When will APEX be capable of observing Database Roles?

Question

Hi All,
When will APEX be capable of observing Database Roles and RLS?
Joel Kallman in his APEX blogspot article " [Application Express and parsing SQL|http://joelkallman.blogspot.com/]" states that
+"the execution of SQL in an Application Express application still does not observe roles when parsing user SQL. This remains true for the recently released Application Express 4.0"+
Is there anyone with inside knowledge of APEX who can shed light on this?
Amgine

Answer 1

Hi All,
Thank you for responding to this discussion.
The initial point of my post was to indicate that applying fine grained data security with APEX, is problematic. In my organisation we have hundreds of databases, thousands of tables and a requirement to protect confidential data. The DBA's and Developers over the years have developed a system of controlled data access based on database roles, Row Level Security with policies, and even Cell Level Security.
We are looking at APEX as a means of replacing Oracle Forms and Reports. The method by which CRUD applications are made with
APEX methodology, involves assigning schemas to a workspace. Doing this circumvents all of the above-mentioned security, because APEX developers, then take on the effective role of schema owner.
If an application is created using the schema, assigned to a workspace, it requires the APEX application developer to develop a parallel authentication/authorization scheme, to match the levels of control normally achieved by the database data security methods.
e.g.. I can easily create a form with select, insert, update capability, based on a table normally having restricted record access and even select only access, controlled by roles or RLS methods. If do not explicitly create a complex Authentication/Authorization system to protect the data, I could easily, and accidently, expose restricted or confidential data, and the unintended ability to modify it, to the end user.
I have found by experiment that there is a partial solution to this problem:
If schema's are not directly assigned to the workspace but instead, a single parsing schema with minimal system privileges is created, and no other schema is assigned to the workspace. The privileges on individual schema objects are then granted to the parsing schema. Applications can then be built which limit the CRUD operations which may be implemented.
With my current APEX /Oracle DB There is still the problem that privileges (e.g. insert, update select on table X) cannot be granted to the parsing schema via a role but need to be explicitly granted. This becomes a maintenance nightmare for the schema owner or DBA, normally avoided by use of roles and/or RLS.
In answer to Andre. I a currently use APEX ver. 3.1.2.00.0 and Oracle 10.2.0.
According the APEX Builder notes:
In Oracle Database Server versions before 10.2.0.3, these privileges must be granted directly to the schema. In Oracle Database Server versions 10.2.0.3 and later, these privileges may be granted to the schema directly or through a role in order for the SQL Workshop to be able to perform the operation using the selected schema.
The reason you can't use roles is because you are always identified in session as APEX_PUBLIC_USER with privileges granted by proxy via the parsing schema, never as the logged on user.
Using the following query logged on as sys:
select
username,
osuser,
program
from v$session
where type='USER'
gives results:
USERNAME    OS_USER    PROGRAM
APEX_PUBLIC_USER SYSTEM Apache.exe
Amgine