VPD: Problems calling a function on another schema

Question

Here's the setup:
I've create a schema called "AllYourBase".  It contains all of my tables, views, functions, procs, etc.
These tables are protected by a DBMS_RLS policy.  The policy uses a function to define its predicate which looks like this:
create or replace function tous_filter(schemaName varchar2, tableName varchar2)
return varchar2 is
begin
return  'account = sys_context(''USERENV'', ''CLIENT_IDENTIFIER'')';
end;
All of the tables have an account column for this to work.  So far, this is a pretty basic VPD setup.
I have other db users that login and view data in the "AllYourBase" schema.
So when "ArbyLong" logs in, I set sys_context('USERENV', 'CLIENT_IDENTIFIER') to "ArbyLong", and when he runs a query, he gets back his rows.
Now, "AllYourBase" has several functions.  Here's a very contrived, simplified example of one (but it illustrates the issue I'm running into just fine):
create or replace function getUserID
return integer is retval integer;
begin
select user_id into retval from users;
return (retval);
end;
When "ArbyLong" runs the equivalent query (select user_id from users), he gets back the one row where the account column is equal to "ArbyLong", as expected.
But this getUserID function lives in the "AllYourBase" schema.  And here's the catch: I've made "AllYourBase" exempt from the policies by running "grant exempt access policy to AllYourBase".
When "ArbyLong" runs the function getUserID, it runs in the "AllYourBase" schema and pulls ALL of the rows from the users table.
This particular function simply errors out (since it's only expecting one row), but other functions are returning data that the logged in user shouldn't see.
So even though there are policies in place, by calling a function on another schema who is exempt from the policies, a user is able to see all returned data and not just the rows they are normally limited to.
Ultimately my question is this: Is there a way to enforce VPD policies when a user calls a function that lives in another schema?
Doing my own research, the answers I've come up with are:
* Don't use "grant exempt policy"!
* Put the function directly into the users' schemas.  So "ArbyLong" would have his own getUserID function that would look at the "AllYourBase" users table.
I'd rather not do either of these, so does anyone have any other ideas?  If it turns out these are the only solutions, then I'll go with one of them.
Thanks!

Answer 1

Need more info. Are you using a ViewStack or other navigator container, and trying to access a view that has not been displayed yet, due to deferred instantiation?
If this post answers your question or helps, please mark it as such.
Greg Lafrance - Flex 2 and 3 ACE certified
www.ChikaraDev.com
Flex Training and Support Services