Re: fine grain access control

In article <4e062d34.0204221431.45fe3a75_at_posting.google.com>, orclwzrd_at_yahoo.com says...
>
>I have fgac implemented in a database that I am attempting to tune. I
>have having great difficulty finding any documentation about how fgac
>effects the backend processing of a query. It appears that the
>predicate added by fgac does not appear in v$sqlarea. Why? and how
>does one over come this? Also, due to the fact that I now have an
>extra column in many tables for the sole purpose of fgac
>implementation, it appears that primary keys now need a column added
>to actually be primary keys again. Where is the documentation that
>discusses the back end impact of fgac? I'm sure that once illuminated
>by the light of day, that this is no big deal. Could I please have
>just a small morsel of information?
>
>Stumped Senior Tuner

You might be interested in

http://asktom.oracle.com/~tkyte/article2/index.html

and I have more in my book.

In any case, FGAC is 100% query augmentation. It is a replacement for the cludge of having a VIEW / role and having to log in as a role to get the right view. It is a method to put the security in the database instead of the application.

In order to tune, you have to look at every possible predicate (just as you would have for every possible view you would have created) and ask yourself "how will this perform?"

--
Thomas Kyte (tkyte@oracle.com)             http://asktom.oracle.com/ 
Expert one on one Oracle, programming techniques and solutions for Oracle.
http://www.amazon.com/exec/obidos/ASIN/1861004826/  
Opinions are mine and do not necessarily reflect those of Oracle Corp