77 Configuring Exclusive Isolated Client Sessions for Virtual Private Database

Exclusive Isolated Client Session Configuration Overview

Table 77-1 lists the configurable options for isolated sessions.

Table 77-1 Configurable Options for Isolated Client Sessions

Option	Type	TopLink Workbench	Java
"Configuring Cache Isolation at the Descriptor Level"	Basic
"Configuring Connection Policy"	Basic
"PostAcquireExclusiveConnection Event Handler"	Basic
"PreReleaseExclusiveConnection Event Handler"	Basic
"NoRowsModifiedSessionEvent Event Handler"	Basic
"ValidationException Handler"	Basic

These options are used throughout the isolated session life cycle (see "Isolated Client Session Life Cycle").

PostAcquireExclusiveConnection Event Handler

TopLink raises this event after an exclusive connection is allocated to an isolated session after the user has logged in to the database with it.

If you are using Oracle Database proxy authentication (see "Oracle Database Proxy Authentication"), then you do not need to implement this session event handler.

If you are not using Oracle Database proxy authentication, then, as part of the isolated session life cycle, you must implement a SessionEventListener for SessionEvent.PostAcquireExclusiveConnection.

Note:

You must add this session event listener to the server session from which you acquire your isolated client session. You cannot add them to the isolated client session itself. For more information, see "Configuring Session Event Listeners"

Using Java

The SessionEvent.PostAcquireExclusiveConnection event listener is your opportunity to authenticate your user and interact with the underlying database platform: for example, to execute PL/SQL to create VPD packages and set VPD context information.

Example 77-1 illustrates a typical session event listener used to handle postAcquireExclusiveConnection events for an isolated session.

Example 77-1 Session Event Listener for an Isolated Session

class VPDEventListener extends SessionEventAdaptor{
    public void postAcquireExclusiveConnection(SessionEvent event){
        ClientSession session = (ClientSession)event.getSession();
        // Get property set on the ConnectionPolicy prior to acquiring the connection
        String userLevel = session.getConnectionPolicy().getProperty("userLevel");
        // Make the Stored Procedure call for VPD to set up the Context Information
        session.executeNonSelectingSQL("StoreProcSetContextUser("+ userLevel + ")");
    }
}

To get the required user credentials, use ClientSession method getConnectionPolicy to get the associated ConnectionPolicy, and then use ConnectionPolicy method getProperty. The ConnectionPolicy associated with the ClientSession should contain all required user credentials (see "Configuring Connection Policy").

After you implement the required SessionEventListener, add it to the parent server session from which you acquire your isolated client session. For more information, see "Configuring Session Event Listeners".

PreReleaseExclusiveConnection Event Handler

TopLink raises a SessionEvent.PreReleaseExclusiveConnection event after you call the isolated session method release.

If you are using Oracle Database proxy authentication (see "Oracle Database Proxy Authentication"), then you do not need to implement this session event handler.

If you are not using Oracle Database proxy authentication, then as part of the isolated session life cycle, you must implement a SessionEventListener for SessionEvent.PreReleaseExclusiveConnection.

Note:

You must add this session event listener to the server session from which you acquire your isolated client session. You cannot add them to the isolated client session itself. For more information, see "Configuring Session Event Listeners"

Using Java

The SessionEvent.PreReleaseExclusiveConnection event listener gives you an opportunity to interact with the underlying database platform: for example, to perform any VPD-specific cleanup such as executing PL/SQL to delete VPD packages or context information.

Example 77-1 illustrates a typical session event listener used to handle preReleaseExclusiveConnection events for an isolated session.

Example 77-2 Session Event Listener for an Isolated Session

class VPDEventListener extends SessionEventAdaptor{
    public void preReleaseExclusiveConnection(SessionEvent event){
        Session session event.getSession();
        // Make the Stored Procedure call for VPD to reset the Context Information
        session.executeNonSelectingSQL("StoreProcResetContext()");
    }
}

To get the required user credentials, use ClientSession method getConnectionPolicy to get the associated ConnectionPolicy, and then use ConnectionPolicy method getProperty. The ConnectionPolicy associated with the ClientSession should contain all required user credentials (see "Configuring Connection Policy").

After you implement the required SessionEventListener, add it to the parent server session, from which you acquire your isolated client session. For more information, see "Configuring Session Event Listeners".

NoRowsModifiedSessionEvent Event Handler

As part of your general error handling strategy, you should implement a SessionEventListener for SessionEvent.NoRowsModifiedSessionEvent.

TopLink raises this event when an update or delete query is executed against the database, but no rows are updated, that is, a zero row count is returned.

If optimistic locking is not enabled and you query the database and violate your VPD security configuration, no exception is thrown: the query simply returns zero rows updated.

If optimistic locking is enabled and you query the database and violate your VPD security configuration, an OptimisticLockException is thrown even though the root cause of the failure was a security violation, not an optimistic locking issue.

Note:

You must add this session event listener to the server session from which you acquire your isolated client session. You cannot add them to the isolated client session itself. For more information, see "Configuring Session Event Listeners"

Using Java

This event listener gives you an opportunity to determine whether the update failure was due to a security violation (in which case you should not retry the operation), or due to an optimistic lock issue (in which case a retry may be appropriate).

You can use the existing session event API, such as getQuery().getResult(), to get the affected object, if any.

After you implement the required SessionEventListener, add it to the parent server session, from which you acquire your isolated client session. For more information, see "Configuring Session Event Listeners".

ValidationException Handler

As part of your general error handling strategy, your application should be prepared to handle a ValidationException of type ISOLATED_SESSION_IS_NO_LONGER_AVAILABLE.

TopLink throws an ISOLATED_SESSION_IS_NO_LONGER_AVAILABLE when a client triggers the indirection on an isolated object when the isolated session used to load that object is no longer available, that is, after you call the isolated session method release.

Fore more information, see: