Skip Headers

# Isolated Client Sessions and Oracle Virtual Private Database (VPD)

Previous

Next

Oracle9i Database Server (and later) provides a server-enforced, fine-grained access control mechanism called Virtual Private Database (VPD). VPD ties a security policy to a table by dynamically appending SQL statements with a predicate to limit data access at the row level. You can create your own security policies, or use Oracle's custom implementation of VPD called Oracle Label Security (OLS). For more information on VPD and OLS, see:

http://www.oracle.com/technology/deploy/security/index.html.

To use the Oracle Database VPD feature in your TopLink-enabled application, use isolated client sessions.

Any class that maps to a table that uses VPD must have the descriptor configured as isolated (see "Configuring Cache Isolation at the Descriptor Level").

When you use isolated client sessions with VPD, you typically use exclusive connections (see "Acquiring a Client Session That Uses Exclusive Connections").

To support VPD, you are responsible for implementing session event handlers that the TopLink runtime invokes during the isolated client session life cycle (see "Isolated Client Session Life Cycle"). The session event handler you must implement depends on whether or not you are using Oracle Database proxy authentication (see "VPD With Oracle Database Proxy Authentication" and "VPD Without Oracle Database Proxy Authentication").

For information, see "Configuring Exclusive Isolated Client Sessions for Virtual Private Database".