Using VPD in APEX

I need to use a VDP in APEX to restrict access to seeing some records. In other oracle apps I did with VPD, I did these steps:
1) Created a view (SP_TEACHER)
2) Created a function to dynamically set the predicte (where)
3) Created a policy
dbms_rls.add_policy(
object_schema => 'STARS3',
object_name => 'SP_TEACHER',
policy_name => 'SP_TEACHER_POLICY',
function_schema => 'STARS3',
policy_function => 'sp_teacher_predicate');
Is this the appropriate way to handle fine grained acess in APEX applications? I see there is a section in Shared Components - Security That has a VPD call sections

Hi Bob,
The VPD section in APEX is actually a different concept really, any code you place in the VPD section is executed for each page request.
I'm not trying to do a 'hard sell' here, but in my book (Pro Application Express) there is a whole section dedicated to data security (chapter 5) where I cover using the 'traditional VPD' functionality in the database with APEX.
John.
Blog: http://jes.blogs.shellprompt.net
Work: http://www.apex-evangelists.com
Author of Pro Application Express: http://tinyurl.com/3gu7cd
REWARDS: Please remember to mark helpful or correct posts on the forum, not just for my answers but for everyone!

Similar Messages

How to use vpd to restrict rows by application and schema_name?

We have a need to reuse a schema name many times in a test/dev. environment. Normally we just create a new instance so development can test their apps. using the same schema_name, let's call it test_user. This is very tedious and time consuming to create many db's and sometimes we don't have the hardware to support so many db's. So I was wondering if I could use vpd and an application_context to restrict the rows & columns that can be seen. But instead of restricting it by schema_name I want to restrict it by schema_name and another env. variable like app_name or something similar. So when the middle layer connects with test_user user name and the app is called accts_payable they see parts of the rows that pertain to them. But if the middle layer connects with the test_user user name and the app is called accts_payable2 they see completely different rows. Any help would be appreciated.
Thanks,
George

I was hoping someone else had already been down this path so I don't have to re-invent the wheel. But it looks like I'm going to go down that path. I did find something in the manual that may help but again it's not exactly what I was hoping for so I will have to test it. It mentions using dbms_session to set the application name in the environment like this:
Consider the application server, AppSvr, that has assigned the client identifier 12345 to client SCOTT. It then issues the following statement to indicate that, for this client identifier, there is an application context called RESPONSIBILITY with a value of 13 in the HR namespace.
DBMS_SESSION.SET_CONTEXT( 'HR', 'RESPONSIBILITY' , '13', 'SCOTT', '12345' );
Thanks for your help on this. If anyone else has been through a similar situation please reply.
Thanks,
George

Converting a delete statement using VPD policies and context

Hello,
I'm trying to convert a delete statement in a update statement using VPD policies and context.
+/* Supose the user 'user1' already exists. This is an application user */+
conn user1/pwd
create table user1.test_a (
id                number(4),
description       varchar2(100),
deleted           number(1)
+);+
alter table user1.test_a add constraint test_a_pk primary key (id);
insert into user1.test_a (1, 'abc', 0);
insert into user1.test_a (2, 'def', 0);
commit;
I'd like to convert each physical deletion into a logical deletion: statements like "delete from user1.test_a where id = 1" must be converted into "update user1.test_a set deleted = 1 where id = 1".
I've found the following way: I will create a policy to avoid physical deletion. Additionally, the policy function should update the deletion flag too.
conn user1/pwd
+/* Create context package */+
create or replace package user1.pkg_security_context is
procedure p_set_ctx(
i_test_a_id      in   user1.test_a.id   %type
+);+
end;
+/+
create or replace package body user1.pkg_security_context is
procedure p_set_ctx (
i_test_a_id      in   user1.test_a.id   %type
+) is+
begin
dbms_session.set_context( 'user1_ctx', 'test_a_id', i_test_a_id );
end;
end;
+/+
show errors
+/* Create trigger to set the context before deletion */+
create or replace trigger user1.test_a_bef_trg
before delete on user1.test_a
for each row
declare
pragma autonomous_transaction;
begin
-- only commits the preceding update, not the delete that fired the trigger.
commit;
user1.pkg_security_context.p_set_ctx( :old.id );
end;
+/+
show errors
create context user1_ctx using user1.pkg_security_context;
+/* Policy function */+
create or replace function user1.f_policy_chk_dels (
object_schema in   varchar2,
object_name   in   varchar2
+) return varchar2+
is
out_string                 varchar2(400)   default '1=2 ';
+/*+
* out_string is the return value.
* - 'WHERE 1=2' means 'nothing to access'
begin
if ( loc_logged_usr_authorized > 0 ) then
+/*+
* Set the flag deleted to 1
update user1.test_a set deleted = 1 where id = sys_context( 'user1_ctx', 'test_a_id' );
out_string := out_string || 'or 1=1 ';
end if;
return out_string;
end;
+/+
show errors
+/*+
* Create policy
begin
dbms_rls.add_policy(
object_schema   => 'user1'                   ,
object_name     => 'test_a'                  ,
policy_name     => 'policy_chk_dels'         ,
function_schema => 'user1'                   , -- function schema
policy_function => 'f_policy_chk_dels'       , -- policy function
statement_types => 'DELETE'
+);+
end;
+/+
When I try to delete a record of the table test_a:
conn user1/pwd
SQL> delete from ilogdia.oplsimulaciones sim       where sim.id = 9999;
+0 rows deleted+
No rows has been deleted, but the update stmt does not work. That means, the "deleted" flag has not been updated.
Any ideas?
Thank you in advance.
Marco A. Serrano
Edited by: albrotar on Oct 15, 2012 8:42 AM
Edited by: albrotar on Oct 15, 2012 8:42 AM
Edited by: albrotar on Oct 15, 2012 8:43 AM

The policy function is applied once per statement execution. The policy function executes first and the UPDATE statement, presumably, updates no rows because the context is not yet populated. The row-level populates the context (I'm assuming that your session can even see context values populated by an autonomous transaction-- I would guess it could but I'd have to test that) after the UPDATE statement is already complete. The COMMIT in the row-level trigger is also pointless-- it only applies to changes made by the current autonomous transaction, of which there are none-- it cannot apply to changes made in other autonomous transactions. Declaring the row-level trigger to use autonomous transactions doesn't seem to accomplish anything other than to open the question of whether the values set in the context by the autonomous transaction are visible in the caller's transaction.
Even if this, somehow, did work, using autonomous transactions would be a very bad idea since Oracle is free to roll-back a partially executed statement (and the work done by its triggers) and re-execute it. Oracle does that with some regularity to maintain write consistency.
Justin

Using arrays in apex

hi i want to know if some can guide me how to use array in apex.
i have a tabuler report with 4 columns.
i need to write a validation in the tabuler report for that i need to used array.
can I directly access the colums as i have shown below? or do i need to decleare this arrays some were in apex?
e.g
FOR i IN 1 .. ow_app.g_f01.COUNT
loop.........................
LOGIC
end loop;
from what i understand i can access each column as ow_app.g_f01,ow_app.g_f02,ow_app.g_f03,ow_app.g_f04 does this make sense?
thanks a lot.

Hi user591315 (please tell us your name - we're a friendly group!),
In answer to this and your previous related post, there is an excellent example of what you're looking to accomplish provided by Denes Kubicek available at http://apex.oracle.com/pls/otn/f?p=31517:41
Hope this helps,
John
If you find this information useful, please remember to mark the post "helpful" or "correct" so that others may benefit as well.

Using JQuery with Apex

Hello, I have a question for those of you who are using JQuery with Apex:
This is my HTML header:
<script type="text/javascript" src="&WORKSPACE_IMAGES.jsapi.js"></script>
<script type="text/javascript">
google.load("jquery", "1.3.2");
</script>
The problem is that JQuery still loads from Google and since the Company Intranet has the cookies blocked the privacy icon appars in IE. I am sure somebody will one day notice this and it's gonna be a "big" problem.
I suspect that something must be changed below to make the privacy icon dissapear,
if (!window['google']) {
window['google'] = {};
if (!window['google']['loader']) {
window['google']['loader'] = {};
google.loader.ServiceBase = 'http://www.google.com/uds';
google.loader.GoogleApisBase = 'http://ajax.googleapis.com/ajax';
google.loader.ApiKey = 'notsupplied';
google.loader.KeyVerified = true;
google.loader.LoadFailure = false;
google.loader.Secure = false;
google.loader.GoogleLocale = 'www.google.com';
Any ideas how to change this code and if this is going to work?
George

Hi,
If you do not like use jQuery from Google, discard your code
<script type="text/javascript" src="&WORKSPACE_IMAGES.jsapi.js"></script>
<script type="text/javascript">
google.load("jquery", "1.3.2");
</script>and use e.g. this guide to integrate jQuery to your Apex apps
http://www.oracleapplicationexpress.com/tutorials/66-integrating-jquery-into-apex
Br,Jari

Error executing a query using VPD and BC4J

Hi all,
Our team is developing an application using an Oracle DB 9.2.0.4 and BC4J 10g (9.0.5.16.0) as persistence layer.
We also are using the VPD (virtual private database) to have security in the database at row level.
The problem we are facing is that every some time (days) we get a jdbc error when a query (see below) that uses VPD policies is executed. Once the error occurs I execute it from sqlplus without getting any error .. it only occurs from our java application.
To temporary solve this problem, we delete and recreate the VPD policies, then the application continue working fine for some time ...
I'll appreciate any comment / suggestions
Thank in advance.
Eduardo.
ERROR LOG:
oracle.jbo.SQLStmtException: JBO-27122: SQL error during statement preparation. Statement: SELECT * FROM (SELECT CalLocation.ID,
CalLocation.CODE, eo
CalLocation.NAME,
CalLocation.ZIP,
CalLocation.PHONE,
CalLocation.FAX,
CalLocation.ADDRESS1,
CalLocation.ADDRESS2,
CalLocation.URL,
CalLocation.OWNER,
CalLocation.CTY_ID,
CalLocation.DESCRIPTION,
ORefCity.CODE CTY_CODE,
ORefCountry.ID CTR_ID,
ORefCountry.CODE CTR_CODE,
ORefRegion.ID REG_ID,
ORefRegion.CODE REG_CODE
FROM CAL_LOCATIONS CalLocation,
OREF_CITIES ORefCity,
OREF_COUNTRIES ORefCountry,
OREF_REGIONS ORefRegion
WHERE ORefCity.ID = CalLocation.CTY_ID
and ORefCountry.ID = ORefCity.CTR_ID
and ORefRegion.ID = ORefCountry.REG_ID) QRSLT WHERE ( ( (CTY_ID = 867) ) )
## Detail 0 ##
java.sql.SQLException: Io exception: Broken pipe
     at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:189)
     at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:231)
     at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:345)
     at oracle.jdbc.driver.OracleStatement.open(OracleStatement.java:717)
     at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:2605)
     at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate(OraclePreparedStatement.java:457)
     at oracle.jdbc.driver.OraclePreparedStatement.executeQuery(OraclePreparedStatement.java:387)

The symptoms we have been getting are quite similar to the bug 3662364 .
I'm going to implement the patch for that bug and see what happend then.
Thank you very much for your help.
Regards,
Eduardo.

PreparedStatement error using VPD

Hi all,
Our team is developing an application using an Oracle DB 9.2.0.4 and BC4J 10g (9.0.5.16.0) as persistence layer.
We also are using the VPD (virtual private database) to have security in the database at row level.
The problem we are facing is that every some time (days) we get a jdbc error when a query (see below) that uses VPD policies is executed. Once the error occurs I execute it from sqlplus without getting any error .. it only occurs from our java application.
To temporary solve this problem, we delete and recreate the VPD policies, then the application continue working fine for some time ...
I'll appreciate any comment / suggestions
Thank in advance.
Eduardo.
ERROR LOG:
oracle.jbo.SQLStmtException: JBO-27122: SQL error during statement preparation. Statement: SELECT * FROM (SELECT CalLocation.ID,
CalLocation.CODE, eo
CalLocation.NAME,
CalLocation.ZIP,
CalLocation.PHONE,
CalLocation.FAX,
CalLocation.ADDRESS1,
CalLocation.ADDRESS2,
CalLocation.URL,
CalLocation.OWNER,
CalLocation.CTY_ID,
CalLocation.DESCRIPTION,
ORefCity.CODE CTY_CODE,
ORefCountry.ID CTR_ID,
ORefCountry.CODE CTR_CODE,
ORefRegion.ID REG_ID,
ORefRegion.CODE REG_CODE
FROM CAL_LOCATIONS CalLocation,
OREF_CITIES ORefCity,
OREF_COUNTRIES ORefCountry,
OREF_REGIONS ORefRegion
WHERE ORefCity.ID = CalLocation.CTY_ID
and ORefCountry.ID = ORefCity.CTR_ID
and ORefRegion.ID = ORefCountry.REG_ID) QRSLT WHERE ( ( (CTY_ID = 867) ) )
## Detail 0 ##
java.sql.SQLException: Io exception: Broken pipe
     at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:189)
     at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:231)
     at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:345)
     at oracle.jdbc.driver.OracleStatement.open(OracleStatement.java:717)
     at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:2605)
     at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate(OraclePreparedStatement.java:457)
     at oracle.jdbc.driver.OraclePreparedStatement.executeQuery(OraclePreparedStatement.java:387)

It seems to be related to the bug 3662364 .
Regards,
Eduardo.

Using VPD and Portal

Situation: Trying to implement row level security using VPD for
applications created in PORTAL. using portal's
Light weight users.
Method: Created a fine grain access control policy to build a
predicate based on a Portal user (not database user).
1 Get Portal User (proc: portal30.wwctx_api.get_user)
2 Determine what business rules are setup for this
Portal User
3 Based on the above rules, build predicate for the
Portal User
Problem: In the first step, not retrieving the Portal user -
looks to be getting PUBLIC when the code is part of a
VPD policy. When it is executed on its own, it gets the correct
information back (ie. The portal user not PUBLIC).
The idea is that we want to be able to set the VPD policy based
on the light weight Portal User.
Oracle Database version 8.1.7
Oracle iAS 1.0.2.2.0
There is a work around for this, which is to create a database
schema for each portal user and then associate the
Portal account with this database schema. When we do this, we
get the correct information for use in the VPD policy,
But we actually look for the Proxy Account (database schema the
portal user is associated with) and not the portal
user/session info. This work around in not desirable when we
get a large number of portal users.
I've included the VPD package below where we try to extract the
Portal user acct using the
portal30.wwctx_api.get_user function
we also tried the
WPG_SESSION_PRIVATE.GET_LW_USER function with the same results
When this PLSQL is executed within a portlet, it seems to return
the correct information.
Code:
CREATE OR REPLACE PACKAGE
BODY "P_CORPORATE_SECURITY_CONTEXT" as
function f_company_security (p1 varchar2, p2 varchar2) return
varchar2 is
v_predicate VARCHAR2(4000);
CURSOR cur_company(p_portal_user_name IN
company_wwsec_person.WWSEC_PERSON_USER_NAME%TYPE) IS
SELECT decode(rownum,1,to_char(company_id),','||to_char
(company_id)) company_id
FROM company_wwsec_person
WHERE POLICY = '='
and upper(WWSEC_PERSON_USER_NAME) = upper
(p_portal_user_name);
l_portal_user_name varchar2(256);
l_oracle_user_name varchar2(30);
l_all_policy_cnt number;
l_equal_policy_cnt number;
BEGIN
l_portal_user_name := portal30.wwctx_api.get_user;
-- l_portal_user_name := USER; Commented out since we
want portal user not
database user.
select count(*)
into l_all_policy_cnt
from company_wwsec_person
where upper(WWSEC_PERSON_USER_NAME) = upper
(l_portal_user_name)
and policy = 'ALL';
select count(*)
into l_equal_policy_cnt
from company_wwsec_person
where upper(WWSEC_PERSON_USER_NAME) = upper
(l_portal_user_name)
and policy = '=';
IF l_all_policy_cnt = 0 and l_equal_policy_cnt > 0 THEN
v_predicate := ' company_id in (';
FOR l_company IN cur_company(l_portal_user_name)
LOOP
v_predicate := v_predicate || l_company.company_id;
END LOOP;
v_predicate := v_predicate || ')';
ELSIF l_all_policy_cnt = 0 and l_equal_policy_cnt = 0 THEN
v_predicate := ' 1=2';
ELSE
v_predicate := NULL;
END IF;
-- Uncomment to allow access to everything
-- v_predicate := ' 1=1';
RETURN v_predicate;
END;
END;

Situation: Trying to implement row level security using VPD for
applications created in PORTAL. using portal's
Light weight users.
Method: Created a fine grain access control policy to build a
predicate based on a Portal user (not database user).
1 Get Portal User (proc: portal30.wwctx_api.get_user)
2 Determine what business rules are setup for this
Portal User
3 Based on the above rules, build predicate for the
Portal User
Problem: In the first step, not retrieving the Portal user -
looks to be getting PUBLIC when the code is part of a
VPD policy. When it is executed on its own, it gets the correct
information back (ie. The portal user not PUBLIC).
The idea is that we want to be able to set the VPD policy based
on the light weight Portal User.
Oracle Database version 8.1.7
Oracle iAS 1.0.2.2.0
There is a work around for this, which is to create a database
schema for each portal user and then associate the
Portal account with this database schema. When we do this, we
get the correct information for use in the VPD policy,
But we actually look for the Proxy Account (database schema the
portal user is associated with) and not the portal
user/session info. This work around in not desirable when we
get a large number of portal users.
I've included the VPD package below where we try to extract the
Portal user acct using the
portal30.wwctx_api.get_user function
we also tried the
WPG_SESSION_PRIVATE.GET_LW_USER function with the same results
When this PLSQL is executed within a portlet, it seems to return
the correct information.
Code:
CREATE OR REPLACE PACKAGE
BODY "P_CORPORATE_SECURITY_CONTEXT" as
function f_company_security (p1 varchar2, p2 varchar2) return
varchar2 is
v_predicate VARCHAR2(4000);
CURSOR cur_company(p_portal_user_name IN
company_wwsec_person.WWSEC_PERSON_USER_NAME%TYPE) IS
SELECT decode(rownum,1,to_char(company_id),','||to_char
(company_id)) company_id
FROM company_wwsec_person
WHERE POLICY = '='
and upper(WWSEC_PERSON_USER_NAME) = upper
(p_portal_user_name);
l_portal_user_name varchar2(256);
l_oracle_user_name varchar2(30);
l_all_policy_cnt number;
l_equal_policy_cnt number;
BEGIN
l_portal_user_name := portal30.wwctx_api.get_user;
-- l_portal_user_name := USER; Commented out since we
want portal user not
database user.
select count(*)
into l_all_policy_cnt
from company_wwsec_person
where upper(WWSEC_PERSON_USER_NAME) = upper
(l_portal_user_name)
and policy = 'ALL';
select count(*)
into l_equal_policy_cnt
from company_wwsec_person
where upper(WWSEC_PERSON_USER_NAME) = upper
(l_portal_user_name)
and policy = '=';
IF l_all_policy_cnt = 0 and l_equal_policy_cnt > 0 THEN
v_predicate := ' company_id in (';
FOR l_company IN cur_company(l_portal_user_name)
LOOP
v_predicate := v_predicate || l_company.company_id;
END LOOP;
v_predicate := v_predicate || ')';
ELSIF l_all_policy_cnt = 0 and l_equal_policy_cnt = 0 THEN
v_predicate := ' 1=2';
ELSE
v_predicate := NULL;
END IF;
-- Uncomment to allow access to everything
-- v_predicate := ' 1=1';
RETURN v_predicate;
END;
END;

Using VPD (Virtual Private Database) with Discoverer for Dummies

Firstly could you please excuse me for the title of the thread, but it’s all I could come up with. For those of you who are looking at me with a strange look of disgust, please view thread that started it all: BIS vs DBI vs Noetix .
Otherwise I’m hoping to gain a greater understanding of how VPD can be used to enhance Discoverer and it’s performance. I've just read that :
“Oracle 8i introduced the notion of a Virtual Private Database (VPD). A VPD offers Fine-Grained Access Control (FGAC) for secure separation of data. This ensures that users only have access to data that pertains to them. Using this option, one could even store multiple companies' data within the same schema, without them knowing about it.
VPD configuration is done via the DBMS_RLS (Row Level Security) package. Select from SYS.V$VPD_POLICY to see existing VPD configuration.”
With Regards to Discoverer, I would like to ask the following:
-When would be best to use VPD in Discoverer?
-Pro’s and Con’s of VPD?
-Tips / Tricks?
-and anything else Michael would like to add (I don’t believe there is a post limit, although this could change in the future)
I've found a few handy links:
http://www.adp-gmbh.ch/ora/security/vpd/index.html
http://www.oracle.com/technology/oramag/oracle/04-mar/o24tech_security.html
As Metalink support would say : I Looking forward to your ‘Positive’ comments. ;-)
Lance

Lance,
You sure do raise some interesting questions here.
I've noticed from some of your previous posts that you are using views to link Discoverer through to apps. I have found this very interesting document that may help with your queries; http://www.oracle.com/technology/deploy/security/oracle9ir2/pdf/VPD9ir2twp.pdf
If you scroll down to the section "Additional VPD Capabilities" and read the following sub-topics, this might enable you to base your Discoverer reports on views that contain VPD policies.
I trust "My Positive Comment" may help!!
Merry Christmas
Si ;-)
P.s This also may come in handy if running 10g http://www.stanford.edu/dept/itss/docs/oracle/10g/network.101/b10773/apdvpoli.htm
Message was edited by:
Simon Pittaway

Can and How to Use JQuary In APex 3.2

Hi,
Can we use JQuary in Apex 3.2 .If please send me any link or demo application with code.
I am New With JQUARY .i don't have any idea about JQuary .
How to use it in Apex 3.2.
I am working on Apex 3.2
Thanks

Hi,
JQuery sample is in htmldbQuery_sample.zip.
File apex_developer_tool_bar.user.js is Greasemonkey script.
Go to Greasemonkey site and check document how import user scripts.
http://userscripts.org/about/installing
Read about htmltooltip.js from
http://dbswh.webhop.net/apex/f?p=BLOG:READ:0::::ARTICLE:3000
Read about other files
http://dbswh.webhop.net/apex/f?p=BLOG:READCAT:0::::CATEGORY:11100346066619
Regards,
Jari
Edited by: jarola on Dec 7, 2010 9:40 AM

Can i use css3 in apex 4.

I am new to apex .. I myself dont know css well .. But trying to know..
Can I use css3 in apex 4...database 11g xe

941005 wrote:
I am new to apex ..Welcome to the forum: please read the FAQ and forum sticky threads (if you haven't done so already), and ensure you have updated with your profile with a real handle instead of "941005".
You'll get a faster, more effective response to your questions by including as much relevant information as possible upfront. This should include:
<li>APEX version
<li>DB version and edition
<li>Web server architecture (EPG, OHS or APEX listener)
<li>Browser(s) used
<li>Theme
<li>Templates
<li>Region type
I myself dont know css well .. But trying to know..
Can I use css3 in apex 4...database 11g xeIn APEX all presentational aspects of an application (including font size) are controlled using a combination of (X)HTML and CSS via themes and templates. You need to have an understanding of these web technologies to make best use of APEX. If you're not familiar with them you're advised to get at least a basic understanding by spending some time on the tutorials here: start with HTML, then XHTML, CSS, Javascript and the HTML DOM.
CSS3 features can certainly be used in your APEX themes and applications. Any problems are not likely to arise there, but in whether these features are supported by the browsers/versions used when running them. These sites may be useful in determining whether it's worthwhile for you to use CSS3 to implement a particular feature:
http://www.impressivewebs.com/css3-browser-support/
http://caniuse.com/
Using progressive enhancement techniques will allow you to introduce CSS3 features for browsers that do support them while still making applications accessible in those that don't.

Publish a plsql code as webservice without using JDEVELOPER or APEX

Hi All,
I am looking into how can we publish a PLSQL code as web-service without using JDEV OR APEX.
When I google for this one I can see only by using JDEV or APEX we can publish Code as a web-service.
Is there any way in oracle, just by using simple PLSQL packages we can publish code as a webservice.
Appreciate your response.
Thanks,
MK.

Apex does not publish PL/SQL code as web services. It is a web run-time and development framework. Something totally different.
To turn a PL/SQL function into a web service is simple. You use the orawsv servlet in XDB - without making a single code change to the function. It will not even know it is called as a web service.
To use orawsv, two basic steps. Configure and enable the servlet (raw HTTP/HTTPS connections will be handled by the Listener). This also entails enabling shared server in the database, if not already enabled. The 2nd step is to allow the function to be executed (via a HTTP call) as a web service, via granting specific roles.
orawsv handles the HTTP call. It provides the WSDL. It parses SOAP envelopes as input. It makes the call (as a standard PL/SQL call), to the function being used as a web service. It returns the results of the PL/SQL function call, as a SOAP envelope output.
See Support Notes:
How to Setup Native Oracle XML DB Web Services [Article ID 444191.1]
Sample Framework for testing Native Oracle XML DB Web Services [Article ID 803794.1]
How to Browse Native Oracle XML DB Web Services Example [Article ID 1324235.1]

Using VPD for Column Masking

Hi ,
Arup nanda demostrate [http://www.oracle.com/technology/pub/articles/10gdba/week14_10gdba.html]
how to use Column Masking using VPD.
I would like to use TDE+VPD for PCI DSS requirements.
In order to protect the data from been stolen i am going to use TDE.
Regarding the VPD , i need to allow few user to see the entire credir card number , and for some user to see just
the last 4 digits of the credit card.
As far as i understood from the link above , all i can do is to mask column valus to null value.
I thought using dbms_crypto , but Tom Kyte suggested hir
[http://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:1631574900346651898]
not to do it.
My question is if it somehow possible to see just the last 4 digit using VPD.
Thanks

No you can't, Column level VPD is not ment to give a masking solution, I have filled a request to oracle to enhance VPD to support this feature, I didn't get any answer for it.
You will have to find a nother way, VPD is not it.
I suggest you to add another column to your tables that holds the credit card number, the new column will hold the masked value of the credit card - write PL/SQL function to do it, and update the table, then use simple views to control what data each user will see.
Oded
[www.dbsnaps.com]
[www.orbiumsoftware.com]

Using wwv_flow_load_excel_data and apex collections

Hi!
I have a question regarding very popular subject: parsing csv files.
I made one application, which takes csv file, parses it using Vicas's code, presents validation report to the user, and finally allows to submit data into the datatable.
Everything works fine, but I don't like this solution. CSV can cause problems when quotation mark is used inside, when numbers have 1000 separators and so on.
Besides that, I have to add some code to validate column types. Lot of mess.
The solution incorporated into apex tool, called "Data Load/Unload" looks much better. It would be nice to use that inside apex application adding some business validations, and hardcoding table and columns names.
I have seen wwv_flow_load_excel_data package and I'm wondering if it is possible to use load_excel_data procedure to perform that task?
Is there any documentation to that package?
Somebody heard about using that with apex collections (to avoid a need of temporary table)?
Regards,
Arek

And if somebody else is looking for "ApEx" forum:
Oracle Application Express (APEX)

Can I use PERL in APEX

Hi All
can i use PERL language in APEX? is it gud practice to use PERL in APEX?
Thanxs

You can use PERL, in so much that you can forward on the user to a PERL application and have that PERL application take in the session + cookie and check it for validity in Oracle, but as far as interactivity between PERL and APEX, it would be either on the level of Web Services style access (one calling the other through web services type Http calls) or possibly running PERL code at system level with something like dbms_scheduler, were it to be for a background database task of some sort.
My question would be what exactly do you need to do in PERL w/ APEX?
-Richard

Using VPD in APEX

Similar Messages

Maybe you are looking for