| Oracle® Label Security Administrator's Guide 11g Release 1 (11.1) Part Number B28529-01 |
|
|
View PDF |
| Oracle® Label Security Administrator's Guide 11g Release 1 (11.1) Part Number B28529-01 |
|
|
View PDF |
This chapter describes special considerations for using Oracle Label Security in a distributed configuration. It contains the following sections:
Establishing Session Label and Row Label for a Remote Session
Using Oracle Label Security Policies in a Distributed Environment
A network configuration that supports distributed databases can include multiple Oracle Database servers, or other database servers, running on the same or different operating systems. Each cooperative server in a distributed system communicates with other clients and servers over a network.
Figure 13-1, "Using Oracle Label Security with a Distributed Database" illustrates a distributed database that includes clients and servers with and without Oracle Label Security. As described in this chapter, if you establish database links from the WESTERN_REGION database to the EASTERN_REGION database, then you can access data if your userid on EASTERN_REGION is authorized to see it, even if locally (on WESTERN_REGION) you do not have this access.
Figure 13-1 Using Oracle Label Security with a Distributed Database
Distributed databases act in the standard way with Oracle Label Security: the local user ends up connected as a particular remote user. Oracle Label Security protects the labeled data, whether you connect locally or remotely. If the remote user has the proper labels, then you can access the data. If not, then you cannot access the data.
The database link sets up the connection to the remote database and identifies the user who will be associated with the remote session. Your Oracle Label Security authorizations on the remote database are based on those of the remote user identified in the database link.
For example, local user JANE might connect as remote user AUSTEN, in the database referenced by the connect string sales, as follows:
CREATE DATABASE LINK sales CONNECT TO austen IDENTIFIED BY pride USING 'sales'
When JANE connects, her authorizations are based on the labels and privileges of remote user AUSTEN, because AUSTEN is the user identified in the database link. When JANE makes the first reference to the remote database, the remote session is actually established. For example, the remote session would be created if JANE enters:
SELECT * FROM emp@sales
You need not be an Oracle Label Security policy user in the local database. If you connect as a policy user on the remote database, you can access protected data.
When connecting remotely, you can directly control the session label and row label in effect when you establish the connection. When you connect, Oracle Label Security passes these values (for all policies) over to the remote database. Notice that:
The local session label and row label are used as the default for the remote session, if they are valid for the remote user.
The remote session is constrained by the minimum and maximum authorizations of the remote user.
Although the local user's session labels are passed to the remote database, the local user's privileges are not passed. The privileges for the remote session are those associated with the remote user.
Consider a local user, Diana, with a maximum level of HS, and a session level of S. On the remote database, the remote user identified in the database link has a maximum level of S.
If Diana's session label is S when the database link is established, then the S label is passed over. This is a valid label. Diana can connect and read SENSITIVE data.
If Diana's session label is HS when the database link is established, then the HS level is passed across, but it is not valid for the remote user. Diana will pick up the remote user's default label (S).
Be aware of the label at which you are running the first time you connect to the remote database. The first time you reference a database link, your local session labels are sent across to the remote system when a connection is made. Later, you can change the label, but to do so, you must run the SA_SESSION.SET_LABEL procedure on the remote database.
Diana can connect at level HS, set the label to S, and then perform a remote access. Connection is implicitly made when the database link is established. Her default label is S on the remote database.
On the local database, Diana can set her session label to her maximum level of HS, but if the label of the remote user is set to S, then she can only retrieve S data from the remote database. If she performs a distributed query, then she will get HS data from the local database, and S data from the remote database.
It is advisable to use the same label component definitions and label tags on any database that is to be protected by the policy.
In a distributed environment, you may choose to use the same label tags across multiple databases. However, if you choose not to use the same tags across multiple databases, then you should retrieve the character form of the label when performing remote operations. This will ensure that the labels are consistent.
In the following example, the character string representation of the label string is the same. However, the label tag does not match. If the retrieved label tag has a value of 11 on the WESTERN_REGION database but a tag of 2001 on the EASTERN_REGION database, then the tags have no meaning. Serious consequences can result.
Figure 13-2 Label Tags in a Distributed Database
When retrieving labels from a remote system, you should return the character string representation (rather than the numeric label tag), unless you are using the same numeric labels on both databases.
If you allow Oracle Label Security to automatically generate labels on different databases, then the label tags will not be identical. Character strings will have meaning, but the numeric values will not, unless you have predefined labels with the same label tags on both instances.
To avoid the complexities of label tags, you can convert labels to strings on retrieval (using LABEL_TO_CHAR) and use CHAR_TO_LABEL when you store labels. Operations will succeed as long as the component names are the same.
In a distributed environment, you should use the same relative ranking of the numeric form of the level component, to ensure proper sorting of the labels.
In the following example, the levels in the two databases are effectively the same. Although the numeric form is different, the relative ranking of the levels numeric form is the same. As long as the relative order of the components is the same, the labels are perceived as identical.
Figure 13-3 Label Components in a Distributed Database
Oracle Label Security supports all standard Oracle Database distributed configurations. Whether or not you can access protected data depends on the policies installed in each distributed database.
Be sure to take into account the relationships between databases in a distributed environment:
If the same application runs on two databases and you want them to have the same protection, then syou must apply the same Oracle Label Security policy to both the local and the remote databases.
If the local and remote databases have a policy in common, then your local session label and row label will override the default labels for the remote user.
If the remote database has a different policy than the local database, then the remote policy can restrict access to the data independent of your local policies. On the other hand, when you make a connection as a remote user who has authorization on the remote policy, you can access any data to which the remote user has access to, regardless of your local authorizations.
If the remote database has no policy applied to it, you can access its data just as you would with a standard distributed database.
Consider a situation in which three databases exist, with different Oracle Label Security policies in force:
Users authorized for Policy A can obtain protected data from Database 1 and Database 2. If the remote user is authorized for Policy C, then this user can obtain data from Database 3 as well.
This section explains how to use the replication option with tables protected by Oracle Label Security policies. It contains these topics:
Requirements for Creating Materialized Views Under Oracle Label Security
How to Refresh Materialized Views
See Also:
For a complete explanation of replication in Oracle Database 11g Release 1 (11.1) and how to set up the replication environment, refer to Oracle Database Advanced Replication.
For general information about using materialized views, refer to Oracle Database Concepts andOracle Database Data Warehousing Guide.
This section introduces the use of replication under Oracle Label Security. It contains the following topics:
Replication Functionality Supported by Oracle Label Security
Row-Level Security Restriction on Replication Under Oracle Label Security
Oracle Label Security supports standard replication and Advanced Replication, including multimaster replication and updatable materialized views (snapshots).
Oracle Database uses materialized views for replicating data. A materialized view is a local copy of a local or remote master table that reflects a recent state of the master table.
As illustrated in Figure 13-4, "Use of Materialized Views for Replication", a master table is a table you wish to replicate, on a node that you designate as the master node. Using a dblink account (such as REPADMIN), you can create a materialized view of the table in a different database. (This can also be done in the same database, and on the same system.) You can select rows from the remote master table, and copy them into the local materialized view. Here, mvEMP represents the materialized view of table EMP, and mlog$_EMP represents the materialized view log.
Figure 13-4 Use of Materialized Views for Replication
In a distributed environment, a materialized view alleviates query traffic over the network and increases data availability when a node is not available.
An Oracle Label Security policy applies Row Level Security (RLS) to a table if READ_CONTROL is specified as one of the policy options. Problems occur if both of the following conditions are true:
The Oracle Label Security policy is applied to any table relevant to replication (such as the master table, materialized view, or materialized view log), and
The policy returns a predicate in the WHERE clause of SELECT statements.
To avoid the additional predicate (and therefore avoid this problem), the users involved in a replication environment should be given the necessary Oracle Label Security privileges. To be specific, the designated users in the database link (such as REPADMIN and the materialized view owner) must have the READ or the FULL privilege. As a result, the queries used to perform the replication will not be modified by RLS.
See Also:
Oracle Database ConceptsThis section discusses the contents of materialized views.
Oracle Label Security performs the following steps when creating materialized views. These steps determine the contents of the view.
It reads the definition of the master table in the remote database.
It reads the rows in the master table that meet the conditions defined in the materialized view definition.
It writes these rows to the materialized view in the local database.
Because Oracle Label Security writes only those rows to which you have write access in the local database, the contents of the materialized view vary according to:
The policy options in effect
The privileges you have defined in the local database
The session label
If you read all of the rows in the master table and have write access in the local database to each label in the materialized view, then the result is a complete materialized view of the master table. To ensure that the materialized view is complete, ensure that you have read access to all of the data in the master table and write access in the local database to all labels at which data is stored in the master table.
Note:
Never revoke privileges that you granted when you created the materialized view. If you do, then you may not be able to perform a replication refresh.A partial materialized view is created when you specify a WHERE clause in the materialized view definition. This is a convenient way to pass subsets of data to a remote database.
Note:
To create a partial materialized view, you must have write access to all the rows being replicated.Requirements for creating a materialized view depend on the type of materialized view you are creating.
Requirements for Creating Partial Multilevel Materialized Views
Requirements for Creating Complete Multilevel Materialized Views
Requirements for the REPADMIN account vary depending on the configuration. In general, however, it should meet the following requirements:
It must have the FULL Oracle Label Security privilege (mandatory for all configurations).
It must have the SELECT privilege on the master table.
It must be the account that establishes the database link from the remote node to the database containing the master table.
See Also:
Oracle Database Advanced ReplicationRemember that the privileges belonging to the owner of the materialized view are used during the refresh of the materialized view. If these privileges are not sufficient, then there are two options:
The materialized view can be created in the REPADMIN account, or
Additional privileges must be granted to the owner of the materialized view.
Consider, for example, the following materialized view created by user SCOTT:
CREATE MATERIALIZED VIEW mvemp as SELECT * FROM EMP@link_to_master WHERE label_to_char(sa_label) = 'HS';
Here, SCOTT should have permission to insert records at the HS level in the local database. If Oracle Label Security policies are applied on the materialized view, then SCOTT must have the FULL privilege to avoid the RLS restriction.
Different configurations can be set up depending on whether Oracle Label Security policies are applied on the materialized view, what privileges are granted to the owner of the materialized view, and so on. If Oracle Label Security policies are applied to the materialized view, but SCOTT should not be granted the FULL privilege, then the REPADMIN account must be used to create the materialized view. SCOTT can then be granted the SELECT privilege on that table.
If no policies are applied to the materialized view, then the view can be created in SCOTT's schema without any additional privileges. In this case, the materialized view should be created in such a way that a WHERE condition limits the records to those which SCOTT can read.
Finally, if SCOTT can be granted the FULL privilege, then the materialized view can be created in SCOTT's schema, and Oracle Label Security policies can also be applied on the materialized view.
Note that the master table can have Oracle Label Security policies containing any set of policy options. If SCOTT has the FULL or the READ privilege, he can select all rows, regardless of policy options.
To create a partial materialized view that includes only some of the rows in a remote master table protected by Oracle Label Security, you must have sufficient privileges to WRITE in the local database at every label retrieved by your query.
To create a complete materialized view that includes every row in a remote master table protected by Oracle Label Security, you must be able to WRITE in the local database at the labels of all of the rows retrieved by the defined materialized view query.
If the contents or definition of a master table changes, then refresh the materialized view so that it accurately reflects the contents of the master table. To refresh a materialized view of a remote multilevel table, you must also have privileges to write in the local database at the labels of all of the rows that the materialized view query retrieves
Warning:
A materialized view can potentially contain outdated rows if you refresh a partial or full materialized view but do not have READ access to all the rows in the master table, and consequently do not overwrite the rows in the original materialized view with the updated rows from the master table.
To ensure an accurate materialized view refresh, use the optional materialized view background processes, SNPn, to refresh the views automatically. These processes must have sufficient privileges both to read all of the rows in the master table and to write those rows to the materialized view, ensuring that the view is completely refreshed. Remember that the privileges used by these processes are those of the materialized view owner.
See Also:
For information about SNPn background processes, refer to Oracle Database Administrator's Guide
