Fine Grained Access Control

Abstract

Fine Grained Access Control (FGAC) in Oracle 8i gives you the ability to dynamically attach, at run-time, a predicate (the WHERE clause) to all queries issued against a database table or view. You now have the ability to procedurally modify the query at run-time – a dynamic view capability. You may evaluate who is running the query, which terminal they are running the query from, when they are running it (as in time of day), and then build the predicate based on those specific set of circumstances. With the use of application contexts, you may securely add additional information to the environment (such as an application role the user may have), and access this in your procedure or predicate as well. You will see FGAC referred to with various names in different publications. The following are synonymous terms for this feature: ❑ Fine Grained Access Control ❑ Virtual Private Database (VPD) ❑ Row Level Security or DBMS_RLS (based on the PL/SQL package DBMS_RLS that implements this feature) In order to execute the examples found in this chapter, you will need Oracleion 8.1.5), or higher. In addition, this feature is available only in the Enterprise and Personal Editions of Oracle; these examples will not work in the Standard Edition. In this chapter, we will cover: ❑ The reasons why it would be advantageous to use this feature, such as it's ease of maintenance, the fact that it is performed in the server itself, takes into account the evolution of application and also allows for easier development, and so on. ❑ Two examples in the How it Works section, demonstrating both security policies and application contexts.