9 Database Security

The Oracle Database supports a wide range of security configurations natively or via additional options available. For a full discussion of the available security options for the database refer to the Oracle Database Security Guide.

Database Users

Your application installation ships with a predefined set of users to be used by the product at configuration and runtime. These users are specified in the installation of the product to build the database and load its initial dataset.The following users are available:

  • SPLADM – This is the default DBA administration account which owns the product schema. This user is used to create and maintain the structures of the database. It is used by DBA personnel to maintain the product schema and indexes.
  • SPLUSER – This is the default main product user used by the product to access the SPLADM schema. The product uses this physical userid as a pooled user with pooled connections to the database. Variations on this account can be created for each channel of access using the following configuration settings.
  • Configuration Parameter Comments
    BATCH_DBUSER Database User for Batch
    DBUSER Database User for online (Default: SPLUSER)
    XAI_DBUSER Database User for Web Services
  • SPLREAD – This is the default read only user available for reporting tools or external direct interfaces to use on the product database. This user is not used by the product.

    Note:

    For customers on older versions of products this user was also used for the ConfigLab component.
  • CISOPR, OPRPLUS – These are optional operator users that can be used to delegate backup and restore operations on the product.

    Note:

    The values of these users can be altered to customer specific values at installation time. Refer to the product Installation Guide and product DBA Guide for more information.

Database Roles

Your application ships with a set of database roles to allow administrators to allocate new database users to the relevant components of the product. The following roles are shipped by default for the product:

  • SPL_USER – This role is available for database users who require update, insert, delete and select access to the product schema. This role is used for product users.•
  • SPL_READ – This role is available for database users who require read only access to the product schema.

To use the roles the DBA grants the role to the database user to connect them to the schema in the desired fashion.

Database Permissions

Database permissions for the application are allocated at the role level with the role setting permissions to the schema objects. By default, the roles have full access to all the objects in the product schema, as dictated by the role.

Unless otherwise stated, it is not recommended to alter the database users used by the product to specific additional permissions on the product schema as this may cause permission issues.

Customers wishing to restrict external parties, such as external tools or reporting engines, to specific objects may use all the desired security facilities available in the database to implement those restrictions.

Using Transparent Data Encryption

Transparent Data Encryption (TDE) allows data to be encrypted at the storage level to protect the data files at the lowest level. From a product perspective, the implementation of Transparent Data Encryption requires no product configuration changes on the application server.

Note:

To implement Transparent Data Encryption, DBAs will have to execute appropriate alter statements on product tables to indicate the level of encryption.

For more information about implementing Transparent Data Encryption refer to the Oracle Advanced Security Guide.

Using Database Vault

By default, the database administration account as SQL Data Manipulation Language (DML) access to the application’s schema, as dictated by the default permissions of the Oracle Database. It is possible to restrict the permissions of the DBA to SQL Data Definition Language (DDL) statements only using Database Vault. Refer to the Database Vault Administrators Guide for details of this facility.

The product includes a pre-built database vault solution, refer to the Technical Best Practices For Oracle Utilities Application Framework Based Products (KB679040) document available from My Oracle Support.