Design Guide

10.5 HotFix 2
- 10.5 HotFix 1
- 10.5
- 10.2 HotFix 1
- 10.2
- 10.1
- 10.0 HotFix 1
- 10.0

Back Next

Virtual Private Databases (VPD)

Virtual Private Databases (VPD) is an Oracle specific feature available as a standard part of Enterprise Edition. VPD provides fine-grained access control that is data-driven, context-dependent and rowbased.

A security administrator defines database

contexts

for individual users or groups of users. These contexts are used to limit the data that a user can see when they execute SQL statements.

Contexts are usually set (enabled) using a login trigger so that a user has no control over the context they use. Once enabled, the context name is used by Oracle to find predefined rules that are used to dynamically modify SQL statements executed by the user.

The security administrator defines contexts and their associated rules. For example, user U1 logs on, a login trigger fires to set a context C1. When the user executes the following SQL:

SELECT * FROM EMP

Oracle adds

WHERE DEPT = 10

to the query so that user U1 can only see rows from his/her own department. Another user U2 using context C2 might have the predicate

WHERE DEPT = 20

added to their otherwise identical SQL. In this way, each user only sees data that is relevant to them.

IIR Implementation

The SSA userid is used to extract source data from the UST and create an IDT and IDXs. In order to see all rows in the UST, the SSA userid must be exempted from VPD based restrictions. This is done with the following SQL:

GRANT EXEMPT ACCESS POLICY TO SSA;

Once all the data is loaded into the IDT and IDXs, ordinary database access controls secure this data, since it is private to the SSA user. A dictionary-alias is normally used to hide the SSA userid and password from search clients.

IIR provides access to the IDT/IDX data through the Search Server. To guard against unauthorized access the System administrator defines the System-Definition option

VPD-Secure

and/or defines the environment variable SSASECUREENV .

When either is defined, IIR insists that each user provide a context using

ids_set_vpd_user

API prior to starting a search. In response to a search request, the Search Server will build a result set and for each record in that set, issue SQL queries using the user’s context to screen out any record that the user is not permitted to see.

Environment Variables

A VPD System requires an additional environment variable to be defined. SSASECURECONNECT specifies a database connection string for a "proxy user" that will be used to screen records from the result set.

The connection string is a normal IIR connection string such as

odb:99:ssaproxy/ssaproxy@oracle920

or may be the special keyword

SSAUSER

, in which case IIR uses the current Rulebase connection string to create a proxy user connection to the UST database.

Proxy User Context

IIR establishes a context for the proxy user by calling a PL/SQL package provided by the security administrator.

Each search user must call the API function

ids_set_vpd_user

to nominate the name of the package and the parameter to be passed to it.

Restrictions

IDTs may not be created by merging (

merged_from

clause)

IDTs may not be flattened.

LOGTEST

tracing is disabled in a VPD environment.

The only IIR Search Client that supports VPD is

relate

. Use the

-V

switch to specify the name of the context setting package and its parameter.

Miscellaneous Issues

Download Guide

Watch

Comments

Communities

Knowledge Base

Success Portal

0 COMMENTS

We’d like to hear from you! Log in to comment.

Rename Saved Search

Table of Contents

Design Guide

Design Guide

Virtual Private Databases (VPD)

Virtual Private Databases (VPD)

IIR Implementation

Environment Variables

Proxy User Context

Restrictions