Table of Contents

• Title and Copyright Information
• Preface
  • Audience
  • Conventions
• Changes in This Release for Oracle Deep Data Security
• Part I Understand Oracle Deep Data Security
  • Introduction to Oracle Deep Data Security
    • What Is Oracle Deep Data Security
      • The Deep Sec Authorization Model
      • Core Capabilities
    • Why Choose Oracle Deep Data Security
      • The Security Challenge in Agentic AI
      • Limitations of Existing Access Control Methods
      • The Deep Data Security Solution
  • Oracle Deep Data Security Fundamentals
    • Key Terminology
    • Fine-Grained Data Authorization
      • Architectural Overview
      • About Data Grants and Security Context
      • Row and Column Controls
      • Access Check Functions
      • Mandatory Access Control
    • Application Registrations, Users, and Roles
      • Data Access Patterns
        • End Users Connect Directly to the Database
        • Applications Log On as Application Identities
        • Applications or AI Agents Access the Database on Behalf of End Users
        • End Users Operate in the Context of an Application or AI Agent
      • Application Registrations in IAM
      • User and Role Management in IAM
      • User and Role Management in the Database
        • Entity Types
        • SQL Quick Reference
    • End-User Security Context
      • Components of the Security Context
      • The Security Context Life Cycle
      • End-User Contexts and Attributes
      • Privilege Elevation
• Part II Quick Starts: Configure Oracle Deep Data Security
  • Configure Oracle Deep Data Security for Direct Logon with Local End Users
    • Before You Begin
    • Create Sample Data
    • Create Local End Users
    • Configure Data Roles
    • Configure Data Access Control
    • Validate Data Access Control
  • Configure Oracle Deep Data Security for Direct Logon with End Users in Microsoft Entra ID
    • Before You Begin
    • Create Application Registrations in Microsoft Entra ID
      • Register the Database Resource
      • Register the Client Application
    • Manage Users and Role Assignments in Microsoft Entra ID
    • Generate Wallets and Certificates
    • Configure the Database Listener
    • Configure the Client for Interactive Sign-In
    • Configure Data Access Control
    • Validate User Connections and Data Access Control
  • Configure Oracle Deep Data Security for a Sample Application
    • Concept and Architecture
    • Before You Begin
    • Create Application Registrations in Microsoft Entra ID
      • Register the Database Resource
      • Register the Spring Boot Application
    • Manage Users and Role Assignments
    • Generate Wallets and Certificates
    • Configure Database Network Settings
    • Configure Data Access Control
    • Set Up the Spring Boot Application
      • Get the Application Source Code
      • Install the JDBC Driver
      • Install the Provider
      • Review Additional Dependencies
      • Configure the Application
    • Build, Run, and Verify
      • Build the Application
      • Run the Application
      • Get an Access Token
      • Verify Employee Access
      • Verify Privilege Elevation
• Part III IAM, Database, and Application Configuration
  • Identify Your Deployment Scenario
    • Local End Users Connecting Directly
    • IAM-Managed Users Connecting Directly
    • IAM-Managed Applications Logging On as Application Identities
    • IAM-Managed Users Connecting Through an Application
    • Local Application Users Connecting Through the Application
  • Configure Microsoft Entra ID for Application-Mediated Access
    • Register the Database in Microsoft Entra ID
    • Register the Application in Microsoft Entra ID
    • Create Users and Assign Roles in Microsoft Entra ID
    • Validate the Microsoft Entra ID Configuration
  • Configure OCI IAM for Application-Mediated Access
    • Register the Database in OCI IAM
    • Register the Application in OCI IAM
    • Configure Custom Claims for Group Information in OCI IAM
    • Create Users and Assign Groups in OCI IAM
    • Validate the OCI IAM Configuration
  • Configure Keycloak for Application-Mediated Access
    • Before You Begin
    • Configure Clients and Audiences
    • Configure Realm Roles and the Role Claim
    • Validate the Token Claims
  • Configure the Database
    • Configure the Database for IAM Integration
      • Set Up IAM Integration for Application-Mediated Connections
      • Set Up IAM Integration for End-User Direct Logon
      • Set Up IAM Integration for Logon as an Application Identity
    • Configure the Database for Local End-User Authentication
      • Set Up Local Authentication for Application-Mediated Connections
      • Set Up Local Authentication for Direct Logon
        • Set Up Multifactor Authentication for Local End Users
    • Configure a SQL Client for End-User Direct Logon
  • Update Application Configuration with IAM Details
    • Understand Authentication Flow and Prerequisites
    • Configure Java Applications
      • Use the API Extension Methods
      • Use the Service Provider Interface
      • Use the JDBC Spring Boot Provider (The SPI Approach)
    • Configure Python Applications
      • Use the API Extension Methods
      • Use the Service Provider Interface
    • Configure Node.js Applications
    • Configure .NET Applications
    • Advanced: Implement a Security Context Provider
      • Understand the Security Context Payload
      • Understand the Driver’s Provider Interface
      • Build the Security Context Provider
      • Register the Provider with the Driver
      • Configure the Driver to Use Your Provider
      • Support Privilege Elevation (Optional)
      • Note for Other Client Drivers
• Part IV User and Role Administration
  • Configure Local End Users
    • Create End User
    • Alter End User
    • Drop End User
  • Configure Application Identities
    • Create Application Identity
    • Drop Application Identity
  • Configure Data Roles
    • Create Data Role
    • Drop Data Role
  • Grant and Revoke Data Roles
    • Grant Data Role
    • Revoke Data Role
    • Grant Database Role to Data Role
• Part V Data Access Control Configuration
  • Configure the Security Context
    • About the End-User Security Context
    • Prerequisites for Establishing a Token-Based Security Context
    • Prerequisites for Establishing a Local Security Context
    • How the Database Server Manages an End-User Security Context
      • Scenario 1: Token-Based (IAM-Managed) Principal
      • Scenario 2: Locally Managed End User
  • Configure End-User Contexts and Attributes
    • About Default and Custom Contexts
      • Default (System-Defined) Contexts
      • Custom (User-Defined) Contexts
    • Create a Custom End-User Context
    • Drop a Custom End-User Context
    • Read End-User Context Attributes
    • Modify Custom End-User Context Attributes
  • Configure Data Grants
    • About Data Grants
      • Understand Cross-Table Data Grants
      • Data Manipulation Language Privilege Semantics
    • Create Data Grants
      • Use SQL Macros in Data Grant Predicates
    • Drop Data Grants
    • Use Access Check Functions
      • Use the ORA_IS_COLUMN_AUTHORIZED Function
      • Use the ORA_CHECK_DATA_PRIVILEGE Function
    • Enforce Mandatory Data Privileges
    • Data Grant Behavior on Dropping Users or Objects
      • Impact of Dropping Database Users
      • Impact of Dropping End Users or Data Roles
      • Impact of Dropping Tables and Views
      • Impact of Dropping or Renaming Columns
      • Impact of Creating or Replacing Views
  • Enforce Data Authorization for Analytics
    • About Data Authorization for Analytics
    • Use Data Grants with Analytical SQL
      • Determine the Data Available to Analytical Queries
      • Apply Column- and Cell-Level Authorization
      • Apply Attribute-Based Access Control
    • Mask Unauthorized Cell Values in Query Results
    • Load and Use Custom End-User Context Attributes for Analytics
    • Understand the Effect of Column Security on Analytical Results
      • About Core SQL Behavior for Masked Data
      • About Analytical Function-Specific Effects
      • Interpret PIVOT Results
      • Interpret Regression Results
      • Interpret APPROX_COUNT_DISTINCT Results
    • Design Guidelines for Analytics with Oracle Deep Data Security
• Part VI Diagnostics Reference
  • Audit Oracle Deep Data Security Operations
    • Auditable Actions
    • Create an Audit Policy
    • Audit End-User Activity
  • Troubleshoot Oracle Deep Data Security
    • General Troubleshooting Methodology
    • End-User Connection Issues
      • Local End User Cannot Connect to the Database
      • External End User Cannot Connect Through IAM
    • Access and Privilege Issues
      • End User Denied Access to Secured Data
      • Data Grants Not Enforced
      • Data Role Not Effective in End-User Session
    • Context Attribute Definition or Usage Issues
      • Cannot Create a Context Attribute Definition Object
      • Context Attribute Cannot Be Used in Session
    • End-User Security Context Issues
      • End-User Security Context Not Attached to Session
      • Invalid Database-Access Token
      • Data Role in the Database Is Not Mapped to IAM Application Role
      • Data Role Granted to an Application Is Not Enabled
      • ORA-00406 Error When Querying End-User Context
    • Enable Diagnostic Tracing
      • Trace Data Grants and Query Rewrites
      • Trace End-User and Data Role DDLs
      • Trace End-User Context Attributes
      • Trace End-User Security Contexts
    • Raise a Service Request with Oracle Support
  • Oracle Deep Data Security Data Dictionary Views
    • Data Authorization Views
      • DBA_DATA_ROLES
      • DBA_DATA_ROLE_GRANTS
      • DBA_DATA_GRANTS
      • ALL_DATA_GRANTS
      • USER_DATA_GRANTS
      • DBA_REQUIRED_PARENT_DATA_PRIVILEGES
      • ALL_REQUIRED_PARENT_DATA_PRIVILEGES
      • USER_REQUIRED_PARENT_DATA_PRIVILEGES
    • Identity Views
      • DBA_END_USERS
      • USER_END_USERS
      • DBA_APPLICATION_IDENTITIES
    • End-User Context Views
      • DBA_END_USER_CONTEXT_DEFINITIONS
      • ALL_END_USER_CONTEXT_DEFINITIONS
      • USER_END_USER_CONTEXT_DEFINITIONS
    • End-User Security Context Views
      • DBA_END_USER_SECURITY_CONTEXTS
      • DBA_END_USER_SECURITY_CONTEXT_DATA_ROLES
      • DBA_END_USER_SECURITY_CONTEXT_ATTRIBUTES
      • END_USER_CONTEXT
      • V$END_USER_DATA_ROLE
• Appendixes
  • Integration Use Cases
    • Integrate with the Database Tools MCP Server
      • The Authentication Flow
      • Scope and Related Documentation
      • Prerequisites: OCI IAM and MCP Server Setup
      • Configure the Database for OCI IAM Auth Tokens
      • Verify the Integration
  • Sample Scripts for Configuring Oracle Deep Data Security
    • Scripts for Direct Logon with Local End Users
      • How to Run the Scripts
      • Scripts
        • 01_local_demo.sql
        • 01_local_cleanup.sql
      • Log Files
        • 01_local_demo.log
        • 01_local_cleanup.log
    • Scripts for Direct Logon with End Users in IAM
      • How to Run the Scripts
      • Scripts
        • 02_entra_demo.sql
        • 02_entra_cleanup.sql
      • Log Files
        • 02_entra_demo.log
        • 02_entra_cleanup.log
    • Scripts for the Employee Records Application
      • How to Run the Scripts
      • Scripts
        • 03_application_demo.sql
        • 03_application_cleanup.sql
      • Log Files
        • 03_application_demo.log
        • 03_application_cleanup.log