Re: Security problem

What Scott Kornheim is suggesting is certainly a way to enhance your application's security.

This isn't water tight though: if your end user can use client software that can issue the SET ROLE command, there is nothing at the server side that will stop this, and then the user will have all the privileges of the role.

So the security is in the user not having software which can issue this command or the user not being aware of this possibility.

A word on Oracle's own SQL*Plus: this program has a built in check to see if certain commands are allowed. You can disable commands (also SET ROLE) by inserting a record in table PRODUCT_USER_PROFILES (look at the chapter on Security in the SQL*PLUS manual), so for this program Scott Kornheim's solution can be made water tight.

Jaap.

Scott Kronheim heeft geschreven in bericht <389B1650.3AFAD0B3_at_synertechsystems.com>...
>Try this, I've used it successfully before:
>1. Grant all of the database object privileges required to run your
>application to a role.
>2. Revoke every user's explicit privileges to those database objects.
>3. Grant the new role to each user as a non-default role.
>4. Each time your application connects to the database, issue a "SET
>ROLE <new role name>" command.
>
>The privileges assigned to a non-default role are not utilized by a
>user's session until the SET ROLE command is issued. Therefore, when a
>user logs into the database using anything other than your application,
>they won't have privileges to do anything with your application
>objects. Also, the SET ROLE command has a session-level scope, so when
>your application disconnects from the database, the privileges
>disappear.
>
>-----
>Scott Kronheim
>
>
>Sex_appeal wrote:
>>
>> Hi,
>> ¿How can I avoid the user uses any application to access the database
>> instead my application?
>> I have some row level security tables, and I don't want to use views
>> (performance reasons), so I have to improve security at application
>> level, but If the users access the database with any other application
>> (like SQL explorer), they could get any information within the table.
>> ¿Is there any way to avoid it?
>>
>> Thanks!
Received on Sat Feb 05 2000 - 04:55:03 CST