER' ) THEN
l_retstr := NULL;
ELSE
/* For any other KPI user pick up all the target groups the user belongs to
and return the string to the policy function i.e.GET_TGT_GRP_ROLE */
l_user :=
SYS_CONTEXT ( 'userenv', 'client_identifier' );
FOR group_rec IN ( SELECT target_group_role
FROM d_kpi_users
WHERE nt_user_id = l_user) LOOP
l_retstr :=
l_retstr || ',''' || group_rec.target_group_role || '''';
END LOOP;
l_retstr := LTRIM ( l_retstr, ',' );
l_retstr :=
'TARGET_GROUP_ROLE IN (' || l_retstr || ')';
END IF;
RETURN l_retstr;
EXCEPTION
WHEN OTHERS THEN
RETURN '1=0';
END;
END;