About Authorizing Application Users Using ACLs
Authorization is another main security feature needed by applications. In Real Application Security, the authorization policy comprises of the Access Control Lists (ACLs) and the application privileges. They are defined in the Real Application Security database and managed in a cache in the middle tier. The application privileges are data privileges. Data privileges are used to define the access of a function or operation to data. Once a function attaches a connection to the session, any query passed through the connection is automatically enforced by the database server.
The AclId class provides various methods to perform the following:
Constructing an ACL Identifier
To construct an Access Control List (ACL) identifier, use one of the overloaded parameterized constructors of the AclId class (see Example: How to Construct an ACL Identifier). If you want to construct an ACL identifier from raw binary data, then use the following constructor:
public AclId(byte[] raw)When you invoke this constructor, an ACL identifier, using raw binary returned from the ora_get_aclids operator of a query, is created.
If you want to construct an ACL identifier from internal ACL identifiers, then use the following constructor:
public AclId(java.util.List<java.lang.Long> ids)When you invoke this constructor, it creates an ACL identifier using internal ACL identifiers.
Example: How to Construct an ACL Identifier
Session lws = null;
static byte[] aclRaw;
...
AclId id = new AclId(aclRaw);
boolean ret = lws.checkAcl(aclRaw, "UPDATE_INFO");
...Using the checkAcl Method
To check one or more ACLs for specified data privileges, use the checkAcl method of the XSAccessController class. The data privileges are checked against one or more ACLs defined in the AclId object. The checkAcl method returns true only when all the data privileges are granted in the ACLs. It is important to note that all privileges need not be granted in a single ACL. A session is needed for using the checkAcl method as Example: How to get an ACL for a Specified Data Privilege indicates.
Example: How to get an ACL for a Specified Data Privilege demonstrates how to get the ACL associated with data privilege privileges22.
Example: How to get an ACL for a Specified Data Privilege
boolean ret;
Session lws = null;
AclId id2 = new AclId(ids);
List <String> privileges22 = new ArrayList<String>();
...
ret = XSAccessController.checkAcl(lws, id2, privileges22);About Getting Data Privileges Associated with a Specific ACL
To get a collection of data privileges that are granted in the given ACL, for the given session, use the getPrivileges method of the Session class.
Note: You use the checkAcl method for data security and the checkPrivilege method for function security.