Should Invoker Rights be used?
•
0 likes•876 views
This document contains information about Patrick Barel, an Oracle consultant and author. It includes his contact details, areas of expertise, blogs and websites to read, plugins available for download, and upcoming training events he will be presenting. Some key points are: - Patrick Barel has been working with Oracle technologies like PL/SQL, APEX, and OCA certification since 1997. - He maintains blogs on technology.amis.nl and blog.bar-solutions.com about Oracle topics. - Plugins for tools like PL/SQL Developer and APEX can be downloaded from his websites. - Upcoming events include a Steven Feuerstein masterclass on PL/SQL best practices and new
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (7)
Similar to Should Invoker Rights be used?
Similar to Should Invoker Rights be used? (20)
More from Getting value from IoT, Integration and Data Analytics
More from Getting value from IoT, Integration and Data Analytics (20)
Recently uploaded
Recently uploaded (20)
Should Invoker Rights be used?
- 2. About me… • Patrick Barel • Working with Oracle since 1997 • Working with PL/SQL since 1999 • Playing with APEX since 2003 (mod_plsql) • ACE since 2011 • OCA since December 20th 2012
- 4. Download me… Plugins for PL/SQL Developer http://bar-solutions.com Plugins for Apex http://apex-plugin.com
- 5. Watch me…
- 7. Steven Feuerstein Masterclass Anti-Pattern PL/SQL Programming + Oracle Database 12c New PL/SQL Features 12/13 December. AMIS, Nieuwegein • Steven will present examples of "bad code" (anti-patterns) and features of PL/SQL that address them. • Students working in pairs then use their laptops to fix the anti-patterns. • Steven then walks entire class through optimal solutions.
- 9. Definer Rights Model Invoker Rights Model Prior to Oracle8i, whenever you executed a stored program, it ran under the privileges of the account in which the program was defined. This is called the … With Oracle8i, you can now decide at compilation time whether your program or package will execute in the definer's schema (the default) or the schema of the invoker of the code. This is called the … Definer Rights vs Invoker Rights
- 10. Patrick Mitchell Code Invoke R e f Relations Relations Definer Rights
- 11. Patrick Mitchell Code Invoke Relations Relations Invoker Rights
- 12. Allows you to centralize access to and control of underlying data structures. Uses roles and doesn’t rely on directly-granted privileges. But it can be a source of confusion and architectural problems. Note: Oracle built-in packages have long had the capability of running under the invoker's authority. Invoker Rights
- 13. What’s wrong with Definer Rights Deployment & maintenance Must install module in all schemas where needed In some databases, each user has own copy of table(s), requiring copy of stored module Security No declarative way to restrict privileges on certain modules in a package -- it's all or nothing, unless you write code in the package to essentially recreate roles programmatically. Difficult to audit privileges Sure would be nice to have a choice...and now you do!
- 14. Deployment & maintenance Must install module in all schemas where needed In some databases, each user has own copy of table(s), requiring copy of stored module Security No declarative way to restrict privileges on certain modules in a package -- it's all or nothing, unless you write code in the package to essentially recreate roles programmatically. Difficult to audit privileges Sure would be nice to have a choice...and now you do! What’s wrong with Definer Rights
- 15. CREATE [ OR REPLACE ] <module type> [ AUTHID { DEFINER | CURRENT_USER } ] AS ... Invoker Rights For top level modules: For modules with separate spec and body, AUTHID goes only in spec, and must be at the package level. Holds true for packages and object types.
- 16. Emp begin x.foo; end; package x authid definer Emp Emp package y authid definer package z authid definer Overview of Definer Rights
- 17. Emp begin x.foo; end; package x authid current_user Emp Emp package y authid definer package z authid current_user Overview of Invoker Rights
- 18. Emp begin x.foo; end; package x authid current_user Emp Emp package y authid definer package z authid current_user Emp begin x.foo; end; Overview of Invoker Rights
- 19. Mock objects To compile code you still need the structure of the objects.
- 20. begin x.foo; end; begin x.foo; end; package x authid current_user Col1` Col2 Col3 Col4 Col1 Col2 Col3 Col4 A.val1 A.val2 A.val3 A.val4 A.val5 A.val6 A.val7 A.val8 A.val9 A.val10 A.val11 A.val12 A.val13 A.val14 A.val15 A.val16 Col1 Col2 Col3 Col4 B.val1 B.val2 B.val3 B.val4 B.val5 B.val6 B.val7 B.val8 B.val9 B.val10 B.val11 B.val12 B.val13 B.val14 B.val15 B.val16 Execute Execute Mock objects
- 22. Definer Rights Definer rights Single codebase SQL Injection
- 23. Definer Rights Use a single codebase for multiple users (a bit of) Protection from SQL Injection
- 25. User1 User2 App Mock objects Single codebase
- 28. User1 User2 App Application code in a central schema (with mock objects) Single codebase
- 29. User1 User2 App Each user has it’s own set of tables, views and sequences Single codebase
- 30. User1 User2 App Columns can be different in each schema Single codebase demo_ir.sqldemo_ir.sql
- 31. Advantages One time development Specific code in user schema (partial) Protection from SQL Injection
- 32. Drawbacks Debugging can be hard Support can be hard
- 33. SQL Injection Dynamic SQL Modification (drop) of objects – You cannot drop what is not there Modification of records – Will only affect current users data You should always use binding instead of concatenating in Dynamic SQL Statements
- 34. Definer Rights Model Invoker Rights Model Rules and Restrictions • AUTHID DEFINER – Uses directly granted privileges – Default, so no need to change current code • AUTHID CURRENT_USER – Uses ROLEs – On entire objects – Need for ‘mock’ objects – (at compile time it’s Definer Rights)