| Oracle® Label Security Administrator's Guide 10g Release 1 (10.1) Part Number B10774-01 |
|
|
View PDF |
| Oracle® Label Security Administrator's Guide 10g Release 1 (10.1) Part Number B10774-01 |
|
|
View PDF |
This chapter describes special considerations for using Oracle Label Security in a distributed configuration. It contains the following sections:
A network configuration that supports distributed databases can include multiple Oracle9i servers, or other database servers, running on the same or different operating systems. Each cooperative server in a distributed system communicates with other clients and servers over a network.
Figure 12-1 illustrates a distributed database that includes clients and servers with and without Oracle Label Security. As described in this chapter, if you establish database links from the WESTERN_REGION database to the EASTERN_REGION database, you can access data if your userid on EASTERN_REGION is authorized to see it, even if locally (on WESTERN_REGION) you do not have this access.
Text description of the illustration olsag019.gif
Distributed databases behave in the standard way with Oracle Label Security: the local user ends up connected as a particular remote user. Oracle Label Security protects the labeled data, whether you connect locally or remotely. If the remote user has the appropriate labels, you can access the data. If not, you cannot access the data.
The database link sets up the connection to the remote database and identifies the user that will be associated with the remote session. Your Oracle Label Security authorizations on the remote database are based upon those of the remote user identified in the database link.
For example, local user JANE might connect as remote user AUSTEN, in the database referenced by the connect string sales, as follows:
CREATE DATABASE LINK sales CONNECT TO austen IDENTIFIED BY pride USING 'sales'
When JANE connects, her authorizations are based on the labels and privileges of remote user AUSTEN, since AUSTEN is the user identified in the database link. When JANE issues the first reference to the remote database, the remote session is actually established. For example, the remote session would be created if JANE enters:
SELECT * FROM emp@sales
You need not be an Oracle Label Security policy user in the local database. If you connect as a policy user on the remote database, you can access protected data.
When connecting remotely, you can directly control the session label and row label in effect when you establish the connection. When you connect, Oracle Label Security passes these values (for all policies) over to the remote database. Notice that:
Consider a local user, Diana, with a maximum level of HS, and a session level of S. On the remote database, the remote user identified in the database link has a maximum level of S.
Be aware of the label at which you are running the first time you connect to the remote database. The first time you reference a database link, your local session labels are sent across to the remote system when a connection is made. Afterward you can change the label, but to do so you must execute the SA_SESSION.SET_LABEL procedure on the remote database.
Diana can connect at level HS, set the label to S, and then perform a remote access. Connection is implicitly made when the database link is established. Her default label is S on the remote database.
On the local database, Diana can set her session label to her maximum level of HS, but if the label of the remote user is set to S, then she can only retrieve S data from the remote database. If she performs a distributed query, she will get HS data from the local database, and S data from the remote database.
It is advisable to use the same label component definitions and label tags on any database that is to be protected by the policy.
In a distributed environment you may choose to use the same label tags across multiple databases. However, if you choose not to use the same tags across multiple databases, you should retrieve the character form of the label when performing remote operations. This will ensure that the labels are consistent.
In the following example the character string representation of the label string is the same; the label tag, however, does not match. If the retrieved label tag has a value of 11 on the WESTERN_REGION database, but a tag of 2001 on the EASTERN_REGION database, the tags have no meaning. Serious consequences can result.
Text description of the illustration olsag020.gif
When retrieving labels from a remote system, you should return the character string representation (rather than the numeric label tag), unless you are using the same numeric labels on both databases.
If you allow Oracle Label Security to automatically generate labels on different databases, the label tags will not be identical. Character strings will have meaning, but the numeric values will not, unless you have predefined labels with the same label tags on both instances.
To avoid the complexities of label tags, you can simply convert labels to strings upon retrieval (using LABEL_TO_CHAR) and use CHAR_TO_LABEL when you store labels. Operations will succeed as long as the component names are the same.
In a distributed environment you should use the same relative ranking of the numeric form of the level component, in order to ensure proper sorting of the labels.
In the following example, the levels in the two databases are effectively the same. Although the numeric form is different, the relative ranking of the levels' numeric form is the same. As long as the relative order of the components is the same, the labels are perceived as identical.
Text description of the illustration olsag021.gif
Oracle Label Security supports all standard Oracle9i distributed configurations. Whether or not you can access protected data depends on the policies installed in each distributed database.
Be sure to take into account the relationships between databases in a distributed environment:
If the remote database has no policy applied to it, you can access its data just as you would with a standard distributed database.
Consider a situation in which three databases exist, with different Oracle Label Security policies in force:
Users authorized for Policy A can obtain protected data from Database 1 and Database 2. If the remote user is authorized for Policy C, this user can obtain data from Database 3 as well.
This section explains how to use the replication option with tables protected by Oracle Label Security policies. It contains these topics:
See Also:
|
This section introduces the use of replication under Oracle Label Security. It contains the following topics:
Oracle Label Security supports standard replication and Advanced Replication, including multimaster replication and updatable materialized views (snapshots).
Oracle9i uses materialized views for replicating data. A materialized view is a local copy of a local or remote master table that reflects a recent state of the master table.
As illustrated in Figure 12-4, a master table is a table you wish to replicate, on a node that you designate as the master node. Using a dblink account (such as REPADMIN), you can create a materialized view of the table in a different database. (This can also be done in the same database, and on the same machine.) You can select rows from the remote master table, and copy them into the local materialized view. Here, mvEMP represents the materialized view of table EMP, and mlog$_EMP represents the materialized view log.
Text description of the illustration olsag018.gif
In a distributed environment, a materialized view alleviates query traffic over the network and increases data availability when a node is not available.
An Oracle Label Security policy applies Row Level Security (RLS) to a table if READ_CONTROL is specified as one of the policy options. Problems occur if both of the following conditions are true:
To avoid the additional predicate (and thus avoid this problem), the users involved in a replication environment should be given the necessary Oracle Label Security privileges. To be specific, the designated users in the database link (such as REPADMIN and/or the materialized view owner) must have READ or FULL privilege. As a result, the queries used to perform the replication will not be modified by RLS.
This section discusses the contents of materialized views.
Oracle Label Security performs the following steps when creating materialized views. These steps determine the contents of the view.
Because Oracle Label Security only writes those rows to which you have write access in the local database, the contents of the materialized view vary according to:
If you read all of the rows in the master table and have write access in the local database to each label in the materialized view, the result is a complete materialized view of the master table. To ensure that the materialized view is complete, ensure that you have read access to all of the data in the master table and write access in the local database to all labels at which data is stored in the master table.
|
Note: Never revoke privileges that you granted when you created the materialized view. If you do, you may not be able to perform a replication refresh. |
A partial materialized view is created when you specify a WHERE clause in the materialized view definition. This is a convenient way to pass subsets of data to a remote database.
|
Note: To create a partial materialized view you must have write access to all the rows being replicated. |
Requirements for creating a materialized view depend upon the type of materialized view you are creating.
Requirements for the REPADMIN account vary depending on the configuration. In general, however, it should meet the following requirements:
Remember that the privileges belonging to the owner of the materialized view are used during the refresh of the materialized view. If these privileges are not sufficient, then there are two options:
Consider, for example, the following materialized view created by user SCOTT:
CREATE MATERIALIZED VIEW mvemp as SELECT * FROM EMP@link_to_master WHERE label_to_char(sa_label) = 'HS';
Here, SCOTT should have permission to insert records at the HS level in the local database. If Oracle Label Security policies are applied on the materialized view, then SCOTT must have the FULL privilege to avoid the RLS restriction.
Different configurations can be set up depending on whether Oracle Label Security policies are applied on the materialized view, what privileges are granted to the owner of the materialized view, and so on. If Oracle Label Security policies are applied to the materialized view, but SCOTT should not be granted the FULL privilege, then the REPADMIN account must be used to create the materialized view. SCOTT can then be granted the SELECT privilege on that table.
If no policies are applied to the materialized view, then the view can be created in SCOTT's schema without any additional privileges. In this case, the materialized view should be created in such a way that a WHERE condition limits the records to those which SCOTT can read.
Finally, if SCOTT can be granted the FULL privilege, then the materialized view can be created in SCOTT's schema, and Oracle Label Security policies can also be applied on the materialized view.
Note that the master table can have Oracle Label Security policies containing any set of policy options. If SCOTT has the FULL or READ privilege, he can select all rows, regardless of policy options.
To create a partial materialized view that includes only some of the rows in a remote master table protected by Oracle Label Security, you must have sufficient privileges to WRITE in the local database at every label retrieved by your query.
To create a complete materialized view that includes every row in a remote master table protected by Oracle Label Security, you must be able to WRITE in the local database at the labels of all of the rows retrieved by the defined materialized view query.
If the contents or definition of a master table changes, refresh the materialized view so that it accurately reflects the contents of the master table. To refresh a materialized view of a remote multilevel table, you must also have privileges to write in the local database at the labels of all of the rows that the materialized view query retrieves
To ensure an accurate materialized view refresh, use the optional materialized view background processes, SNPn, to refresh the views automatically. These processes must have sufficient privileges both to read all of the rows in the master table and to write those rows to the materialized view, ensuring that the view is completely refreshed. Remember that the privileges used by these processes are those of the materialized view owner.
| See Also:
For information about SNPn background processes, see Oracle Database Administrator's Guide |
|
 Copyright © 2000, 2003 Oracle Corporation All Rights Reserved. |
|
