Comments on: Pop-quiz: VPD policy that depends on a table with a policy…

By: Lucas

Lucas — Wed, 28 Sep 2005 07:48:46 +0000

En wat als de policy function refereeert naar de tabel zelf? Bijvoorbeeld: User mag alleen maar medewerkers zien die onder een Manager vallen die de User mag zien? Zoiets als:

create or replace
function get_emp_predicate
( p_schema_name  in   varchar2
, p_table_name   in   varchar2
) return varchar2
is
begin
   if user = 'SCOTT'
   then
    return 'ENAME = ''BLAKE'' or exists ( select 1 from emp e where e.empno = emp.mgr)';
   else if user = 'UP'
        then
          return 'DEPTNO=10 or exists ( select 1 from emp e where e.empno = emp.mgr)';
        end if;
   else
          return 'JOB=''SALESMAN'' or exists ( select 1 from emp e where e.empno = emp.mgr)';
   end if;
end;

Which predicate is applied in the subquery? Is this a recursive nightmare?

By: Wilfred

Wilfred — Tue, 27 Sep 2005 08:51:27 +0000

We have the exact same policies implemented with a EXISTS clause. The only downside to it is the performance hit. Do you have any idea what happens if you have a 10+ table query in a report and all these tables get an EXISTS clause added in the predicate that refer to some central table.

We’re still struggling with it. So yes, it does work but do consider the performance hit!

By: Lucas

Lucas — Tue, 27 Sep 2005 04:01:32 +0000

Rob, You are most welcome. Good to see that this post actually serves a purpose! All the best.

By: Robert Gauf

Robert Gauf — Tue, 27 Sep 2005 02:54:52 +0000

What a timely blog entry. I just spent a half hour this afternoon trying to explain to a client how VPD policies could work to restrict access to their reporting database content (a DW-like info melange). This gives me a great example for them to see how detail data access (i.e. Emp) and corresponding reference data restrictions (i.e. Dept) can combine, without building intensely ugly VPD policies on the detail. Slick!! Thanks!