1. Index

Index

A  C  D  E  F  G  I  J  M  N  O  P  R  S  T  U  V  W  X  

A

  • access control entry (ACE)
  • access control lists (ACL)
    • about 1.2.6
    • directories
      • trace files, using to resolve predicate errors 5.4.3
    • dynamic data realm constraints
    • evaluation order 5.6.3
    • static data realm constraints
      • ACL evaluation order 5.6.3
    • static data realms
    • user-managed
  • ACE
  • acl
  • ACL
  • ACLS
    • See: access control lists
  • ACLs and ACEs
  • aggregate privilege
  • ALL_XDS_ACL_REFRESH view 9.54
  • ALL_XDS_ACL_REFSTAT view 9.55
  • ALL_XDS_LATEST_ACL_REFSTAT view 9.56
  • ALL_XS_ACES view 9.29
  • ALL_XS_ACL_PARAMETERS view 9.41
  • ALL_XS_ACLS view 9.26
  • ALL_XS_APPLIED_POLICIES view 9.46
  • ALL_XS_COLUMN_CONSTRAINTS view 9.44
  • ALL_XS_IMPLIED_PRIVILEGES view 9.16
  • ALL_XS_INHERITED_REALMS view 9.38
  • ALL_XS_POLICIES view 9.32
  • ALL_XS_PRIVILEGES view 9.13
  • ALL_XS_REALM_CONSTRAINTS view 9.35
  • ALL_XS_SECURITY_CLASS_DEP view 9.23
  • ALL_XS_SECURITY_CLASSES view 9.20
  • ALL grant 4.1.1.1
  • ALL privilege 4.1.1.1
  • anonymous user 7.1
  • application integration
    • support for external users and roles 7.1
  • application privileges
    • about 1.2.3
    • granting to principles 2.4
  • application roles
  • application sessions
  • application sessions in the database
    • architecture figure 3.1.1
  • application user roles
    • application sessions, disabling from 3.3.8
    • application sessions, enabling for 3.3.7
    • disabling for specified session 11.1.4.13
    • enabling for specified session 11.1.4.12
  • application users
  • application users and roles
  • applying
    • additional application privileges
      • to a column 5.5
  • assigning
    • an application user to an anonymous application session 3.2.5
  • attaching
    • an application session 3.2.3
  • auditing
    • DBA_XS_AUDIT_POLICY_OPTIONS view 1.6
    • DBA_XS_AUDIT_TRAIL view 1.6
    • DBA_XS_ENB_AUDIT_POLICIES view 1.6
    • in an Oracle Database Real Application Security environment 1.6
    • unified auditing 1.6, 9
  • authentication

C

  • callback event handler procedure
  • checking
    • ACLs for a privilege 4.3.5
  • checking security attribute
    • using getSecurityAttribute method
      • SecurityAttribute returns value ENABLED B.2.1
      • SecurityAttribute returns value NONE B.2.1
      • SecurityAttribute returns value UNKNOWN B.2.1
  • checking user authorization indicator
    • using getAuthorizationIndicator method
      • AuthorizationIndicator returns value NONE B.2.2
      • AuthorizationIndicator returns value UNAUTHORIZED B.2.2
      • AuthorizationIndicator returns value UNKNOWN B.2.2
  • COLUMN_AUTH_INDICATOR function 10.1
  • column authorization
    • JDBCI interface B.2
    • OCI interface B.1
  • column-level security 5.5
  • configuring
    • an application role 2.2.3
    • application roles 2.2
    • application users 2.1
    • application user switch
      • proxying an application user 2.1.5
    • global callback event handlers
      • for an application session 3.2.8
  • constraining ACL inheritance
  • cookies
    • application sessions, setting for 3.2.4
  • create views
    • using BEQUEATH clause 5.9
  • creating

D

  • database role
  • database user
  • data realm constraints
    • affect on database tables 5.6.2
    • membership methods 5.4.1
    • membership rule (WHERE predicate)
    • membership rules
      • session variables, guideline for 5.4.1
    • parameterized
    • types defined by WHERE predicates 5.4.1
  • data realms 5.4.2
    • See also: dynamic data realms, static data realms
  • data security
    • about 5.1
    • ACLs 4.4
    • automatic refreshment for static ACL 11.5.3.1
    • troubleshooting D.2.5
    • with Oracle Database Real Application Security 1.2.1
  • data security documents
    • example 5.3
    • privileges
      • security checks, how handled 5.8.1
    • privileges, column-level security 5.5
  • DataSecurity module 4.4.1
  • data security policy
  • data security privileges
  • DBA_XDS_ACL_REFRESH view 9.57
  • DBA_XDS_ACL_REFSTAT view 9.58
  • DBA_XDS_LATEST_ACL_REFSTAT view 9.59
  • DBA_XS_ACES view 4.3.1, 4.3.11, 9.27
  • DBA_XS_ACL_PARAMETERS view 9.39
  • DBA_XS_ACLS view 4.3.11, 9.24
  • DBA_XS_ACTIVE_SESSIONS view 9.49
  • DBA_XS_APPLIED_POLICIES view 9.45
  • DBA_XS_AUDIT_POLICY_OPTIONS view 1.6, 9
  • DBA_XS_AUDIT_TRAIL view 1.6, 9
  • DBA_XS_COLUMN_CONSTRAINTS view 9.42
  • DBA_XS_DYNAMIC_ROLES view 9.8
  • DBA_XS_ENB_AUDIT_POLICIES view 1.6, 9
  • DBA_XS_EXTERNAL_PRINICIPALS view 9.3
  • DBA_XS_IMPLIED_PRIVILEGES view 9.14
  • DBA_XS_INHERITED_REALMS view 9.36
  • DBA_XS_MODIFIED_POLICIES view 9.47
  • DBA_XS_NS_TEMPLATE_ATTRIBUTES view 9.53
  • DBA_XS_NS_TEMPLATES view 9.52
  • DBA_XS_OBJECTS view 9.1
  • DBA_XS_POLICIES view 9.30
  • DBA_XS_PRINICIPALS view 9.2
  • DBA_XS_PRIVILEGE_GRANTS view 9.17
  • DBA_XS_PRIVILEGES view 4.3.12, 9.11
  • DBA_XS_PROXY_ROLES view 9.9
  • DBA_XS_REALM_CONSTRAINTS view 9.33
  • DBA_XS_ROLE_GRANTS view 9.10
  • DBA_XS_ROLES view 9.7
  • DBA_XS_SECURITY_CLASS_DEP view 4.3.12, 9.21
  • DBA_XS_SECURITY_CLASSES view 4.3.12, 9.18
  • DBA_XS_SESSION_NS_ATTRIBUTES view 9.51
  • DBA_XS_SESSION_ROLES view 9.50
  • DBA_XS_SESSIONS view 9.48
  • DBA_XS_USERS view 9.4
  • DBMS_XS_SESSIONS PL/SQL package
  • default security class
  • defining a basic data security policy
    • implementation tasks 5.10.1
      • disable a data security policy for a table 5.10.1.6
    • use case 5.10
  • deleting
    • namespaces
      • in application session 3.3.6
  • destroying
  • detaching
    • application session
      • from a traditional database session 3.2.10
  • determining
    • invoker’s rights use for nested program units
      • using BEQUEATH clause when creating views 5.9
    • the invoking application user
      • using SQL functions 5.9.1
  • direct application user accounts
    • setting password verifiers 2.1.3.3
  • disabling
    • application roles
      • for an application session 3.3.8
  • displaying secure column values
    • using SQL*Plus SET SECUREDCOL command 5.8.2
  • dynamic application role 2.2.2.2
  • dynamic application roles
  • dynamic data realm constraints

E

  • enabling
    • application roles
      • for application session 3.3.7
  • event-based tracing
  • event handlers 11.1.4.20
    • See also: global callback events
  • examples
    • JDBC
      • security attributes, checking B.2.3
      • user authorization, checking B.2.3
    • OCI return codes B.1.1
    • Real Application Security policy on master-detail related tables 5.7.3
  • exception dumps D.3
  • exception state dumps D.1.4
  • extending ACL inheritance
  • external roles 7.1
  • external users 7.1
    • namespaces for 7.2.1
    • session modes 7.1
      • secure mode 7.1
      • trusted mode 7.1
  • external users and external roles
    • createSession method 7.2.2
    • for application integration 7.1
    • session APIs for 7.2

F

  • firewall 4.3.6
  • foreign_key
    • specifies foreign key of detail table 5.7.2

G

  • getting
    • session attributes
      • in application session 3.3.4
  • global callback events
  • granting
    • application privileges to principles 2.4
    • application role
      • to existing application user 2.4.1.2
      • to new application role 2.4.2
      • to new application user 2.4.1.1
    • database role
      • to an application role 2.4.3

I

  • inheritance
    • master-detail related tables 5.7.1
  • inheritedFrom element, components 5.7.2
  • initializing
    • namaspace
    • namespace 3.3.2.3
      • application user is switched in application session 3.3.2.4
      • when session is created 3.3.2.1
    • namespaces
  • in-memory tracing D.1.6

J

  • Java environment
    • aborting a session 7.2.5
    • assigning a user to a session 7.2.4
    • assigning or switching an application user 6.2.3
    • attaching an application session 7.2.3
      • external role behavior 7.2.3
    • attachng an application session 6.2.2
    • authenticating users using Java APIs 6.3
    • authorizing application users using ACLs 6.4
    • changing the middle-tier cache size 6.1.3
      • clearing the cache 6.1.3.6
      • getting the maximum cache idle time 6.1.3.3
      • getting the maximum cache size 6.1.3.4
      • removing entries from the cache 6.1.3.5
      • removing entries from the cache, getting the high watermark for cache 6.1.3.5.2
      • removing entries from the cache, getting the low watermark for cache 6.1.3.5.3
      • removing entries from the cache, setting the watermark 6.1.3.5.1
      • setting the maximum cache size 6.1.3.2
      • setting the middle-tier cache idle time 6.1.3.1
    • checking if application role is enabled 6.2.4.3
    • constructing an ACL identifier 6.4.1
    • creating an application session 7.2.2
    • creating a session namespace attribute 6.2.5.4.1
    • creating a user session 6.2.1
    • creating namespaces 6.2.5.1
    • deleting namespaces 6.2.5.2
    • deleting session namespace attributes 6.2.5.4.6
    • destroying an application session 6.2.9
    • detaching an application session 6.2.8
    • disabling application roles 6.2.4.2
    • enabling and disabling application roles 6.2.4
    • enabling application roles 6.2.4.1
    • getting a session namespace attribute 6.2.5.4.3
    • getting data privileges associated with a specific ACL 6.4.3
    • getting the application user ID for the session 6.2.7.2
    • getting the Oracle connection associated with the session 6.2.7.1
    • getting the session cookie 6.2.7.5
    • getting the session ID for the session 6.2.7.3
    • getting the string representation of the session 6.2.7.4
    • implicitly creating namespaces 6.2.5.3
    • initializing the middle tier 6.1
      • mid-tier configuration mode 6.1.1
      • privileges for the session manager 6.1.2
      • roles for the session manager 6.1.2
      • using getSessionManager method 6.1.2
    • listing session namespace attributes 6.2.5.4.4
    • performing namespace operations as session manager 6.2.6
    • performing namespace operations as session user 6.2.5
    • resetting session namespace attributes 6.2.5.4.5
    • saving a session 7.2.5
    • setting a session namespace attribute 6.2.5.4.2
    • setting session cookie as session manager 6.2.7.7
    • setting session inactivity timeout as session manager 6.2.7.6
    • using namespace attributes 6.2.5.4
    • using the checkAcl method 6.4.2
  • JDBC
    • column authorization, interface for B.2

M

  • master detail data realm
    • foreign_key
      • specifies foreign key of detail table 5.7.2
    • parentObjectName element
      • specifies name of master table 5.7.2
    • parentSchemaName element
      • specifies name of schema containing master table 5.7.2
    • primary_key
      • specifies primary key from master table 5.7.2
    • when element
      • specifies a predicate for detail table 5.7.2
  • master-detail tables
    • ACL
      • identifiers, retrieving 10.4
    • inheritedFrom element, components 5.7.2
    • Real Application Security policies
  • Materialized View 5.4.2
  • membership rules (WHERE predicate) in data realm constraints
  • membership rules in data realm constraints
    • session variables, guideline for 5.4.1
  • modifying
  • multilevel authentication 4.3.6

N

O

  • OCI parameter handle attribute
    • OCI_ATTR_XDS_POLICY_STATUS B.1.4
      • OCI_XDS_POLICY_ENABLED value B.1.4
      • OCI_XDS_POLICY_NONE value B.1.4
      • OCI_XDS_POLICY_UNKNOWN value B.1.4
  • OCI return codes
    • ORA-24530
      • column value is unauthorized to the user B.1.1
    • ORA-24531
      • column value authorization is unknown B.1.1
    • ORA-24536
      • column authorization unknown B.1.1
  • ORA_CHECK_ACL function 10.3, D.1.3
  • ORA_CHECK_PRIVILEGE function 10.5
  • ORA_GET_ACLIDS function
    • See: ORA_GET_ACLIDS function
  • ORA_INVOKING_USER function
    • returns name of current database user 5.9.1
  • ORA_INVOKING_USERID function
    • returns ID of current database user 5.9.1
  • ORA_INVOKING_XS_USER_GUID function
    • returns ID of current Real Application Security application user 5.9.1
  • ORA_INVOKING_XS_USER function
    • returns name of current Real Application Security application user 5.9.1
  • ORA-24530
    • column value is unauthorized to the user
  • ORA-24531
    • column value authorization is unknown
  • ORA-24536
    • column authorization unknown
  • ORA-28113((colon)) policy predicate has error message 5.4.3
  • oracle.jdbc.OracleResultSetMetaData interface
    • getAuthorizationIndicator method
    • getSecurityAttribute method
  • Oracle Call Interface (OCI)
    • column authorization, interface for B.1
  • Oracle Database Real Application Security
    • about data security 1.2.1
    • access control entry (ACE) 1.2.5
    • access control list (ACL) 1.2.6
    • advantages of 1.1.2
    • aggregate privilege 1.2.3
    • application privileges 1.2.3
    • application session concepts 1.3
    • architecture 1.1.3
    • data security concepts 1.2
    • data security policy 1.2.7
    • flow of design and development 1.4
    • principals
    • security classes 1.2.4
    • security components of 1.1.3
    • use case scenario example policy 1.5
      • component requirements 1.5.2
      • description and security requirements 1.5.1
      • implementation overview 1.5.2
    • what is 1.1
  • Oracle Label Security
    • context established during attach session 2.1.3.4
    • context established in application session 3.2.3
    • context established in named user’s application session 3.2.5
    • context switches to target_user session 3.2.6
  • Oracle Virtual Private Database (VPD)
    • extended for Real Application Security 5.1

P

  • parameterized ACL 4.4.2
  • parameterized data realm constraints
  • parentObjectName element
    • specifies name of master table 5.7.2
  • parentSchemaName element
    • specifies name of schema containing master table 5.7.2
  • password verifiers
    • direct application user accounts 2.1.3.3
  • PL/SQL functions
    • COLUMN_AUTH_INDICATOR 10.1
    • XS_SYS_CONTEXT 10.2
  • pluggable databases
    • Oracle Real Application Security support for 1.7
  • predefined objects
  • primary_key
    • specifies primary key from master table 5.7.2
  • principals
  • privileges
    • about application 1.2.3
    • check 4.3.5
    • constrain 4.3.10.2
    • data security documents
      • columns, applying additional to 5.5
      • security checks, how handled 5.8.1

R

S

  • scope, ACL
  • security class
    • about 1.2.4
    • adding parent|security class
    • configuration 4.2
    • create 4.2.2
    • definition 4.2.1
    • inheritance 4.2.2
    • inheritance|security class
    • manipulating 4.2.6
    • troubleshooting D.2.3
  • session 3
    • See also: application sessions
  • Session
  • session cookie
  • SessionNamespace
  • session privilege scoping through ACL 3.5
  • session service
    • application configuration of the session filter 8.5
    • authorization (checkACL) 8.2
    • check privilege API 8.7.4
    • deployment 8.4
    • domain configuration 8.6
    • namespace APIs 8.7.3
    • namespace operations 8.2
    • Oracle Platform Security Service (OPSS) 8
    • privilege elevation 8.2
    • privilege elevation API 8.7.2
    • Real Application Security servlet filter 8.2
    • session APIs 8.2, 8.7.1
    • session filter 8.3
    • session filter operation 8.3.1
    • supports JavaEE web application
      • using OPSS as application security provider 8
  • SET SECUREDCOL command
    • SQL*Plus
      • displaying secure column values 5.8.2
  • setting
    • a cookie for an application session 3.2.4
    • password verifiers 2.1.3.3
    • session attributes
      • in application session 3.3.3
  • SQL functions
    • ORA_CHECK_ACL 10.3, D.1.3
    • ORA_CHECK_PRIVILEGE 10.5
    • ORA_INVOKING_USER
      • returns name of current datanase user 5.9.1
    • ORA_INVOKING_USERID
      • returns ID of current database user 5.9.1
    • ORA_INVOKING_XS_USER
      • returns name of current Real Application Security application user 5.9.1
    • ORA_INVOKING_XS_USER_GUID
      • returns ID of current Real Application Security application user 5.9.1
    • TO_ACLID 10.6
  • SQL operators
    • ORA_CHECK_ACL
      • checking ACLs for a privilege 4.3.5
  • static data realms
    • about 5.4.2
    • constraints
      • ACL evaluation order 5.6.3
  • statistics in troubleshooting D.1.7
  • switching
    • application users
      • in current application session 3.2.6
  • SYS_GET_ACLIDS function
    • See: ORA_GET_ACLIDS function
  • system-constraining ACL

T

  • tables
    • data security policy
    • master-detail tables, Real Application Security policies
  • time-out values
  • TO_ACLID function 10.6
  • trace files
    • acl D.2.4
    • application roles D.2.2
    • application sessions D.2.1
    • application users D.2.2
    • data security D.2.5
    • policy predicate errors 5.4.3
    • Real Application Security components D.2
    • security classes D.2.3
  • tracing
    • event and in-memory D.1.6
  • traditional security model
    • manging application users
  • troubleshooting
    • acl D.2.4
    • application principals D.2.2
    • application sessions D.2.1
    • data security D.2.5
    • event-based tracing
    • exception dumps D.3
    • exception state dumps D.1.4
    • in-memory tracing D.1.6
    • Real Application Security diagnostics D.1
    • security classes D.2.3
    • session statistics D.4
    • statistics D.1.7
    • using the ORA_CHECK_ACL function D.1.3
    • using the ORA_GET_ACLIDS function D.1.2
    • using validation APIs D.1.1

U

  • use case scenario example policy
    • human resources administration of employee information 1.5
      • component requirements 1.5.2
      • description and security requirements 1.5.1
      • implementation overview 1.5.2
    • Java implementation 6.5
      • authorizing with middle-tier API 6.5
      • main method 6.5
      • performing cleanup operations 6.5
      • running a query on the database 6.5
      • setting up connection 6.5
      • setting up session 6.5
  • USER_XDS_ACL_REFRESH view 9.60
  • USER_XDS_ACL_REFSTAT view 9.61
  • USER_XDS_LATEST_ACL_REFSTAT view 9.62
  • USER_XS_ACES view 9.28
  • USER_XS_ACL_PARAMETERS view 9.40
  • USER_XS_ACLS view 9.25
  • USER_XS_COLUMN_CONSTRAINTS view 9.43
  • USER_XS_IMPLIED_PRIVILEGES view 9.15
  • USER_XS_INHERITED_REALMS view 9.37
  • USER_XS_PASSWORD_LIMITS view 9.6
  • USER_XS_POLICIES view 9.31
  • USER_XS_PRIVILEGES view 9.12
  • USER_XS_REALM_CONSTRAINTS view 9.34
  • USER_XS_SECURITY_CLASS_DEP view 9.22
  • USER_XS_SECURITY_CLASSES view 9.19
  • USER_XS_USERS view 9.5
  • users 2.1.1.1
    • See also: application users
  • user sessions 3
    • See also: application sessions
  • using
    • constraining application privilege 4.3.10.2
    • effective dates with application roles 2.3
    • multilevel authentication 4.3.6
    • ORA_CHECK_ACL SQL operator 4.3.5
    • SQL functions
      • to determine the invoking application user 5.9.1
    • XS_DIAG.VALIDATE_PRINCIPAL function 2.1.6, 2.2.3.3

V

  • V$XS_SESSION_NS_ATTRIBUTES view 9.63
  • V$XS_SESSION_ROLES view 9.64
  • validating
  • views 9
    • ALL_XDS_ACL_REFRESH 9.54
    • ALL_XDS_ACL_REFSTAT 9.55
    • ALL_XDS_LATEST_ACL_REFSTAT 9.56
    • ALL_XS_ACES 9.29
    • ALL_XS_ACL_PARAMETERS 9.41
    • ALL_XS_ACLS 9.26
    • ALL_XS_APPLIED_POLICIES 9.46
    • ALL_XS_COLUMN_CONSTRAINTS 9.44
    • ALL_XS_IMPLIED_PRIVILEGES 9.16
    • ALL_XS_INHERITED_REALMS 9.38
    • ALL_XS_POLICIES 9.32
    • ALL_XS_PRIVILEGES 9.13
    • ALL_XS_REALM_CONSTRAINTS 9.35
    • ALL_XS_SECURITY_CLASS_DEP 9.23
    • ALL_XS_SECURITY_CLASSES 9.20
    • DBA_XDS_ACL_REFRESH 9.57
    • DBA_XDS_ACL_REFSTAT 9.58
    • DBA_XDS_LATEST_ACL_REFSTAT 9.59
    • DBA_XS_ACES 9.27
    • DBA_XS_ACL_PARAMETERS 9.39
    • DBA_XS_ACLS 9.24
    • DBA_XS_ACTIVE_SESSIONS 9.49
    • DBA_XS_APPLIED_POLICIES 9.45
    • DBA_XS_COLUMN_CONSTRAINTS 9.42
    • DBA_XS_DYNAMIC_ROLES 9.8
    • DBA_XS_EXTERNAL_PRINCIPALS 9.3
    • DBA_XS_IMPLIED_PRIVILEGES 9.14
    • DBA_XS_INHERITED_REALMS 9.36
    • DBA_XS_MODIFIED_POLICIES 9.47
    • DBA_XS_NS_TEMPLATE_ATTRIBUTES 9.53
    • DBA_XS_NS_TEMPLATES 9.52
    • DBA_XS_OBJECTS 9.1
    • DBA_XS_POLICIES 9.30
    • DBA_XS_PRINCIPALS 9.2
    • DBA_XS_PRIVILEGE_GRANTS 9.17
    • DBA_XS_PRIVILEGES 9.11
    • DBA_XS_PROXY_ROLES 9.9
    • DBA_XS_REALM_CONSTRAINTS 9.33
    • DBA_XS_ROLE_GRANTS 9.10
    • DBA_XS_ROLES 9.7
    • DBA_XS_SECURITY_CLASS_DEP 9.21
    • DBA_XS_SECURITY_CLASSES 9.18
    • DBA_XS_SESSION_NS_ATTRIBUTES 9.51
    • DBA_XS_SESSION_ROLES 9.50
    • DBA_XS_SESSIONS 9.48
    • DBA_XS_USERS 9.4
    • privileges in data security documents 5.8.1
    • USER_XDS_ACL_REFRESH 9.60
    • USER_XDS_ACL_REFSTAT 9.61
    • USER_XDS_LATEST_ACL_REFSTAT 9.62
    • USER_XS_ACES 9.28
    • USER_XS_ACL_PARAMETERS 9.40
    • USER_XS_ACLS 9.25
    • USER_XS_COLUMN_CONSTRAINTS 9.43
    • USER_XS_IMPLIED_PRIVILEGES 9.15
    • USER_XS_INHERITED_REALMS 9.37
    • USER_XS_PASSWORD_LIMITS 9.6
    • USER_XS_POLICIES 9.31
    • USER_XS_PRIVILEGES 9.12
    • USER_XS_REALM_CONSTRAINTS 9.34
    • USER_XS_SECURITY_CLASS_DEP 9.22
    • USER_XS_SECURITY_CLASSES 9.19
    • USER_XS_USERS 9.5
    • V$XS_SESSION_NS_ATTRIBUTES 9.63
    • V$XS_SESSION_ROLES 9.64

W

  • when element
    • specifies a predicate for detail table 5.7.2

X