An Oracle Database Vault-Oracle Label Security integration enables you to assign an OLS label to a Database Vault factor identity.

In Oracle Label Security, you can restrict access to rows in database tables or PL/SQL programs. For example, Mary may be able to see data protected by the HIGHLY SENSITIVE label, an Oracle Label Security label on the EMPLOYEE table that includes records that should have access limited to certain managers. Another label can be PUBLIC, which allows more open access to this data.

In Oracle Database Vault, you can create a factor called Network, for the network on which the database session originates, with the following identities:

• Intranet: Used for when an employee is working on site within the intranet for your company.

• Remote: Used for when the employee is working at home from a VPN connection.

You then assign a maximum session label to both. For example:

• Assign the Intranet identity to the HIGHLY SENSITIVE Oracle Label Security label.

• Assign the Remote identity to the PUBLIC label.

This means that when Mary is working at home using their VPN connection, she have access only to the limited table data protected under the PUBLIC identity. But when she is in the office, she has access to the HIGHLY SENSITIVE data, because she is using the Intranet identity.

The Label Security Integration Audit Report enables you to monitor the integration with Oracle Label Security. You can create audit policies to capture this information. Be aware that as of Oracle Database release 23ai, traditional auditing is desupported.

You must fulfill specific requirements in place before you use Oracle Database Vault with Oracle Label Security.

• Oracle Label Security is licensed separately. Ensure that you have purchased a license to use it.

• Before you install Oracle Database Vault, you must have already installed Oracle Label Security.

• Ensure that you have the appropriate Oracle Label Security policies defined.

• If you plan to integrate an Oracle Label Security policy with Oracle Database Vault, ensure that the Oracle Label Security policy name is less than 122 characters. You can check the names of Oracle Label Security policies by querying the POLICY_NAME column of the ALL_SA_POLICIES data dictionary view..

To enhance security, you can integrate Oracle Database Vault factors with Oracle Label Security policies.

• About Using Oracle Database Vault Factors with Oracle Label Security Policies
  And Oracle Database Vault-Oracle Label Security integration enables you to control the maximum security clearance for a database session.
• Configuring Factors to Work with an Oracle Label Security Policy
  You can define factors that contribute to the maximum allowable data label of an Oracle Label Security policy.

An Oracle Database Vault-Oracle Label Security integration can grant different levels of access to two administrative users who have the same privileges.

• About This Tutorial
  You can use Oracle Database Vault factors with Oracle Label Security and Oracle Virtual Private Database (VPD) to restrict sensitive data access.
• Step 1: Create Users for This Tutorial
  You must create two administrative users for this tutorial.
• Step 2: Create the Oracle Label Security Policy
  Next, you can create the Oracle Label Security policy and grant users the appropriate privileges for it.
• Step 3: Create Oracle Database Vault Rules to Control the OLS Authorization
  After you create the Oracle Label Security policy, you can create Database Vault rules to work with it.
• Step 4: Update the ALTER SYSTEM Command Rule to Use the Rule Set
  Before the rule set can be used, you must update the ALTER SYSTEM command rule, which is a default command rule.
• Step 5: Test the Authorizations
  With all the components in place, you are ready to test the authorization.
• Step 6: Remove the Components for This Tutorial
  You can remove the components that you created for this tutorial if you no longer need them.

Oracle Database Vault provides reports and data dictionary views that list information about the Oracle Database Vault-Oracle Label Security integration.

An Oracle Database Vault-Oracle Data Guard integration requires first, the primary database configuration, then the standby database configuration.

1. For Linux and UNIX systems, ensure there is an /etc/oratab entry for the database on the node in which you are installing Oracle Database Vault.
2. If you are using Data Guard Broker, then from the command prompt, disable the configuration as follows:

   dgmgrl sys
   Enter password: password
   
   DGMGRL> disable configuration;
   

3. Configure and enable Oracle Database Vault on the primary server.
   By default, Oracle Database Vault is installed as part of Oracle Database. You can check the registration status by querying the DBA_DV_STATUS data dictionary view.
4. Log in to the PDB as user SYS with the SYSDBA administrative privilege.
5. Run the following ALTER SYSTEM statements:

   ALTER SYSTEM SET OS_ROLES=FALSE SCOPE=SPFILE; 
   ALTER SYSTEM SET REMOTE_LOGIN_PASSWORDFILE='EXCLUSIVE' SCOPE=SPFILE;
   ALTER SYSTEM SET SQL92_SECURITY=TRUE SCOPE=SPFILE;
   ALTER SYSTEM SET REMOTE_OS_ROLES=FALSE SCOPE=SPFILE;

   The REMOTE_OS_ROLES initialization parameter is deprecated in Oracle Database 23ai

6. Run the ALTER SYSTEM statement on each database instance to set the parameters as shown in the preceding step.
7. As user SYS with the SYSDBA administrative privilege, close and then reopen each PDB.

   ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
   ALTER PLUGGABLE DATABASE pdb_name OPEN;

You can perform the standby database configuration within the database to be used for the standby database.

1. Log into the database instance as user SYS with the SYSDBA administrative privilege.
2. Mount a standby database instance.

   ALTER DATABASE MOUNT STANDBY DATABASE;

3. Run the following ALTER SYSTEM statements:

   ALTER SYSTEM SET OS_ROLES=FALSE SCOPE=SPFILE; 
   ALTER SYSTEM SET REMOTE_LOGIN_PASSWORDFILE='EXCLUSIVE' SCOPE=SPFILE;
   ALTER SYSTEM SET SQL92_SECURITY=TRUE SCOPE=SPFILE;
   ALTER SYSTEM SET REMOTE_OS_ROLES=FALSE SCOPE=SPFILE;

   The REMOTE_OS_ROLES initialization parameter is deprecated in Oracle Database 23ai

4. Close and then reopen the PDB.

   ALTER PLUGGABLE DATABASE pdb_name CLOSE IMMEDIATE;
   ALTER PLUGGABLE DATABASE pdb_name OPEN;

5. Mount the next standby instance.
6. Restart the managed recovery as follows:

   ALTER DATABASE RECOVER MANAGED STANDBY DATABASE; 
   

7. If you are using Data Guard Broker, then from the command line, re-enable the configuration.

   dgmgrl sys
   Enter password: password
   
   DGMGRL> enable configuration; 
   

   This command applies the changes to the physical standby database made by the Oracle Database Vault installation on the primary database.

8. Repeat the physical standby installation process on each physical standby database. For example, if there are three physical standby databases, then run these procedures or each standby database.

Enterprise User Security centrally manages database users and authorizations in one place.

It is combined with Oracle Identity Management and is available in Oracle Database Enterprise Edition.

In general, to integrate Oracle Database Vault with Oracle Enterprise User Security, you configure the appropriate realms to protect the data that you want to protect in the database.

After you define the Oracle Database Vault realms as needed, you can create a rule set for the Enterprise users to allow or disallow their access.

To configure an Enterprise User authorization, you must create an Oracle Database Vault rule set to control the user access.

1. Connect to the PDB or the application root as a user who has been granted the DV_OWNER or DV_ADMIN role.
2. Run the DBMS_MACADM.CREATE_RULE procedure to create the rule that allows or disallows user access.

   BEGIN
    DBMS_MACADM.CREATE_RULE(
     rule_name => 'Control User Access',
     rule_expr =>'SYS_CONTEXT(''USERENV'',''AUTHENTICATED_IDENTITY'') = ''USER_DOMAIN_NAME''',
     scope => DBMS_MACUTL.G_SCOPE_LOCAL);
   END;
   /
   

   In this specification:

   • rule_name specifies a rule name. Enter any valid name that is appropriate for your needs.
   • rule_expr must use the rule expression given in this example. Replace 'user_domain_name' with the domain. For example:

     'SYS_CONTEXT(''USERENV'',''AUTHENTICATED_IDENTITY'') = ''myserver.us.example.com'''

   • scope must be DBMS_MACUTL.G_SCOPE_LOCAL.
3. Run the DBMS_MACADM.CREATE_RULE_SET procedure to create a rule set to be used for the rule.
   For example:

   BEGIN
    DBMS_MACADM.CREATE_RULE_SET(
     rule_set_name   => 'EM User Authorization',
     description     => 'Allows or disallows user access to EM',
     enabled         => DBMS_MACUTL.G_YES,
     eval_options    => DBMS_MACUTL.G_RULESET_EVAL_ANY,
     audit_options   => DBMS_MACUTL.G_RULESET_AUDIT_OFF,
     fail_options    => DBMS_MACUTL.G_RULESET_FAIL_SILENT,
     fail_message    => null,
     fail_code       => null,
     handler_options => DBMS_MACUTL.G_RULESET_HANDLER_OFF,
     handler         => ' ',
     is_static       => TRUE);
   END;
   /

4. Run the DBMS_MACADM.ADD_RULE_TO_RULE_SET procedure to add the rule to the rule set.
   For example:

   BEGIN
    DBMS_MACADM.ADD_RULE_TO_RULE_SET(
     rule_set_name => 'EM User Authorization', 
     rule_name     => 'Control User Access');
   END;
   /

5. Run the DBMS_MACADM.ADD_AUTH_TO_REALM procedure to add the rule set to the realm authorization for the data that you want to protect.
   For example, for a realm called HR Realm:

   BEGIN
    DBMS_MACADM.ADD_AUTH_TO_REALM(
     realm_name    => 'HR Realm', 
     grantee       => 'PFITCH', 
     rule_set_name => 'EM User Authorization',
     auth_options  => DBMS_MACUTL.G_REALM_AUTH_OWNER,
     auth_scope    => DBMS_MACUTL.G_SCOPE_LOCAL);
   END;
   /

You can configure existing Oracle Database Vault user accounts as enterprise user accounts in a PDB.

1. Log in to the PDB as a user who has been granted the CREATE ROLE system privilege.
2. Create a global role for the DV_OWNER role and a global role for the DV_ACCTMGR role.

   For example:

   CREATE ROLE g_dv_owner IDENTIFIED GLOBALLY;
   CREATE ROLE g_dv_acctmgr IDENTIFIED GLOBALLY;
   

3. Connect as a user who has been granted the DV_OWNER role.
4. Grant the DV_OWNER role to the global DV_OWNER role.

   GRANT DV_OWNER TO g_dv_owner;

5. Connect as a user who has been granted the DV_ACCTMGR role.
6. Grant the DV_ACCTMGR role to the global DV_ACCTMGR role.

   GRANT DV_ACCTMGR TO g_dv_acctmgr;

7. Connect as user SYS with the SYSDBA administrative privilege.
8. Temporarily grant the DV_ACCTMGR user who will import the Database Vault users into OID the CREATE TABLE privilege and the SELECT_CATALOG_ROLE role.

   GRANT CREATE TABLE, SELECT_CATALOG_ROLE TO dbv_acctmgr;

9. From the command line, run the User Migration Utility (UMU) to import the Database Vault accounts into Oracle Internet Directory (OID).

   The following example imports the Database Vault accounts dvowner and dvacctmgr into OID. The DV_ACCTMGR user is specified for the DBADMIN setting.

   $ORACLE_HOME/rdbms/bin/umu PHASE=ONE
   DBADMIN=dbv_acctmgr:password
   ENTADMIN=cn=jane_ent_admin,dc=example,dc=com:password
   USERS= LIST
   DBLOCATION=example.com:7777:orcl
   DIRLOCATION=example.com:636
   USERSLIST=dvowner:dvacctmgr
   MAPSCHEMA=PRIVATE
   CONTEXT=CONTEXT="c=Users, c=us"
   KREALM=EXAMPLE.COM
   
   $ORACLE_HOME/rdbms/bin/umu PHASE=TWO
   DBADMIN=dbv_acctmgr:password
   ENTADMIN=cn=jane_ent_admin,dc=example,dc=com:password
   DBLOCATION=example.com:7777:orcl
   DIRLOCATION=example.com:636
   

   By default, errors are written to the $ORACLE_HOME/network/log/umu.log file.

   Enterprise User Security (EUS) User Migration Utility (UMU) is deprecated in Oracle Database 21c. Use EUS Manager (EUSM) features instead.
10. From the Oracle Internet Directory Self Service Console (http://hostname:port/oiddas/), grant the global DV_OWNER and DV_ACCTMGR roles (for example, g_dv_owner and g_dv_acctmgr) to the enterprise user Database Vault accounts.

    See the example of creating enterprise users in Oracle Database Enterprise User Security Administrator's Guide for a demonstration of creating an enterprise role from a global role and then granting this role to a user.

11. From SQL*Plus, as user SYS with the SYSDBA administrative privilege, revoke the CREATE TABLE and SELECT_CATALOG_ROLE role from the DV_ACCTMGR user.

    REVOKE CREATE TABLE, SELECT_CATALOG_ROLE FROM dbv_acctmgr;

Oracle APEX is Oracle's primary tool for developing Web applications with SQL and PL/SQL.

You can configure and enable Oracle Database Vault to protect applications that have been developed using Oracle APEX. Oracle Database Vault can provide the same controls to Oracle APEX that are available to other applications, including custom and enterprise applications. Because Oracle APEX has its own web-based user interface to create and manage applications, as well as Oracle APEX workspaces and users, there are certain steps that you must follow so that Oracle APEX can work an Oracle database that has Oracle Database Vault enabled.

When Oracle Database Vault is enabled, additional privileges are required to install or upgrade Oracle APEX.

1. Log in to the root of the Oracle Database Vault-enabled database as a user with the DV_OWNER role.
2. Grant the DV_PATCH_ADMIN role to SYS in all pluggable databases (PDBs).

   GRANT DV_PATCH_ADMIN TO SYS CONTAINER=ALL;

3. Complete the installation of Oracle APEX as directed by Oracle APEX Installation Guide.
   If this installation includes Oracle Rest Data Services (ORDS), then see Authorizing Oracle APEX to Proxy Users for Oracle Rest Data Services.
4. As a user with the DV_OWNER role, in the container database revoke the DV_PATCH_ADMIN role from SYS from all PDBs.

   REVOKE DV_PATCH_ADMIN FROM SYS CONTAINER=ALL;

You must add the Oracle APEX schema (for example, APEX_SCHEMA) to Oracle Database Vault realms and authorizations that are required by Oracle APEX.

1. Connect to the pluggable database (PDB) of the Oracle Database Vault-enabled database as a user with the DV_OWNER role.
2. Authorize the Oracle APEX schema for the following realms, policies, and rules.
   For example, for an Oracle APEX schema called APEX_SCHEMA:

   BEGIN
    DBMS_MACADM.ADD_AUTH_TO_REALM(
    REALM_NAME      => 'Oracle Default Schema Protection Realm',
    GRANTEE         => 'APEX_SCHEMA',
    RULE_SET_NAME   => NULL,
    AUTH_OPTIONS    => DBMS_MACUTL.G_REALM_AUTH_OWNER);
   END;
   /
   
   BEGIN
    DBMS_MACADM.ADD_AUTH_TO_REALM(
    REALM_NAME      => 'Oracle System Privilege and Role Management Realm',
    GRANTEE         => 'APEX_SCHEMA',
    RULE_SET_NAME   => NULL,
    AUTH_OPTIONS    => DBMS_MACUTL.G_REALM_AUTH_OWNER);
   END;
   /
   
   BEGIN
    DBMS_MACADM.ADD_AUTH_TO_REALM(
    REALM_NAME     => 'Oracle Default Component Protection Realm',
    GRANTEE        => 'APEX_SCHEMA',
    RULE_SET_NAME  => NULL,
    AUTH_OPTIONS   => DBMS_MACUTL.G_REALM_AUTH_OWNER);
   END;
   /
   
   BEGIN
    DBMS_MACADM.ADD_AUTH_TO_REALM(
    REALM_NAME     => 'Database Vault Account Management',
    GRANTEE        => 'APEX_SCHEMA',
    RULE_SET_NAME  => NULL,
    AUTH_OPTIONS   => DBMS_MACUTL.G_REALM_AUTH_OWNER);
   END;
   /
   
   EXEC DBMS_MACADM.UPDATE_POLICY_STATE('Oracle Account Management Controls',DBMS_MACADM.G_PARTIAL);
   BEGIN 
    DBMS_MACADM.UPDATE_RULE('Is User Manager'
   ,'DVSYS.DBMS_MACUTL.USER_HAS_ROLE_VARCHAR(''DV_ACCTMGR'',SYS_CONTEXT(''userenv'',''current_user'')) = ''Y''');
   END;
   /
   
   BEGIN 
    DBMS_MACADM.UPDATE_RULE('Is Alter DVSYS Allowed'
   ,'DVSYS.DBMS_MACADM.IS_ALTER_USER_ALLOW_VARCHAR(SYS_CONTEXT(''userenv'',''current_user'')) = ''Y''');
   END;
   /

Oracle APEX uses Oracle Scheduler and must be authorized to continue to do so.

1. Connect the pluggable database (PDB) of the Oracle Database Vault-enabled database as a user with the DV_OWNER role.
2. Authorize the SYS user to use its scheduler privileges on the Oracle APEX schema.
   For example, for an Oracle APEX schema named APEX_SCHEMA:

   EXEC DBMS_MACADM.AUTHORIZE_SCHEDULER_USER('SYS','APEX_SCHEMA');

3. Authorize the Oracle APEX user to use its job scheduler privileges.

   EXEC DBMS_MACADM.AUTHORIZE_SCHEDULER_USER('APEX_SCHEMA','%');

You must authorize the Oracle APEX schema to use its DDL privileges on objects that it has access to but may be subject to additional Oracle Database Vault controls

1. Connect the pluggable database (PDB) of the Oracle Database Vault-enabled database as a user with the DV_OWNER role.
2. Authorize the Oracle APEX schema to use its DDL privileges
   For example, for an Oracle APEX schema named APEX_SCHEMA:

   EXEC DBMS_MACADM.AUTHORIZE_DDL('APEX_SCHEMA','%');

You must authorize the Oracle APEX schema to perform maintenance tasks.

1. Connect the pluggable database (PDB) of the Oracle Database Vault-enabled database as a user with the DV_OWNER role.
2. Authorize the Oracle APEX schema to use its DDL privileges.
   For example, for an Oracle APEX schema named APEX_SCHEMA:

   EXEC DBMS_MACADM.AUTHORIZE_MAINTENANCE_USER('APEX_SCHEMA','%');

If you use Oracle Rest Data Services (ORDS), then you must authorize proxy users.

1. Connect the pluggable database (PDB) of the Oracle Database Vault-enabled database as a user with the DV_OWNER role.
2. Find the existing proxy users and database users that they can proxy as.

   SELECT PROXY, CLIENT FROM PROXY_USERS;

3. Authorize the proxying of users.

   EXEC DBMS_MACADM.AUTHORIZE_PROXY_USER('proxy','client');

4. Repeat this step for each of the combinations listed in the PROXY_USERS query that you performed.

Objects that are protected by Oracle Database Vault realms and command rules are still protected after you have integrated Oracle APEX.

The same privileges and authorizations must be met before Oracle Database Vault will grant access to these objects. For example, if you create an Oracle APEX workspace that requires access to the HR schema objects, and there is an Oracle Database Vault realm protected the HR schema objects, then the workspace will be required to have authorization to access the realm.

If you have problems with the integration of Oracle APEX and Database Vault, then you can diagnose these problems using tracing and Oracle Database Vault simulation mode.

• Tracing: Trace files enable you to track the Oracle Database Vault database instance for server and background process events. Use trace file to find out if the Oracle Database Vault policy authorization succeeded or failed. They are also useful for resolving issues such as bugs and other unexpected behavior.
• Simulation mode: You can use simulation mode to capture violations in a simulation log instead of blocking SQL execution by Oracle Database Vault realms and command rules. Oracle Database Vault stores these errors in a central location so that you can easily analyze them.