Oracle VPD and multiple users

Hi all

I'm currently implementing VPD on our database, but I found a problem that I don't understand.

We have 4 users on the same database

-sysadmin_vpd (admin vpd packages)

-owner_usr (owner of the schema)

-org_1 and org_2 (access owner_usr tables using synonyms)

All tables have been created on the owner_usr schema has the same column (nrorg) I want to use to filter the data automatically with the user who is logged on the database (org_1 or org_2)

That's what I did:

sysadmin_vpd/password login

CONTEXT to CREATE or REPLACE nrorg_ctx USING nrorg_ctx_pkg;

CREATE OR REPLACE PACKAGE nrorg_ctx_pkg

PROCEDURE set_nrorg (number NRORG);

END;

CREATE OR REPLACE PACKAGE BODY nrorg_ctx_pkg

PROCEDURE set_nrorg (number NRORG)

AS

BEGIN

DBMS_SESSION. SET_CONTEXT ('nrorg_ctx', 'nrorg', NRORG);

END set_nrorg;

END;

CREATE OR REPLACE TRIGGER set_nrorg_trg

AFTER LOGON ON DATABASE

BEGIN

IF SUBSTR(USER,1,4) = "ORG_" THEN

sysadmin_vpd.nrorg_ctx_pkg.set_nrorg (TO_NUMBER (substr (User, 5, 10)));

END IF;

END;

Here, I can test the trigger and the context variable:

owner_usr/password login

SELECT SYS_CONTEXT ('nrorg_ctx', 'nrorg') AS NRORG FROM DUAL;

NRORG

------------------------------------------------


org_1/password login

SELECT SYS_CONTEXT ('nrorg_ctx', 'nrorg') AS NRORG FROM DUAL;

NRORG

------------------------------------------------

1


org_2/password login

SELECT SYS_CONTEXT ('nrorg_ctx', 'nrorg') AS NRORG FROM DUAL;

NRORG

------------------------------------------------

2


Back to the sysadmin_vpd user, I created the function to return the predicate.


(Get_nrorg_pred) CREATE or REPLACE FUNCTION

schema_p IN VARCHAR2,

table_p IN VARCHAR2)

RETURN VARCHAR2

AS

nrorg_pred VARCHAR2 (400) value default NULL;

BEGIN

IF SUBSTR(USER,1,4) = "ORG_" THEN

nrorg_pred: = ' NRORG = ("nrorg_ctx", "nrorg") SYS_CONTEXT';

END IF;

RETURN nrorg_pred;

END;


owner_usr/password login

SELECT FROM DUAL PRED sysadmin_vpd.get_nrorg_pred (NULL, NULL);

PRED

--------------------------------------------------


org_1/password login

SELECT FROM DUAL PRED sysadmin_vpd.get_nrorg_pred (NULL, NULL);

PRED

--------------------------------------------------

NRORG = SYS_CONTEXT ('nrorg_ctx', 'nrorg')

org_2/password login

SELECT FROM DUAL PRED sysadmin_vpd.get_nrorg_pred (NULL, NULL);

PRED

--------------------------------------------------

NRORG = SYS_CONTEXT ('nrorg_ctx', 'nrorg')

If I connect to the database using owner_usr the function returns an empty predicate. Connect using org_1 or org_2 returns the predicate to filter select it as expected.


Back to the sysadmin_vpd user, I created the policy


BEGIN

DBMS_RLS. () ADD_POLICY

object_schema = > 'OWNER_USR ',.

object_name = > "TABLE1."

POLICY_NAME = > "NRORG_POLICY"

function_schema = > 'SYSADMIN_VPD ',.

policy_function = > 'GET_NRORG_PRED ',.

statement_types = > ' select, insert, update, delete.

policy_type = > DBMS_RLS. SHARED_CONTEXT_SENSITIVE);

END;


owner_usr/password login

SELECT DISTINCT FROM TABLE1 NRORG;

NRORG

-----------------

1

2


connect org_1 and password

SELECT DISTINCT NRORG FROM owner_usr. TABLE1;

NRORG

-----------------

1

2


connect org_2 and password

SELECT DISTINCT NRORG FROM owner_usr. TABLE1;

NRORG

-----------------

1

2


As you can see, if I connect to the database using the owner of that selection is not filtered like I wanted. But if I connect using org_1 or org_2 all data are displayed... Why?


I also tried to create synonyms and creating policy for the synonym... No chance!


connect org_1 and password

CREATE A SYNONYM FOR OWNER_USR TABLE1. TABLE1;


SELECT DISTINCT FROM TABLE1 NRORG;

NRORG

-----------------

1

2


BEGIN

DBMS_RLS. () ADD_POLICY

object_schema = > 'ORG_1 ',.

object_name = > "TABLE1."

POLICY_NAME = > "NRORG_POLICY"

function_schema = > 'SYSADMIN_VPD ',.

policy_function = > 'GET_NRORG_PRED') ;

END;


SELECT DISTINCT FROM TABLE1 NRORG;

NRORG

-----------------

1

2


What I am doing wrong? Can someone help me?


Thank you!

I just understand... The problem was in the users org_1 and org_2.

My coleague created users of theses and gave them grants more than it should... I have everything, revoked granted only SELECT and RESOURCES and this is...

I don't know what was the grant that substitute policy... Anyone know?

Thanks anyway...

Tags: Database

Similar Questions

  • Homegroup and multiple user account problems

    I have been searching the net for information and can't find anything that matches.  I'm having all kinds of problems through the homegroup and multiple user accounts.

    I would like to know: when a machine (laptop in this case) is off the network, the individual user accounts will remain visible under homegroup?

    If they are not, then homegroup is not for me.

    UPDATE and closing:

    I confirmed that the individual accounts of the user on a machine that visible to another when this computer is connected to another group residential computer on a local network domestic.  Why they don't look just like a homegroup internally I don't get except that the machine would always be part of a group residential e.g. a laptop, as in my case, would be carrying a homegroup with it and not be able to jump on another residential group in a different location.

    What was causing me a lot of trouble has AVG Free.  Attention, the installation of AVG Free homegroup PCs cannot meet or is inconsistent at best.  My laptop would show the user accounts, but not the other homegroup PCs and both could indicate that there is no other available HG machine or sometimes invites you to create a homegroup.  It was a nightnare.

  • Fusion and multiple users

    Hello

    I hope someone can answer a few questions for me.

    I just installed Fusion 3 on an iMac with 4 users in my household. For one reason or another, we all need access to WinXP. I have admin rights and everyone has rights of the user.

    I installed the merger under my admin account, but when I change user and launch the merger, he seems to want to install XP.

    My questions are:

    (1) merger not allows to access XP from several user accounts? Not even a single user at a time?

    (2) otherwise, since it is the woman who has the most need for XP, is possible to move the virtual machine to its account, or do I have to perform another installation of XP?

    (3) if I need to perform another installation, it ruin things if I have XP/Fusion installed on my account and create another facility for her?

    Thank you

    This error message is related to the function of VMware shared folders (VMware Fusion (menu bar) > VM > settings... > sharing (under control panel)) and is apparently pointing to a file that other users have no access to or is they if, lets say, pointing to your desktop folder.  In other words if the shared folder of VMware will be used, then you must point to a location that all applications have access to.  Also note that the "Mirrored folders" feature should not be used when multiple users need to access/use the same Virtual Machine.

    Probably the best solution for the use of VMware shared folders with multiple users is to not use this feature and instead use native file Mac sharing in order to achieve this.  Unfortunately if you do not use the VMware Shared Folders functionality you can also not use the settings > Applications > default Applications features either.  The workaround for this is to use a share point common that all users have access to and then use native file sharing on the Mac to allow each user access to files in their home and the common share folder point that all users have access to the shared folder of VMware feature to use the settings under settings > Applications > default Applications

    Unfortunately, that's when the permissions are involved and we certainly won't give all permissions for everyone to (even if desired).

  • DBMS_FGA.add_policy... How to handle multiple tables and multiple users

    Dear all,

    My database is 11 GR 1 material and Linux is the platform.

    I have over 50 very important tables and about 15 users database.

    I want to implement an audit fine-grained on these important tables.

    This is how I will implement:

    SQL > START
    () DBMS_FGA.add_policy
    object_schema = > 'Scott ',.
    object_name = > "SAL."
    POLICY_NAME = > "SALARY_CHK_AUDIT"
    audit_condition = > NULL,
    handler_schema = > 'imran.
    statement_types = > 'SELECT, INSERT, UPDATE, DELETE.
    audit_column = > NULL);
    END;
    /

    What is I have several tables of several users and object_schema in handler_schema.

    I hope I'm able to clear my question, doubts please let me know.

    Best regards, Imran

    Hello

    object_schema - the schema of the object to be audited. (If the value is NULL, the schema of the current user is supposed).
    in case if you want to audit for multiple users - then make a test taking a value null and test access important tables - where relevant audit records are generated according to your requirement or not. I have not tested... try it

    -Pavan Kumar N

  • Oracle VPD and truncate table command

    I can still use the truncate table SQL command when you are connected to an Oracle VPD. I wonder how Oracle related where clause for a truncate table command.

    Thanks in advance,
    Alexandre Bailly

    You can truncate the table or you may not.
    It is not possible to truncate only part of the picture.

    VPD political work by adding the predicate for the policy of the DML.
    You cannot add a predicate to truncate - DDL.

    And I do not expect truncated to the error just because EVP is enabled.
    Your results are so as I expect--political VPD are applied, if necessary, but if you have privilege to truncate the table, truncated happen.
    (Same as DROP TABLE - he would just let it go in the table)

    If you want to delete lines in a VPD piolicy, then use the command DELETE policy that includes this type of statement.

    Published by: dombrooks on October 7, 2009 15:45

  • iPad security and multiple users

    I intend to buy an iPad Mini 4 (subject to change) for my sister who is currently in palliative care. She is devastated bed and needs to get his affairs in order and make some estate planning bills etc.

    I wonder if you can have the user double security with the iPad or the ramifications of the reset of the iPad once she spends or to access its iPad rather than it becomes a brick.

    I have already created my sister with iCloud account and I have the user name and password. I'm not sure I've ever had this situation come before. If I need to access the device what would be my options.  I guess she will tend to choose the fingerprint sensor, if it isn't bug or perhaps a simple access code instead.

    Any suggestion would be appreciated.

    Thank you

    I'm sorry to hear about the State of your sister, but I'm very happy that you asked these questions now rather than later when it could be too late.

    One person at the same time has an iOS device.  That's how they are designed.  So I strongly suggest you think in this way, which is to come:

    • Your sister has and uses the iPad.
    • Your sister has the iPad (as if it sells or it betrays) to a new owner.
    • You take possession of the iPad and set up like yours, as if it were a new device.

    To do this, before your sister frees him, here's what should happen:

    What to do before you sell or give away your iPhone, iPad or iPod touch - Apple Support

    So everything I want to say is that you are ready to run (or help run) all the steps in the article.  Once you get the iPad and be responsible, be prepared to make settings > general > reset > erase all content and settings (if it had not already been done).  When you do that, you can resume the iPad and it will have no memory of what either of the past.

  • Mobile of LR and multiple users

    My wife and I share a subscription of the CC, and both want to use LR mobile to access our collections shared on our iPads. It seems that CC provides only a single mobile sign-in LR. How can I have my own mobile LR on my iPad and my wife were here has on his iPad?

    By everyone to have your own subscription.

    Subscriptions are not supposed to be shared. They are linked to an Adobe identification code permanently and assume that the same person is their use at any time. The end user license agreement allows a licensee to activate the software for personal use on up to two computers at the same time.

  • Oracle 10g and multiple processors

    I use Oracle 10 g on Windows on a 4-processor machine.

    I send a lot of 50,000 PLATELETS and SELECTS.

    I have brought increasing performance monitor and looked at the CPU. I noticed in general, I had about 15% usage, but it was divided this way
    CPU   Utilization
 1         1%
 2         1%
 3        57%
 4         1%
    Of course, this does not effectively.

    Is it possible to fix this?

    When everything has failed, read the Fine Manual

    http://download.Oracle.com/docs/CD/B19306_01/server.102/b14200/statements_2012.htm#i2231814

    WRT, session

    http://download.Oracle.com/docs/CD/B19306_01/server.102/b14220/process.htm#sthref1481

  • BlackBerry Smartphones Outlook synchronization issues and multiple users

    1 can synchronize you just some contacts if you have separate folders for them?   that is, the personal contacts and business contacts?  When I tried this, he did a synchronization of all of them.   How can you separate them?

    2. my daughter also has blackjack (samsung) that uses Outlook.   Is it possible that I can configure Outlook for her and I and address books not duplicated on our phones?

    Thank you all for your efforts once more!

    FYI, I found this, after reading PAGES and PAGES of support questions... it was an old post and thought that some may find it useful... THIS MARKET!   And I did 2 clocks to ensure minimum participation of the file that I didn't have on my BB and they aren't today...  YAY

    Connect HH with your in your PC Desktop Manager. If your device is set to wireless synchronization, you must turn off wireless sync. To do this, go to the address book -> click on Menu -> Options -> wireless sync: No. -> click on Menu , Save the changes.

    Click the button synchronize on Desktop Manager-> click on the Configuration tab, then click on set the synchronization of -> click on Choose under address book (on the right side of the pop-up window)-> click apps organizer (like MS outlook, Lotus notes, etc.) -> Select desired apps -> select the option button to sync , and then click OK twice to return to Synchronize tab -> click on Synchronize Now.

  • Is it possible to set up for multiple users on the same computer to avoid entering the e-mail and the password

    Original title: Multi users

    Is it possible to set up for multiple users on the same computer to avoid entering the email and password every time that a new user want to check emails?

    Hello

    Welcome to the community forums of Microsoft and thanks for posting the question. According to the description, you need help in the creation of multiple user accounts. I've surely you will help find a solution on the issue.

    What is the operating system installed on the computer?

    User accounts, several people can easily share a single computer. Each person can have a separate user account with unique settings and preferences, such as a screen saver or desktop background. User accounts control files and programs users can access and what types of changes users can make to the computer. As a general rule, you'll want to create standard accounts for most computer users.

    If you use Windows Vista or Windows 7, see the article below:

    Create a user account

    http://Windows.Microsoft.com/en-in/Windows7/create-a-user-account

    http://Windows.Microsoft.com/en-in/Windows-Vista/create-a-user-account

    For Windows XP users:

    How to create and configure user accounts in Windows XP

    http://support.Microsoft.com/kb/279783?WA=wsignin1.0

    Hope this information helps. Answer please if you have more queries about Windows.

  • share 'Start' content and presentation of the tile with multiple users on the same Tablet Windows RT

    Hello

    Can someone tell me if it is possible to share/copy the content start and the tile layout with multiple users on the same shelf?

    Hello

    Welcome to the Microsoft community.

    Unfortunately, you will not be able to share or copy the content start and available to tile with multiple users. However, you can rearrange the tiles and select the content to be displayed manually on each of the user accounts.

    See these articles for more details:

    Customize the splash screen

    http://Windows.Microsoft.com/en-in/Windows-8/start-screen#1TC=T1

    Reorganization of the tiles start

    http://Windows.Microsoft.com/en-in/Windows-8/rearrange-tiles-start

    I hope this helps. Let us know if you need more assistance.

  • Why do we establish oinstall under the main group of oracle and grid users?

    IM and RDBMS version: 11.2.0.4

    Platform: RHEL/OL 6.5

    Why do we set oinstall under the main group for OS proprietary oracle software and grid?

    I would say "The Central stock" is the watchword here.

    orainstall is actually called the "oraInventory group." Member of (oracle and grid) users who belong to this group must read, write and execute privileges on the directory Central inventory which will serve as a catalogue of all oracle related software installed on the server. Whenever users put oracle or grid to level, the patches from the software they own, they should be able to update the respective news in this catalogue.

  • Oracle AWR and ADDM report for a multiple instance Oracle database 11 g 2 (RAC)

    Hello

    How to create an Oracle AWR and ADDM report for a multiple instance (RAC) Oracle database 11 g 2?

    Concerning

    Hello

    Oracle DB 11 g 2 AWR Global report before 11 GR 2, the awrrpt.sql generation

    under $ORACLE_HOME/rdbms/admin only generates the report awr for the local instance.

    You will need to collect for each RAC instance awr report.

    11 GR 2, there are two new scripts awrgrpt.sql AND awrgdrpt.sql for CARS

    awrgrpt. SQL - AWR Global report (RAC) (global report)

    awrgdrpt. SQL - overall Diff AWR (RAC) report.

    Some other important scripts under $ORACLE_HOME/rdbms/admin

    spawrrac. SQL - Server Performance RAC report

    awrsqrpt. SQL - statement of the standard ANSI SQL92 report

    awrddrpt. SQL - period diff on the current instance

    awrrpti. SQL - workload repository Instance (RAC) report

    REF link:

    ADDM enhancements in Oracle Database 11 g & mdash; DatabaseJournal.com

  • ESXi-v5 and multiple compared to individual (s) users

    I noticed a discussion than ESXi (not on this site, but in other no vmware forums and it may have been v4, but the discussion has Reference v5 as well) only allows a single user to connect at the same time?

    I have currently no access to one machine, so I can't verify this (today ' today/tomorrow), but I know that there are at least 3 different admin accts on 10 or so systems to one of the sites I visit. One is an administrator of the VM, another who takes care of storage and even a third dealing with newspapers. ESXi-v5 machines are all using Active Directory. All connected via SSH and the vSphere Client and I don't think I've ever heard talk of them complain that one person could connect to the system at the same time via SSH or the vSphere Client?

    Anyone?

    Hello

    Multiple users can connect at the same time.

  • Multiple Oracle homes on the same server (Oracle ACE and DB)

    Hi all

    OS: RHEL 4.7
    Oracle Application Server: 10.1.3.1
    Oracle database: 11.2.0.1.0

    I was asked to install oracle 11g on a server that is already running Oracle Application Server 10.1.3.1

    Due to the lack of space on the server sys admin gave me space under/usr, Installation went smooth and successful and complete location 11 g installed is "/ usr/11 GR 2/app/product/11 g.

    Database is also created using DBCA with the location of the file ' / usr/11 GR 2/app / 11 g/oradata.

    It is, I need to define the environment variable under the same 'oracle' user when it connects, should be able to log on by typing just sqlplus...

    . Current user 'oracle' Bash_profile looks like this...

    ***********************************************************************
    # Get the aliases and functions
    If [~/.bashrc - f]; then
    . ~/.bashrc
    FI

    # Specific programs startup and user environment

    Path=/U01/Oracle/product/10.1.3.1/OracleAS_1/JDK/bin:$path:$Home/bin

    Export RPD_HOME = / home/oracle/ORABI/OBI/Server/repository
    export ORACLE_HOME=/u01/oracle/product/10.1.3.1/OracleAS_1
    #export JAVA_HOME=/u01/oracle/product/10.1.3.1/OracleAS_1/jdk
    export JAVA_HOME=/home/oracle/product/10.1.3.1/OracleAS_1/jdk/
    $PATH = path: $ORACLE_HOME/bin
    $PATH = path: $ORACLE_HOME/opmn/bin
    export ANT_HOME = / usr/local/ant
    export PATH = ${PATH}: ${ANT_HOME} / bin
    #export JAVA_HOME = / usr/local/ant/jdk


    export PATH

    *****************************************************************************

    Please suggest to include this also oracle_home in the .bash_profile above or any other solution to meet the needs...

    Thank you

    Published by: user1687821 on December 22, 2011 01:10

    Hello;

    I did a similar thing using Oracle 10 and 11, but I keep manual and use default bash for one.

    From the houses of the Oracle, I run the command: (using which profile I need)

    
 source ./o10g.profile

    Note the "unset ORACLE_HOME" command in each profile.

    o10g. Profile

    
TMP=/tmp; export TMP
TMPDIR=$TMP; export TMPDIR

export ORACLE_BASE=/u01/app/oracle
unset ORACLE_HOME
export ORACLE_HOME=/u01/app/oracle/product/10.2.0
#export DISPLAY=localhost:0.0
export TZ=CST6CDT
export ORA_OCI_NO_OPTIMIZED_FETCH=1
ORA_OCI_NO_OPTIMIZED_FETCH=1; export ORA_OCI_NO_OPTIMIZED_FETCH
export ORACLE_SID=
export ORACLE_TERM=xterm
#export TNS_ADMIN= Set if sqlnet.ora, tnsnames.ora, etc. are not in $ORACLE_HOME/network/admin

export NLS_LANG=AMERICAN;

LD_LIBRARY_PATH=$ORACLE_HOME/lib:/lib:/usr/lib
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib
export LD_LIBRARY_PATH

# Set shell search paths

unset PATH

PATH=/usr/sbin:/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin; export PATH
export PATH=$PATH:$ORACLE_HOME/bin

#CLASSPATH
CLASSPATH=$ORACLE_HOME/JRE:$ORACLE_HOME/jlib:$ORACLE_HOME/rdbms/jlib
CLASSPATH=$CLASSPATH:$ORACLE_HOME/network/jlib
export EDITOR=vi
set -o vi
PS1='$PWD:$ORACLE_SID>'

    o11g. Profile

    TMP=/tmp; export TMP
TMPDIR=$TMP; export TMPDIR

export ORACLE_BASE=/u01/app/oracle
unset ORACLE_HOME
export ORACLE_HOME=/u01/app/oracle/product/11.2.0
#export DISPLAY=localhost:0.0
export TZ=CST6CDT
export ORA_OCI_NO_OPTIMIZED_FETCH=1
ORA_OCI_NO_OPTIMIZED_FETCH=1; export ORA_OCI_NO_OPTIMIZED_FETCH
export ORACLE_SID=
export ORACLE_TERM=xterm
#export TNS_ADMIN= Set if sqlnet.ora, tnsnames.ora, etc. are not in $ORACLE_HOME/network/admin

export NLS_LANG=AMERICAN;

LD_LIBRARY_PATH=$ORACLE_HOME/lib:/lib:/usr/lib
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib
export LD_LIBRARY_PATH

# Set shell search paths

unset PATH

PATH=/usr/sbin:/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin; export PATH
export PATH=$PATH:$ORACLE_HOME/bin

#CLASSPATH
CLASSPATH=$ORACLE_HOME/JRE:$ORACLE_HOME/jlib:$ORACLE_HOME/rdbms/jlib
CLASSPATH=$CLASSPATH:$ORACLE_HOME/network/jlib
export EDITOR=vi
set -o vi
PS1='$PWD:$ORACLE_SID>'

    Best regards

    mseberg

Maybe you are looking for