Effective Dates for Application Users and Application Roles

You can specify effective dates for application users, application roles, and role grants. The application user or application role is available only within the period defined by the effective start and end date. Example: Setting Effective Dates for an Application User shows how effective dates are specified for an application user.

Example: Setting Effective Dates for Creating an Application Role shows how effective dates are specified for creating an application role.

Sometimes the effective date restriction does not need to be an attribute of an application user or application role. Instead, it is only needed to restrict the effective dates on a per role grant basis. In this case, you can specify beginning and ending effective dates for an application role grant. This only constrains that particular application role grant and allows for implementing fine-grained access control policy. Example: Setting Effective Dates for Granting the Application Role shows how effective dates are specified for granting an application role.

These are the most direct consequences of effective date restrictions:

If an application user is not currently effective (that is, within the period defined by its start and end date), the session for the particular application user cannot be created.
If an application role is not currently effective, the application role (and any descendants) is not be available to the application user in the session.
For application roles that are shared children of multiple application roles, the child application roles are available as long as there is at least one parent that is effective.
If the application role grant of an application role is not currently effective, the application role (and any descendants) is not available to the application user or application role to which it is granted.

Note: The effective dates should be used in the policy after a careful consideration of the nature of the restrictions that they impose on the use of application users and application roles.

Example: Setting Effective Dates for an Application User

sqlplus sec_mgr
Enter password: password
Connected.

DECLARE
 startDate TIMESTAMP := TO_TIMESTAMP (
      '2012-01-01 11:00:00','YYYY-MM-DD HH:MI:SS');
 endDate TIMESTAMP := TO_TIMESTAMP (
      '2013-01-01 11:00:00','YYYY-MM-DD HH:MI:SS');

BEGIN
  SYS.XS_PRINCIPAL.CREATE_USER
      (name        => 'lwuser1',
      start_date   => startDate,
      end_date     => endDate);
END;
/

Example: Setting Effective Dates for Creating an Application Role

sqlplus sec_mgr
Enter password: password
Connected.

DECLARE
 startDate TIMESTAMP := TO_TIMESTAMP ('2012-01-01 11:00:00','YYYY-MM-DD
 HH:MI:SS');
 endDate TIMESTAMP := TO_TIMESTAMP ('2013-01-01 11:00:00','YYYY-MM-DD
 HH:MI:SS');
BEGIN
  SYS.XS_PRINCIPAL.CREATE_ROLE
    (
     name => 'app_regular_role',
    enabled=>true,
     start_date => startDate,
     end_date => endDate);
END;
/

Example: Setting Effective Dates for Granting the Application Role

sqlplus sec_mgr
Enter password: password
Connected.

DECLARE
 startDate TIMESTAMP := TO_TIMESTAMP ('2012-01-01 11:00:00','YYYY-MM-DD
 HH:MI:SS');
 endDate TIMESTAMP := TO_TIMESTAMP ('2013-01-01 11:00:00','YYYY-MM-DD
 HH:MI:SS');
BEGIN
  SYS.XS_PRINCIPAL.GRANT_ROLES
    (grantee      => 'lwuser1',
     role         => 'app_regular_role',
     start_date   => startDate,
     end_date     => endDate);
END;
/