VPD: Column Level Masking - Error: ORA-28104: input value for sec_relevant_cols is not valid

Question

Hi Gurus,
I am trying to mask the secured column from the table for one specified user, Here is the detail of DB and code which I am using to apply the security:
DB Version: Oracle Database 11g Enterprise Edition Release 11.1.0.7.0
Security Function:
create or replace function kr_sec_function_papf(p_object_schema IN VARCHAR2,
p_object_name VARCHAR2)
return varchar2
as
p_nid varchar2(200);
whoami varchar2(100);
begin
if SYS_CONTEXT('USERENV', 'SESSION_USER') = 'VPDTEST'
then
p_nid := 'national_identifier = national_identifier';
return (p_nid);
else
p_nid := '1=2';
return (p_nid);
end if;
end kr_sec_function_papf;
Code to Add Policy:
BEGIN
DBMS_RLS.ADD_POLICY(
object_schema => 'APPS',
object_name => 'PER_ALL_PEOPLE_F',
policy_name => 'secure_emp',
policy_function => 'kr_sec_function_papf',
statement_types => 'SELECT',
sec_relevant_cols=>'NATIONAL_IDENTIFIER',
sec_relevant_cols_opt=>DBMS_RLS.ALL_ROWS);
END;
I am getting error while executing the above plsql block, Error is:
ORA-28104: input value for sec_relevant_cols is not valid
ORA-06512: at "SYS.DBMS_RLS", line 20
ORA-06512: at line 2
Any one please help me to resolve the issue.
Thanks in Advance.
~Krishna Nand Singh

Answer 1

Hi Every one,
I got this issue resolved.
The issue is with parameter object_schema => 'APPS' , the object schema name is 'HR' and APPS has synonym with the same name.
The Correct code should be:
BEGIN
DBMS_RLS.ADD_POLICY(
object_schema => 'HR',
object_name => 'PER_ALL_PEOPLE_F',
policy_name => 'secure_emp',
policy_function => 'kr_sec_function_papf',
statement_types => 'SELECT',
sec_relevant_cols=>'NATIONAL_IDENTIFIER',
sec_relevant_cols_opt=>DBMS_RLS.ALL_ROWS);
END;
Thanks,
Krishna Nand Singh