13 Using the DBMS_MACSEC_ROLES Package

This chapter contains:

About the DBMS_MACSEC_ROLES Package

You can modify your applications to use the procedures within the DBMS_MACSEC_ROLES package to check the authorization for a user or to set an Oracle Database Vault secure application role. The DBMS_MACSEC_ROLES package is available to all users.

Chapter 8, "Configuring Secure Application Roles for Oracle Database Vault," describes secure application roles in detail. See also Chapter 14, "Using the DBMS_MACUTL Package," for a set of general-purpose utility procedures that you can use with the secure application role procedures.

Table 13-1 lists the DBMS_MACSEC_ROLES package function and procedure.

Table 13-1 DBMS_MACSEC_ROLES Oracle Label Security Configuration Procedures

Function or Procedure Description

CAN_SET_ROLE Function

Checks whether the user invoking the method is authorized to use the specified Oracle Database Vault secure application role. Returns a BOOLEAN value.

SET_ROLE Procedure

Issues the SET ROLE statement for an Oracle Database Vault secure application role.

CAN_SET_ROLE Function

The CAN_SET_ROLE function checks whether the user invoking the method is authorized to use the specified Oracle Database Vault secure application role.

Syntax

DBMS_MACSEC_ROLES.CAN_SET_ROLE(
  p_role IN VARCHAR2)
RETURN BOOLEAN;

Parameters

Table 13-2 CAN_SET_ROLE Parameter

Parameter Description

p_role

Role name.

To find existing secure application roles in the current database instance, query the DVSYS.DBA_DV_ROLE view, described in "DVSYS.DBA_DV_ROLE View".

Example

SET SERVEROUTPUT ON
BEGIN
 IF DBMS_MACSEC_ROLES.CAN_SET_ROLE('SECTOR2_APP_MGR')
  THEN DBMS_OUTPUT.PUT_LINE('''SECTOR2_APP_MGR'' can be enabled.');
 END IF;
END;
/

SET_ROLE Procedure

The SET_ROLE procedure issues the SET ROLE PL/SQL statement for specified roles, including both Oracle Database Vault secure application roles and regular Oracle Database roles. This procedure sets an Oracle Database Vault secure application role only if the rule set that is associated with the role evaluates to true.

Syntax

DBMS_MACSEC_ROLES.SET_ROLE(
  p_role IN VARCHAR2);

Parameters

Table 13-3 SET_ROLE Parameter

Parameter Description

p_role

Role names. You can enter multiple roles, including secure application roles and regular roles.

To find existing secure application roles in the current database instance, query the DVSYS.DBA_DV_ROLE view, described in "DVSYS.DBA_DV_ROLE View".

To find all of the existing roles in the database, query the DBA_ROLES data dictionary view, described in Oracle Database Reference.

Example

EXEC DBMS_MACSEC_ROLES.SET_ROLE('SECTOR2_APP_MGR, APPS_MGR');

You can enter the name of the role in any case (for example, Sector2_APP_MGR).