PeopleSoft XML Publisher - 查询安全性
我们有一个 XML Publisher 模板，它使用查询（内置查询管理器）作为数据源。该查询使用包含机密数据的自定义视图。该报告供经理用来查看其直接下属的信息 - 这是通过在页面上设置参数来完成的。由于我们必须使记录可供查询使用，因此任何有权编写查询的经理也可以查看该记录，从而查看除向他们报告的员工以外的员工的数据。查询还必须是公开的，因此任何有权运行查询的人都可以使用它。我们希望能够：
仅通过页面提供查询（我想我已经得到了这个 - 该页面将传递一个附加参数，该参数将与查询的 WHERE 子句中进行比较）
隐藏自定义记录除查询/报告之外的任何人
我们不能使用典型的行级安全性，因为总经理应该只能看到向他们汇报的人员。
谢谢
We have an XML Publisher template that uses a query (built in query manager) as a data source. The query uses a custom view containing confidential data. The report is to be used by managers to view information on their direct reports - this is accomplished by setting parameters on the page. Since we have to make the record available to Query, any manager that also has permission to write queries can also see the record, and thus data on employees other than the ones that report to them. The Query also has to be public, so it too will be available to anyone that has access to run queries. We'd like to be able to:
Make the query available only via the page (I think I've got this one - the page will pass an additional parameter which will be compared to in the WHERE clause of the query)
Hide the custom record from anyone but the query/report
We cannot use typical row-level security as a general manager should only be able to see the people that report up to them.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
要对用户尝试查询特定记录（使用查询管理器）时显示的数据启用安全性，您可以使用查询安全记录，在其中可以验证尝试访问数据的用户。通常，这里使用动态视图，您可以在其中检查尝试访问数据的 OPRID，并相应地提供数据。 Querymanager会自动在sql中获取查询安全记录。
To enable security over the data that is being shown when a user tries to query a particular record (using query manager), you will can use a query security record in which you could verify the user that is trying to access the data. Generally, a dynamic view is used here wherein you could check the OPRID trying to access the data, and accordingly serve the data. Querymanager picks up the query security record automatically in the sql.
我没有太多使用 XML Publisher，但我不得不做一些与此类似的事情（减去机密性要求）。
经理手下的所有人员是否都设置在同一个部门 ID 下？ PSOPRDEFN 表存储映射到 EmplID 的 OPRID/用户 ID，您可以将其链接到 JOB 表以获取 EmplID 的 DeptID。
因此，在查询上设置一个条件，将其限制为当前用户的部门 ID。我在 Oracle 10g 中找到了如何执行此操作的语法，但当我尝试时它似乎不适用于 11g。 http://www.techonthenet.com/oracle/functions/user.php http://www.techonthenet.com/oracle/functions/sys_context.php
I haven't used XML Publisher much, but I've had to do something similar to this (minus the confidentiality requirement).
Are all of the people that work under a manager set up under the same Department ID? The PSOPRDEFN table stores OPRIDs/User IDs that map to EmplIDs, and you can link that to the JOB table to get the DeptID for the EmplID.
So set a criteria on the query to be something that limits it to the current user's Department ID. I've found syntax on how to do that in Oracle 10g, but it doesn't seem to be working for 11g when I try it. http://www.techonthenet.com/oracle/functions/user.php http://www.techonthenet.com/oracle/functions/sys_context.php