Overview of the Security HR Demo

This Human Resources (HR) Demonstration shows how to use basic Real Application Security (RAS) features. This tutorial is an end-to-end use case scenario. PL/SQL scripts, a Java program source file, and log files can be found in Real Application Security HR Demo Files.

The HR demo secures the HR.EMPLOYEE table by applying a data security policy that has three realms:

1. An employee’s own record realm. The ACL, EMP_ACL controls this realm, which grants application role employee privileges to access the realm, including the SALARY column.

2. All the records in the IT department realm. The ACL, IT_ACL controls this realm, which grants application role it_engineer privileges to access the realm, but excluding the SALARY column.

3. All the employee records realm. The ACL, HR_ACL controls this realm, which grants application role hr_representative privileges to access the realm, including the SALARY column.

The HR Demo defines two application users to demonstrate the effects of the policy:

• DAUSTIN, an application user in the IT department. He has application roles employee and it_engineer. So, he can access realm #1 and realm #2 mentioned previously; that is, he can view employee records in the IT department, but he cannot view the SALARY column, except for his own salary record.

• SMAVRIS, an application user in HR department. She has application roles employee and hr_representative. So, she can access realm #1 and realm #3 mentioned previously; that is, she can view and update all the employee records.

The HR Demo scripts show:

• How to create Real Application Security objects: application user, application role, ACL, security class, and data security policy.

• How to use the data security policy to secure rows (using realm constraints) and columns (using a column constraint) of a table.

• How to directly logon to a database with application users (requiring a password), and how to create, attach, detach, and destroy a Real Application Security session.

• How to enable and disable an application role in a Real Application Security session.