Perl Cd Bookshelf [Electronic resources] نسخه متنی

Security Management

In Oracle XML Database 10g, security should be set up to protect against unauthorized access of data and any XML processes that could affect database system operations.

Protecting Data in the Oracle XML DB Repository

The security for the Oracle XML DB resources is based on an ACL, which is a standard security mechanism used in Java, Windows NT, and other systems. The ACL maintains a list of objectlevel restrictions on database users or roles to access the resources in the Oracle XML DB Repository hierarchy.

Before a user performs an operation or method on a resource, a check of privileges for the user on the resource takes place. The set of privileges checked depends on the operation or method performed. For example, to update the Oracle XML DB configurations, READ and WRITE privileges are needed for the xdbconfig.xml resource.

Data access is controlled by the ACL document that specifies the database users, roles, and groups who are able to access certain resources. The default ACL includes the following:

all_all_acl.xml Grants all privileges to all users

all_owner_acl.xml Grants all privileges to owner/creator user

ro_all_acl.xml Grants read privileges to all users

The DBMS_XDBZ PL/SQL package provides the APIs to check and update the ACL in the Oracle XML DB Repository. The following example shows how you can create a user group and set up the ACL for the group to access the Oracle XML DB Repository. The access privilege for each principal, who can be a user or a role, is stored in access control entries (ACEs) in the ACL:

 CREATE USER USER1 IDENTIFIED BY USER1; 
GRANT CONNECT, RESOURCE TO USER1; 
CREATE USER USER2 IDENTIFIED BY USER2; 
GRANT CONNECT, RESOURCE TO USER2; 
CREATE ROLE DEMOGROUP NOT IDENTIFIED; 
GRANT CONNECT, RESOURCE to DEMOGROUP; 
GRANT DEMOGROUP to USER1; 
GRANT DEMOGROUP to USER2;  

By default, all file and directory resources created by a user are accessible to all database users. To limit these users to the group, DEMOGROUP, you first need to create a new ACL resource file and store it in the Oracle XML DB Repository as the file /sys/acls/all_demogroup_ acl.xml. The file looks like the following:

 <acl description="Private:All privileges to OWNER only"
xmlns="http://xmlns.oracle.com/xdb/acl.xsd"
xmlns:dav="DAV:" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.oracle.com/xdb/acl.xsd
http://xmlns.oracle.com/xdb/acl.xsd"> 
<ace>  
<principal>DEMOGROUP</principal> 
<grant>true</grant>  
<privilege>  
<all/> 
</privilege> 
</ace> 
</acl>  

The preceding ACL specifies grants of all privileges to the owner of the document using the ACE elements. Each ACE element specifies access privileges for a given principal using values set for the elements described in Table 12-3.

To have some resources to work with, you can connect as USER1 and create a folder in the Oracle XML DB Repository for User1:

DECLARE
retval BOOLEAN; 
BEGIN 
retval := DBMS_XDB.createfolder('/public/folder1'); 
retval := DBMS_XDB.createResource('/public/folder1/doc1.xml', XML
Type('<xml1/>'));  
END; /  

To confirm that User1 and User2 can currently view this resource, either use your FTP client to see the /public/folder1 directory or execute the following query while connected as each user:

 SELECT count(*) from RESOURCE_VIEW; 

Now you can restrict access to these resources by changing the ACL file to all_all_acl.xml by executing the following command:

BEGIN  
DBMS_XDB.SetACL('/public/folder1',
'/sys/acls/all_all_acl.xml'); 
COMMIT;  
END; /  

Once again check for resource access and count and you will see that User2 has fewer resources and no access to /public/folder1. If role/group ownership is in effect, both users could have the same number of accessible resources. You can do this by switching the ACL file again to all_demogroup_acl.xml by executing the following connected as SYS:

 BEGIN  
DBMS_XDB.SetACL('/public/folder1',  
'/sys/acls/all_demogroup_acl.xml'); 
COMMIT;  
END; 
/  

Using the same query, USER1 and USER2 now have the same number of accessible resources:

 SELECT count(*) from RESOURCE_VIEW; 

Each DBMS_XDB security management method takes a path (resource_path, abspath, or acl_path) as a parameter. You can then use any or all of the following DBMS_XDB methods to perform security management tasks:

getAclDocument()

ACLCheckPrivileges()

checkPrivileges()

getPrivileges()

changePrivileges()

setACL()

Oracle XML DB ACLs are cached for very fast evaluation. When a transaction that modifies an ACL is committed, the modified ACL is picked up after the time-out specified in the Oracle XML DB configuration file. The XPath for this configuration parameter is /xdbconfig/sysconfig/ acl-max-age.

Securing DBUri Operations

DBUri servlet security is handled by Oracle Database 10g by using roles. When users log in to the servlet, they use their database username and password. The servlet will check to make sure the user logging in belongs to one of the roles specified in the configuration file. The roles that are allowed to access the servlet are specified in the security-role-ref tag. By default, the servlet is available to the special role authenticatedUser. Any user with a valid database username and password belongs to this role and thus can use the servlet.

The parameter updated in the following example restricting the list of authenticated users can be changed to restrict access to any role(s) in the database. To change from the default authenticated-user role to a role that you have created, for example, servlet-users, run the following connected as a user with XDBADMIN role:

 DECLARE 
doc XMLType; 
doc2 XMLType; 
doc3 XMLType; 
BEGIN 
doc := dbms_xdb.cfg_get(); 
select updateXML(doc, '/xdbconfig
/sysconfig/protocolconfig/httpconfig/webappconfig 
/servletconfig/servlet-list/servlet[servlet-name="DBUriServlet"]  
/security-role-ref/role-name/text()', 'servlet-users') into doc2 
from dual; 
select updateXML(doc2, '/xdbconfig/sysconfig
/protocolconfig/httpconfig/webappconfig 
/servletconfig/servlet-list/servlet[servlet-name="DBUriServlet"]  
/security-role-ref/role-link/text()', 'servlet-users') into doc3 
from dual;  
DBMS_XDB.CFG_UPDATE(doc3); 
COMMIT;  
END; 
/