Initial Oracle Deep Data Security lab kit

scenarios/04-view-bypass-mac/sql/00_schema.sql

@@ -0,0 +1,14 @@
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+
+CREATE TABLE dds_mac_accounts (
+  account_id   NUMBER PRIMARY KEY,
+  account_name VARCHAR2(100),
+  owner_name   VARCHAR2(60),
+  region       VARCHAR2(30),
+  balance      NUMBER(12,2)
+);
+
+CREATE VIEW dds_mac_accounts_view AS
+SELECT account_id, account_name, owner_name, region, balance
+FROM dds_mac_accounts;
+

scenarios/04-view-bypass-mac/sql/01_seed_data.sql

@@ -0,0 +1,8 @@
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+
+INSERT INTO dds_mac_accounts VALUES (1, 'Conta Alpha', 'emma', 'LATAM', 100000);
+INSERT INTO dds_mac_accounts VALUES (2, 'Conta Beta', 'marvin', 'LATAM', 250000);
+INSERT INTO dds_mac_accounts VALUES (3, 'Conta Gamma', 'erik', 'EMEA', 900000);
+
+COMMIT;
+

scenarios/04-view-bypass-mac/sql/02_identities.sql

@@ -0,0 +1,9 @@
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+
+CREATE END USER emma IDENTIFIED BY "Welcome1_DDS!";
+CREATE END USER marvin IDENTIFIED BY "Welcome1_DDS!";
+
+CREATE DATA ROLE account_owner_role;
+GRANT DATA ROLE account_owner_role TO emma;
+GRANT DATA ROLE account_owner_role TO marvin;
+

scenarios/04-view-bypass-mac/sql/03_data_grants.sql

@@ -0,0 +1,15 @@
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+
+CREATE OR REPLACE DATA GRANT mac_account_owner
+  AS SELECT
+  ON dds_mac_accounts
+  WHERE owner_name = ORA_END_USER_CONTEXT.username
+  TO account_owner_role;
+
+CREATE OR REPLACE DATA GRANT mac_accounts_view_broad
+  AS SELECT
+  ON dds_mac_accounts_view
+  TO account_owner_role;
+
+SET USE DATA GRANTS ONLY ON dds_mac_accounts ENABLED;
+

scenarios/04-view-bypass-mac/sql/04_test_queries.sql

@@ -0,0 +1,13 @@
+SET PAGESIZE 100
+SET LINESIZE 200
+
+PROMPT Query base table
+SELECT account_id, account_name, owner_name, region, balance
+FROM dds_mac_accounts
+ORDER BY account_id;
+
+PROMPT Query view
+SELECT account_id, account_name, owner_name, region, balance
+FROM dds_mac_accounts_view
+ORDER BY account_id;
+

scenarios/04-view-bypass-mac/sql/99_reset.sql

@@ -0,0 +1,17 @@
+BEGIN EXECUTE IMMEDIATE 'SET USE DATA GRANTS ONLY ON dds_mac_accounts DISABLED'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT mac_account_owner'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA GRANT mac_accounts_view_broad'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP VIEW dds_mac_accounts_view'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP TABLE dds_mac_accounts PURGE'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE account_owner_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP END USER emma'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+BEGIN EXECUTE IMMEDIATE 'DROP END USER marvin'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
+