12 Using the DVSYS.DBMS_MACSEC_ROLES Package

This chapter contains:

About the DVSYS.DBMS_MACSEC_ROLES Package
CAN_SET_ROLE Function
SET_ROLE Procedure

About the DVSYS.DBMS_MACSEC_ROLES Package

You can modify your applications to use the procedures within the DVSYS.DBMS_MACSEC_ROLES package to check the authorization for a user or to set an Oracle Database Vault secure application role. The DVSYS.DBMS_MACSEC_ROLES package is available to all users.

Chapter 8, "Configuring Secure Application Roles for Oracle Database Vault" describes secure application roles in detail. See also Chapter 13, "Using the DVSYS.DBMS_MACUTL Package" for a set of general-purpose utility procedures that you can use with the secure application role procedures.

Table 12-1 lists the DVSYS.DBMS_MACSEC_ROLES package function and procedure.

Table 12-1 DVSYS.DBMS_MACSEC_ROLES Oracle Label Security Configuration Procedures

Function or Procedure	Description
CAN_SET_ROLE Function	Checks whether the user invoking the method is authorized to use the specified Oracle Database Vault secure application role. Returns a `BOOLEAN` value.
SET_ROLE Procedure	Issues the `SET ROLE` statement for an Oracle Database Vault secure application role.

CAN_SET_ROLE Function

The CAN_SET_ROLE function checks whether the user invoking the method is authorized to use the specified Oracle Database Vault secure application role.

Syntax

DVSYS.DBMS_MACSEC_ROLES.CAN_SET_ROLE(
  p_role IN VARCHAR2)
RETURN BOOLEAN;

Parameters

Table 12-2 CAN_SET_ROLE Parameter

Parameter Description

Parameter	Description
`p_role`	Role name. To find existing secure application roles in the current database instance, query the `DVSYS.DBA_DV_ROLE` view, described in "DBA_DV_ROLE View".

p_role

Role name.

To find existing secure application roles in the current database instance, query the DVSYS.DBA_DV_ROLE view, described in "DBA_DV_ROLE View".

Example

SET SERVEROUTPUT ON
BEGIN
 IF DVSYS.DBMS_MACSEC_ROLES.CAN_SET_ROLE('SECTOR2_APP_MGR')
  THEN DBMS_OUTPUT.PUT_LINE('''SECTOR2_APP_MGR'' can be enabled.');
 END IF;
END;
/

SET_ROLE Procedure

The SET_ROLE procedure issues the SET ROLE PL/SQL statement for specified roles, including both Oracle Database Vault secure application roles and regular Oracle Database roles. This procedure sets an Oracle Database Vault secure application role only if the rule set that is associated with the role evaluates to true.

Syntax

DVSYS.DBMS_MACSEC_ROLES.SET_ROLE(
  p_role IN VARCHAR2);

Parameters

Table 12-3 SET_ROLE Parameter

Parameter Description

Parameter	Description
`p_role`	Role names. You can enter multiple roles, including secure application roles and regular roles. To find existing secure application roles in the current database instance, query the `DVSYS.DBA_DV_ROLE` view, described in "DBA_DV_ROLE View". To find all of the existing roles in the database, query the `DBA_ROLES` data dictionary view, described in Oracle Database Reference.

p_role

Role names. You can enter multiple roles, including secure application roles and regular roles.

To find existing secure application roles in the current database instance, query the DVSYS.DBA_DV_ROLE view, described in "DBA_DV_ROLE View".

To find all of the existing roles in the database, query the DBA_ROLES data dictionary view, described in Oracle Database Reference.

Example

EXEC DVSYS.DBMS_MACSEC_ROLES.SET_ROLE('SECTOR2_APP_MGR, APPS_MGR');

You can enter the name of the role in any case, for example, Sector2_APP_MGR.