Table security concerns with form on intranet

Question

We are trying to maintain database security for forms that run
on the intranet. The first line of security is to require all
users to logon to the application. The main concern is the
database user being asscessed without the application. Here are
the current ideas:
The easiest solution would be to hide the user/password
information on the html that launches the form, however (to my
knowledge) this is not possible.
I moved the table containing application users passwords to a
second user (db user) and am using a function to validate logon
information. This works great, the problem is where to put the
actual data tables user by the application. If they are in the
first user which the form logs into by default then a "curious"
person may access the tables via a sql session using the
user/password from the html. The best thing I can come up with
is to put the data tables in the second user containing the
logon password table, however if the grants exist for the user
that the form defaults to we have the same problem.
Dynamic grants would be perfect however you can not create
grants with the logon function.
Any input would be greatly appreciated.
-Doug
null

Answer 1

You can mantain this table in a separate user (administrative
user) and create a function under this user to validate
user and password. Grant privilege for the users to execute
this function, but not to select the table. In this way, any
user can execute this function but cannot query the table.
The only one allowed to query and update this table is the
owner. Based on Oracle concepts, if the user has rights to
execute a function or procedure, he automatically has implicit
rights to the objects being accessed by this function or
procedure. But to access these implicit objects directly,
he must have specific rights. I hope this can help you.
null