Security Classes

Real Application Security provides the following predefined security classes and application privileges:

• DML - DML Privileges security class. If an ACL does not specify its security class, DML is the default security class for the ACL. See “DML Security Class” for more information. Contains the following common application privileges for object manipulation.

  • SELECT - Privilege to read an object.

  • INSERT - Privilege to insert an object.

  • UPDATE - Privilege to update an object.

  • DELETE - Privilege to delete an object.

• SYSTEM - System security class. Contains the following application privileges:

  • PROVISION - Privilege for updating principal documents from FIDM. The PROVISION privilege is also extended for creating, deleting, and modifying Real Application Security principals (users or roles) beginning in Release 12.2. This Real Application Security system privilege is intended to replace the traditional use of database create user, alter user privileges, and so forth to create and alter Real Application Security application users and roles.

  • CALLBACK - Privilege to register and update global callbacks.

  • ADMIN_ANY_SEC_POLICY - Privilege for any administrative operation.

  • ADMIN_SEC_POLICY - Privilege for administering objects in its own schema.

  • ADMIN_NAMESPACE - Privilege for administering any namespace.

• SESSION_SC - Session security class. Contains the following application privileges:

  • CREATE_SESSION - Privilege to create a Real Application Security user session.

  • TERMINATE_SESSION - Privilege to terminate a Real Application Security user session.

  • ATTACH_SESSION - Privilege to attach to a Real Application Security user session.

  • MODIFY_SESSION - Privilege to modify contents of a Real Application Security user session.

  • ASSIGN_USER - Privilege to assign user to an anonymous Real Application Security user session.

  • ADMINISTER_SESSION - Privilege for Real Application Security user session administration, aggregate of CREATE_SESSION, TERMINATE_SESSION, ATTACH_SESSION, MODIFY_SESSION, and SET_DYNAMIC_ROLES.

  • SET_DYNAMIC_ROLES - Privilege to protect Real Application Security enablement and disablement of a dynamic role as part of the attach session and assign user operations.

• NSTEMPLATE_SC - Namespace template security class. Contains the following application privileges:

  • MODIFY_NAMESPACE - Privilege to modify session namespace.

  • MODIFY_ATTRIBUTE - Privilege to modify session namespace attribute.

  • ADMIN_NAMESPACE - Privilege for namespace administration, aggregate of MODIFY_NAMESPACE and MODIFY_ATTRIBUTE.