Comments on: Virtual Private Database, securing your data

By: Marcos

Marcos — Thu, 08 Sep 2005 12:59:09 +0000

The idea of VPD is that one is able to implement RLS with the use of application_context.
To have more control over the application_context one could extend the package setting this
context with additional test procedures.
Since VPD uses policies written in PL/SQL it is up to the person writing the policy to make sure
that the returning clause will not “muck” up the performance. I admit that it is difficult when
more complex clauses are returned or when several policies are registed to the table/view.

By: Viliam

Viliam — Thu, 08 Sep 2005 04:25:30 +0000

We use VPD for a long time and I don’t know about any limitation in the number of rows.

But other issue is, that the execution plan of a query may change if the session context changes. This may muck things up when the policy returns more complicated conditions. And the development tools (like PL/SQL Developer we use) sometimes don’t allow to set the context when explaining the plan.

By: Marcos

Marcos — Wed, 07 Sep 2005 19:31:40 +0000

Hi Brian,

Up till now I never ran into this problem. Perhaps the number of record I worked with were not big enough. I would however be very interested in an example that supports your statement.

By: Brian

Brian — Wed, 07 Sep 2005 14:12:10 +0000

I looked at VPD some time ago, and in my experimentation I discovered that there was a top limit to the number of rows that could be displayed. It’s been long enough ago that I don’t recall what that number was…it was pretty big, but unfortunately, not big enough to make VPD useful to my customer. Do you know if that upper range has been extended? For example, in a large corporation with thousands of employees per division, a division supervisor should only be able to access data on employees within his division, but the VPD couldn’t handle a row return that large. (Hopefully I’m remembering this right!)