利用Oracle VPD（虚拟专用数据库）实现类似EBS R12里的多OU屏蔽
EBS R11通过建立带有CLIENT_INFO过滤条件的视图来实现多OU屏蔽，
而R12使用的则是VDP（Virtual Private Database）来实现，关联的package是MO_GLOBAL,ORG_SECURITY。
假设我们想让员工只能查看到本部门的所有员工信息：
没有应用VDP之前：
select * from scott.emp; ----------------------------------------------------------------------------- 7369 SMITH CLERK 7902 12/17/1980 00:00:00 800 20 7499 ALLEN SALESMAN 7698 02/20/1981 00:00:00 1600 300 30 7521 WARD SALESMAN 7698 02/22/1981 00:00:00 1250 500 30 7566 JONES MANAGER 7839 04/02/1981 00:00:00 2975 20 7654 MARTIN SALESMAN 7698 09/28/1981 00:00:00 1250 1400 30 7698 BLAKE MANAGER 7839 05/01/1981 00:00:00 2850 30 7782 CLARK MANAGER 7839 06/09/1981 00:00:00 2450 10 7788 SCOTT ANALYST 7566 04/19/1987 00:00:00 3000 20 7839 KING PRESIDENT 11/17/1981 00:00:00 5000 10 7844 TURNER SALESMAN 7698 09/08/1981 00:00:00 1500 0 30 7876 ADAMS CLERK 7788 05/23/1987 00:00:00 1100 20 7900 JAMES CLERK 7698 12/03/1981 00:00:00 950 30 7902 FORD ANALYST 7566 12/03/1981 00:00:00 3000 20 7934 MILLER CLERK 7782 01/23/1982 00:00:00 1300 10
应用VPD之后（员工查询的时候不需加任何条件，VPD会通过query rewrite自动附加对应的过滤条件）：
select * from scott.emp; ----------------------------------------------------------------------------- 7782 CLARK MANAGER 7839 06/09/1981 00:00:00 2450 10 7839 KING PRESIDENT 11/17/1981 00:00:00 5000 10 7934 MILLER CLERK 7782 01/23/1982 00:00:00 1300 10
什么是VPD？
VPD是由应用程序上下文（application context）和细粒度访问控制(fine-grained access control)共同实现的一套可以精确到行（RLS，row level security）和列的安全策略。
具体实现
这里以scott用户示例，首先创建application context：
CONNECT scott/tiger
为方便以后手动设置context，这里先加一个set_dept_info，因为如果dbms_session.set_context不放到context关联的package里面会报ORA-01031: insufficient privileges：
http://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:1288401763279#3056702265218
创建application context所需的package：
CREATE OR REPLACE PACKAGE scott_context
AS
PROCEDURE set_deptno;
PROCEDURE set_dept_info (p_name IN VARCHAR2, p_value IN VARCHAR2);
END scott_context;
CREATE OR REPLACE PACKAGE BODY scott_context
AS
PROCEDURE set_deptno
IS
l_deptno NUMBER;
BEGIN
SELECT deptno
INTO l_deptno
FROM scott.emp
WHERE UPPER (ename) = SYS_CONTEXT ('USERENV', 'SESSION_USER');
DBMS_SESSION.set_context ('dept_info', 'deptno', l_deptno);
END set_deptno;
PROCEDURE set_dept_info (p_name IN VARCHAR2, p_value IN VARCHAR2)
AS
BEGIN
DBMS_SESSION.set_context ('dept_info', p_name, p_value);
END set_dept_info;
END scott_context;
赋予scott CREATE ANY CONTEXT权限：
CONNECT system/oracle
GRANT CREATE ANY CONTEXT TO scott;
创建application context：
CONNECT scott/tiger
CREATE CONTEXT dept_info USING scott.scott_context;
创建FGAC所需package：
CREATE OR REPLACE PACKAGE scott_security
AS
FUNCTION deptno_sec (a1 VARCHAR2, a2 VARCHAR2)
RETURN VARCHAR2;
END scott_security;
CREATE OR REPLACE PACKAGE BODY scott_security
AS
FUNCTION deptno_sec (a1 VARCHAR2, a2 VARCHAR2)
RETURN VARCHAR2
IS
l_predicate VARCHAR2 (2000);
BEGIN
l_predicate := 'deptno=SYS_CONTEXT(''dept_info'',''deptno'')';
RETURN l_predicate;
END deptno_sec;
END scott_security;
将FGAC的package与表关联：
CONNECT system/oracle
BEGIN
DBMS_RLS.add_policy (object_schema => 'scott'
,object_name => 'emp'
,policy_name => 'dept_policy'
,function_schema => 'scott'
,policy_function => 'scott_security.deptno_sec'
,statement_types => 'select'
);
END;
查看刚刚建好的VPD policy：
SELECT object_name
,policy_name
,sel
,ins
,upd
,del
,ENABLE
FROM all_policies;
-----------------------------------------------------------------------------
EMP DEPT_POLICY YES NO NO NO YES
将FGAC package的执行权限赋予public：
GRANT EXECUTE ON scott.scott_security TO public;
测试：
exec scott_context.set_dept_info('deptno',10);
select deptno from scott.emp;
DEPTNO
----------
10
10
10
通过LOGON触发器我们可以在用户登录的时候就直接设置好context值：
CREATE OR REPLACE TRIGGER scott.security_context
AFTER LOGON ON DATABASE
BEGIN
scott_context.set_deptno;
END;
REF：
1. <<Expert Oracle Database 11g Administration>> Page 578, Fine-Grained Data Access
2. http://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:1288401763279#3056702265218