Flow of Design and Development

You should be familiar with the concepts introduced in this chapter to take full advantage of Real Application Security.

In general, identify all tasks an application performs that require application privileges to control data access. Then, add the appropriate application privileges to a security class so that you can reference them in an ACL and grant them to the application users and application roles. This process involves these tasks:

• Create a default set of meaningful application roles based on the features the application provides.

• Identify the tables that require data security protection based on the application table design and security requirements, and define the data realms, including column protection.

• Define data security policies based on the application requirements and the rules applied on the tables.

• Ensure that ACLs used in the data security policy and functional security grant the appropriate application privileges to application roles.

This section contains:

• Design Phase

• Development Flow Steps

Design Phase

In the design phase, you identify all the tasks an application performs that require application privileges to control data access.

For example, during the design phase, the application policy designer must identify:

1. The set of application-level operations that require access control.

2. The rows and columns of tables and views that can be accessed as part of the application-level operations.

3. The set of actors or principals (users and roles) that can perform these operations.

4. The runtime application session attributes that identity rows of a table or views. These attribute names are used within the predicates that selects the rows to be authorized, and their values are set during the execution of the application.

Development Flow Steps

In the development phase, as the Real Application Security administrator, you use Real Application Security components to develop your data security policies.

Follow these steps to develop your data security policies:

1. Create the corresponding application users and roles. If using an external directory server, create the application users and roles or user groups in the directory server. Follow this procedure to create these principals natively in the database:

   1. Create the application roles and grant database roles to these application roles, if needed. See About Configuring Application Roles.

   2. Create the application users and grant application roles to the application users. See About Configuring Application Users.

2. Create each security class that you plan to use to develop the security policies for your application. Each security class consists of one or more appropriate privileges that you define and can reference in an ACL and also grant them to the application users and application roles. Each security class authorizes by means of ACLs the required application-level operations of a data security policy. See About Configuring Security Classes and About Configuring Access Control Lists.

3. Create one or more session namespaces that can be used across different application sessions. This consists of defining for a session namespace its set of properties (application attributes) and its associated access control policy or ACL that you can choose from a list or create. See About Manipulating the Application Session State.

4. Create the data security policy by associating each data realm with an ACL, so as to create both data realm authorization and column authorization as needed. See About Data Security.

   This process consists of four parts:

   1. Policy Information - You choose the object to be protected and the privilege class to protect it as well as specify the policy name and select the policy owner. See Understanding the Structure of the Data Security Policy.

   2. Column Level Authorization - You choose the name of the column to be protected and select the privilege to be granted to access the column, which is associated with the privilege class you selected in Step 4a. See Applying Additional Application Privileges to a Column.

   3. Data Realm Authorization - You create a SQL predicate to represent the data realm to be protected and add each to a data realm grant list. Then you choose or create the ACL to protect the data realm. See About Designing Data Realms.

   4. Apply Policy - You can apply, remove, enable, or disable the data security policy you are creating and choose to specify certain apply options, allowing the owner of the table or view to bypass this data security policy, and whether to enforce statement types for this policy. See About Enabling Data Security Policy for a Database Table or View.

See Also:

Scenario: Security Human Resources (HR) Demonstration of Employee Information that describes in detail how the development flow is implemented for an example policy scenario for the security human resources (HR) demonstration of employee information using the concepts and components of Real Application Security.