Using beforeTrigger to implement VPD security model - any suggestions?

Question

Hi,
I'm investigating using the beforeTrigger in a data set to implement VPD security. The idea is that a parameter containing the username would be passed to the beforeTrigger pl/sql function to set the user context for that database session. I got this to work in a small prototype, but ran into a couple of what seem to be significant restrictions.
1) The pl/sql package I name in the dataTemplate defaultPackage must contain a global variable for each report parameter. In my case I'm passing the username to the pl/sql method as an bind variable argument, so I don't need/want any global variables. This is a major problem as we will have lots of reports all with different parameters. I want to bind the parameters using the :PARAM bind variable in the queries themselves.
Is there a way to avoid having to make each parameter a global variable?
2) We will need the ability to call various pl/sql packages in different reports. The following ER makes it sound as if this is not possible - but I haven't actually tested it out:
Bug# 6472921 - ALLOW FUNCTION CALL OUTSIDE OF DEFAULT PACKAGE IN DATA TEMPLATE
Is it required that all of the pl/sql calls for a data set be within the same pl/sql package?
I've included my dataTemplate below for reference.
If anyone has experience establishing VPD security for a data set using this technique or another, I'm interested in hearing what you recommend.
Thanks,
Leslie
<dataTemplate name="TARGET_DATA_TEMPLATE" defaultPackage="MGMT_IP">
<properties>
<property name="debug_mode" value="on"/>
</properties>
<parameters>
<parameter name="EMUSER" dataType="character" defaultValue="THREE"/>
</parameters>
<dataTrigger name="beforeReport" source="MGMT_IP.IPSETUSERCONTEXT(:EMUSER)"/>
<dataQuery>
<sqlStatement name="Q1">select TARGET_TYPE as TARGET_TYPE, TARGET_NAME
as TARGET_NAME from mgmt$target order by TARGET_TYPE</sqlStatement>
</dataQuery>
<dataStructure>
<group name="G1" source="Q1">
<element name="TTTYPE" value="TARGET_TYPE"/>
<element name="TNAME" value="TARGET_NAME"/>
</group>
</dataStructure>
</dataTemplate>

Answer 1

Hi Leslie,
Step 1.
Setup the VPD policy in database,
Create some proxy users, and create data sources and try querying, by login in with the different users.
You should be able to get the different results based on user logged in.
Step 2:
Package in data template.
for each report, you need to create separate package.
And the parameters in the report should be declared as Global variables in the report.
And once the trigger calls the package, then i guess, package has control to call other packages inside the database.
You can write all the function in the default package.
Is it required that all of the pl/sql calls for a data set be within the same pl/sql package?
I guess, yes as of now. if you need anything outside this default, you can call them in the default package like a wrapper may be.
This is what i can think right now.
Will try my luck on this and let you know :) in details.