Overview

RAS implements virtual users who connect as XS$NULL with individual passwords and a manipulated view of the target schema objects (including data redaction without the need for an Advanced Security license and pruning of rows, similar to VPD)...

SELECT SYS_CONTEXT('userenv','current_user') FROM dual;

SELECT SYS_CONTEXT('userenv','current_schema') FROM dual;

SELECT SYS_CONTEXT('userenv','authenticated_identity') FROM dual;

Setup

Create RAS Administrator

GRANT dba, xs_session_admin TO &RAS_ADMIN;

Create DB Role with permissions on Target Schema

CREATE ROLE &target_role;

GRANT ALL ON &target_object TO &target_role;

Create RAS Users and Roles

exec xs_principal.create_role(name => '&low_priv', enabled => true);

exec xs_principal.create_role(name => '&mid_priv', enabled => true);

exec xs_principal.create_role(name => '&top_priv', enabled => true);

GRANT &target_role TO &low_priv,&mid_priv,&top_priv;

exec xs_principal.create_user(name => '&low_user', schema => '&target_schema');

Create RAS Access Control Entities

Create masking and filtering realm policies

Associate Policies with Tables

Bibliography