Home Database Mysql Tutorial 使用Oracle VPD(Virtual Private Database)实现数据库层面数据权限

使用Oracle VPD(Virtual Private Database)实现数据库层面数据权限

Jun 07, 2016 pm 04:48 PM

Oracle VPD(Virtual Private Database)就是从数据库层面实现数据访问控制的一种成熟技术。借助VPD,一些已经上线或者不容易进行

在应用系统开发领域,功能权限和数据权限两层权限体系占到了安全功能性需求的大半。除了在应用程序层面进行处理之外,我们其实还可以从数据库层面实现数据权限访问的。

Oracle VPD(Virtual Private Database)就是从数据库层面实现数据访问控制的一种成熟技术。借助VPD,一些已经上线或者不容易进行二次开发的功能可以比较容易的解决。
 
1、VPD简述

从产品属性来看,Oracle Virtual Private Database(简称VPD)是归属在Oracle安全security框架下的成熟产品。要注意:VPD是企业版Enterprise版本功能,在其他如标准Standard版下是不能使用的。
 
简单的说,VPD就是介于用户SQL语句和实际执行对象之间的介质层。用户或者应用程序发出的SQL语句在传入到DBMS执行之前,会自动被拦截并且进行额外处理。处理的结果往往反映为在语句where条件中添加特殊的条件式。
 
例如:数据表T中包括了所有供应商的信息,设计者系统任何SQL语句发送之后,都只能查看到location=’北京’的记录。在没有VPD的情况下,我们必须修改应用程序代码,将location=’北京’加入到所有对应数据表操作SQL语句中。
 
借助VPD,应用程序不需要修改任何代码。我们只需要在数据库层面设定一个指定策略规则,如果针对某个数据对象表的所有SQL语句,都会调用一个设定的函数。函数自身会返回一个字符串条件,作为补充的where语句条件。
 
例如:如果我们设定对数据表t的每个Select语句都要添加一个条件object_id 
下面我们通过一系列的实验来进行验证演示。

 

2、环境介绍和配置

 

我们选择Oracle 11g企业版进行测试。

 

SQL> select * from v$version;

 

BANNER

-----------------------------------------------

Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - Production

PL/SQL Release 11.2.0.4.0 - Production

CORE 11.2.0.4.0 Production

 

注意:只有在其中明确标注Enterprise Edition才认为是企业版Oracle。否则是标准版。

创建专门用户用于实验。

 

SQL> create user vpd identified by vpd;

User created

 

SQL> grant resource, connect to vpd;

Grant succeeded

 

SQL> grant execute on dbms_rls to vpd;

Grant succeeded

 

SQL> grant select any dictionary to vpd;

Grant succeeded

 

在vpd schema下创建数据表T。

 

SQL> conn vpd/vpd@ora11g;

Connected to Oracle Database 11g Enterprise Edition Release 11.2.0.4.0

Connected as vpd

 

SQL> create table t as select * from dba_objects;

Table created

 

SQL> select count(*) from t;

 

  COUNT(*)

----------

    86032

 

目标是使用VPD实现数据隐藏:只有VPD用户查询数据表T才能获取全文,其他schema读取不到其中数据。

3、配置VPD

配置VPD第一步是定义处理函数,我们需要函数的意义是返回一个字符串条件列。在函数中,我们可以根据不同的情况插入自由的逻辑。

针对这个需求,首先需要获取到查询用户的schema名称才能判断。于是,函数为:

SQL> create or replace function f_limit_access

  2  (

  3    vc_schema varchar2,

  4    vc_object varchar2

  5  ) return varchar2

  6  as

  7  vc_userid varchar2(100);

  8  begin

  9    select SYS_CONTEXT('USERENV','SESSION_USER')

 10    into vc_userid

 11    from dual;

 12 

 13    if (trim(vc_userid)='VPD') then

 14      return '1=1';

 15    else

 16      return '1=0';

 17    end if;

 18 

 19  end;

 20  /

 

Function created

sys_context函数可以获取到当前用户名信息,做出判断。输入参数vc_schema和vc_object是作为调用点,可以逆向插入回去的。

 

更多详情见请继续阅读下一页的精彩内容:

linux

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

When might a full table scan be faster than using an index in MySQL? When might a full table scan be faster than using an index in MySQL? Apr 09, 2025 am 12:05 AM

Full table scanning may be faster in MySQL than using indexes. Specific cases include: 1) the data volume is small; 2) when the query returns a large amount of data; 3) when the index column is not highly selective; 4) when the complex query. By analyzing query plans, optimizing indexes, avoiding over-index and regularly maintaining tables, you can make the best choices in practical applications.

Explain InnoDB Full-Text Search capabilities. Explain InnoDB Full-Text Search capabilities. Apr 02, 2025 pm 06:09 PM

InnoDB's full-text search capabilities are very powerful, which can significantly improve database query efficiency and ability to process large amounts of text data. 1) InnoDB implements full-text search through inverted indexing, supporting basic and advanced search queries. 2) Use MATCH and AGAINST keywords to search, support Boolean mode and phrase search. 3) Optimization methods include using word segmentation technology, periodic rebuilding of indexes and adjusting cache size to improve performance and accuracy.

Can I install mysql on Windows 7 Can I install mysql on Windows 7 Apr 08, 2025 pm 03:21 PM

Yes, MySQL can be installed on Windows 7, and although Microsoft has stopped supporting Windows 7, MySQL is still compatible with it. However, the following points should be noted during the installation process: Download the MySQL installer for Windows. Select the appropriate version of MySQL (community or enterprise). Select the appropriate installation directory and character set during the installation process. Set the root user password and keep it properly. Connect to the database for testing. Note the compatibility and security issues on Windows 7, and it is recommended to upgrade to a supported operating system.

MySQL: Simple Concepts for Easy Learning MySQL: Simple Concepts for Easy Learning Apr 10, 2025 am 09:29 AM

MySQL is an open source relational database management system. 1) Create database and tables: Use the CREATEDATABASE and CREATETABLE commands. 2) Basic operations: INSERT, UPDATE, DELETE and SELECT. 3) Advanced operations: JOIN, subquery and transaction processing. 4) Debugging skills: Check syntax, data type and permissions. 5) Optimization suggestions: Use indexes, avoid SELECT* and use transactions.

Difference between clustered index and non-clustered index (secondary index) in InnoDB. Difference between clustered index and non-clustered index (secondary index) in InnoDB. Apr 02, 2025 pm 06:25 PM

The difference between clustered index and non-clustered index is: 1. Clustered index stores data rows in the index structure, which is suitable for querying by primary key and range. 2. The non-clustered index stores index key values ​​and pointers to data rows, and is suitable for non-primary key column queries.

Can mysql and mariadb coexist Can mysql and mariadb coexist Apr 08, 2025 pm 02:27 PM

MySQL and MariaDB can coexist, but need to be configured with caution. The key is to allocate different port numbers and data directories to each database, and adjust parameters such as memory allocation and cache size. Connection pooling, application configuration, and version differences also need to be considered and need to be carefully tested and planned to avoid pitfalls. Running two databases simultaneously can cause performance problems in situations where resources are limited.

The relationship between mysql user and database The relationship between mysql user and database Apr 08, 2025 pm 07:15 PM

In MySQL database, the relationship between the user and the database is defined by permissions and tables. The user has a username and password to access the database. Permissions are granted through the GRANT command, while the table is created by the CREATE TABLE command. To establish a relationship between a user and a database, you need to create a database, create a user, and then grant permissions.

Explain different types of MySQL indexes (B-Tree, Hash, Full-text, Spatial). Explain different types of MySQL indexes (B-Tree, Hash, Full-text, Spatial). Apr 02, 2025 pm 07:05 PM

MySQL supports four index types: B-Tree, Hash, Full-text, and Spatial. 1.B-Tree index is suitable for equal value search, range query and sorting. 2. Hash index is suitable for equal value searches, but does not support range query and sorting. 3. Full-text index is used for full-text search and is suitable for processing large amounts of text data. 4. Spatial index is used for geospatial data query and is suitable for GIS applications.

See all articles