In our web application we want to use DB2 row level access control to control who can view what. Each table would contain a column named userId which contain the user id. We want log-in users be able to see only row's usereId column with theirs id. I have seen db2 permission examples using DB2 session_id or user, for example taking DB2 given Banking example :
CREATE PERMISSION EXAMPLEBANKING.IN_TELLER_ROW_ACCESS
ON EXAMPLEBANKING.CUSTOMER FOR ROWS WHERE BRANCH in (
SELECT HOME_BRANCH FROM EXAMPLEBANKING.INTERNAL_INFO WHERE EMP_ID = SESSION_USER
)
ENFORCED FOR ALL ACCESS
ENABLE;
Our table gets updated dynamically hence we don't know what row get added or deleted hence we don't know what are all the user Id in the table.
At any given time, different user would log-on to the web to view information retrieve from the tables, the permission declaration above only take SESSION_USER as the input, can I change it to something like Java function parameter where one can pass arbitrary id to the permission? If not then how do I handle different log-in users at arbitrary time? Or do I just keep changing SESSION_USER dynamically as new user login (using "db2 set" ??)? If so then is this the best practice for this kind use case?
Thanks in advance.
Since the user ID in question is application-provided, not originating from the database, using SESSION_USER, which equals to the DB2 authorization ID, would not be appropriate. Instead you might use the CLIENT_USERID variable, as described here.
This might become a little tricky if you use connection pooling in your application, as the variable must be set each time after obtaining a connection from the pool and reset before returning it to the pool.
Check out Trusted Contexts, this is exactly why they exist. The linked article is fairly old (you can use trusted contexts with PHP, ruby, etc. now).
Related
I work for a software house and I'm looking for a way to authenticate database access as follow:
Someone whose personal data are stored in a table needs to read his
personal row and he has the right to access the table.
Once the requested row has been retrieved, I need an external check
which ensures he has the right to read that specific row, checking
some table's fields which are contained in the same row.
It seems to me that the attribute-based access control is what I'm looking for, but I'm not sure. Can you confirm if it's able to do what I need?
Yes, ABAC (the model) can do that. However, the check would typically happen before you get access to the data - and that's better actually (it avoids retrieving data).
ABAC gives you two things:
a policy language to express what can and cannot happen. For instance
A user can view a record they own but not the credit card field
a request / response scheme or how to enforce the policies.
In the case of data-centric access control, policies are transformed into SQL filters. For instance, you would go from:
SELECT * FROM transactions;
to
SELECT amount, owner, CASE WHEN (0=1) THEN CREDITCARD ELSE 'xxxx' FROM transactions WHERE owner = 'Alice'
This is called dynamic data filtering and dynamic data masking. Some database vendors have had that capability e.g. Oracle and VPD or MySQL and FGAC. Lately the trend is to outsource this type of behavior to tools like Informatica DDM or Axiomatics ADAF MD (which is where I work).
I have integrated the content of 'ofproperty' table of openfire to some table of custom database. by default the openfire use username to asssemble JID as a sign every single user.
After setting the system properties of openfire(some sql statements), it will make the 'ofuser'table in openfire point to 'users' table of the business database.
what i am not sure is that whether openfire inner mechanism only identify the username or not?
because my entire instant message is close to done, and now i am asked to try userid to replace username, the change will concern lots of other business logic in my project. I don't want to see the circumstance that every change is done,but openfire mechanism does not accept it.
if i use userid to replace username to assemble the jid, and correspondingly change the setting properties of openfire, will it still work？
Hope some experienced people give me some advice..Thanks a lot
I think this will not work if openfire is using DefaultAuthProvider.java for user authentication. Because DefaultAuthProvider.java uses a static sql string
private static final String LOAD_PASSWORD =
"SELECT plainPassword,encryptedPassword FROM ofUser WHERE username=?";
so if you change in your system properties that won't work. You can do one of the following two things
Change the LOAD_PASSWORD string inside DefaultAuthProvider.java (inside source code) accoring to your need and then compile it and Enjoy :)
Write you own AuthProvider by implementing AuthProvider Interface
I think first one is little easier
here is something interesting that I have been asked. It has to do with the encryption of data in a non encrypted database.
The story has as follows. We have a database, not encrypted and also none column encrypted in any of its tables. Now, we'd like to control the trafic of the data depending on who is asking for this. Let me explain more clear:
We have a table with the name: table1
This table has one column with the name: SName
We'd like to reach the following result. A user connected to the SQL Server Management Studio if runs the following query:
select * from table1
to take no result or if he/she takes a result, this result to be scrambled.
Now from inside the application the table should exchange data from/to the application in the normal mode.
Do you know if there is a setting, or an implementation or an external tool that can provide this functionality?
I think that this is quite interesting case!
Thank you.
Use permissions to stop that person reading the table at all.
Or use a VIEW to hide the table and have a WHERE clause in that that applies a filter silently: this could refer to another table with a list of approved users.
This isn't really an encryption (well, obfuscation in this case) issue.
I'm currently creating my first real life project in Pervasive. The task is to map a certain XML structure containing orders (as in shops and products) to 3 tables I created myself. These tables rest inside a MS-SQL-Server instance.
All of the tables have a unique key called "id", an automatically incremented column. I've dropped this column from all mappings so that Pervasive will not try to fill it itself.
For certain calculations, for a split key in one of the tables and for references to the created records in other tables, I will need the id that the database has just created. For that, I have googled the answer. I can use "select ##identity;" as a statement, and this returns the id that has most recently been created for the current connection. This means that in Pervasive, I will have to execute this statement using the already existing target connection object.
But how to do that? I am quite sure that I will need a JDImport or DJExport object, but how to get one associated with the current connection that Pervasive inserts the records by?
Or is there any other way to handle this auto increment when I need to reference the id in other tables?
Not sure how things work in Pervasive, but you may run into issues with ##identity,. Scope_identity() would probably be safer but may still not work in Pervasive.
Hopefully your tables have a natural key in addition to the generated id, in which case you can select your id based on the natural key. This will avoid any issues you may have with disparate sessions and scope.
If there is anyone looking this post up and wonders about the answer, it's "You can't". Pervasive does not allow access to their very own connection object, the one they use to query the database. Without access to it, you cannot guaranteed fetch the right id. The solution for us was this: We used a stored procedure which we called in the Before-Transformation event that created the header record and returned the id and an optional error message as a table. We executed it and it returns the id we then save and use throughout our mapping.
I have an access 'application' (.adp file), when it opens i have it update an admin database with the username and time open. When it closes it updates the admin database with username time closed - these are sperate records in the events table so it looks like
username,dbaction,time
bob,open,13:00
gareth,open,13:05
bob,close,14:00
If the user where to open the db twice there would be 2 open and 2 close actions recorded but no way to establish which database session each of the 2 close events belonged.
What i want to store in this table is a unique identifier to link the open and close actions together with 'each session'. Preferably i would like to use a property ov the application object in vba if something exists. Does it even store the time the db was opened? I could generate my own id when databases are opened and store it in a variable until close, but id prefer to use something in built. Any ideas?
I do this using a hidden unbound form which opens on startup. In that form I insert the record into the table. I then fetch the autonumber ID (or whatever SQL Server calls that field.) of that record and store in a text control. If you do any development and you hit an error and reset the running code you lose all global variables thus I prefer using forms to store these kinds of variables.
In the hidden forms On Close event I then update the same record with the date/time exited. I've been using this technique for well over a decade without any problems.
You could have a global 'Id_session' variable, initiated at startup (random generated uniqueIdentifier for example) that you will store in an 'id_Session' column of your 'event' table. When the database is opened, the record is inserted in the 'event' table, and the record identifier is stored as a global variable. When the database is closed, the existing record is identified (through the id_session value) and updated in the database.
In fact, I do not understand the interest of an inbuilt identifier instead of this solution.
There is likely a method that runs in an access database when it is opened. In this you could generate a random identifier and store it in a global variable. When writing your log line you could include this identifier allow you to trace login and logout.
Update: You can use the code shown here to generate a GUID which is pretty much gauranteed to be unique so this should do what you want. If it doesnt you might need to clarify as I'm not understanding the question.
All these answers seem to me to be too clever by half.
What I do is add an Autonumber field to the table I'm logging these in, and then capture the Autonumber value of the startup event record and store it somewhere in (usually in a hidden field on the app's startup form) for use at shutdown to write the shutdown event with the ID number of the startup event.
is HWND going to be unique for 2 access applications opened at the same time on possibly on the same pc or 2 different pcs?