Wie in DB2 können die möglichen sinnvollen Werte-Kombinationen der Security Policy mit ihren Komponenten als Labels definiert werden. In Oracle werden ihnen numerische Label-Tags zugeordnet, die so gewählt werden können, dass sie für Gruppierung oder Sortierung in Auswertungen nutzbar sind.
Definition von Daten-Labels:
| 1 | BEGIN |
| 2 | SA_LABEL_ADMIN.CREATE_LABEL( |
| 3 | policy_name => 'PERSDAT' |
| 4 | ,label_tag => 1 |
| 5 | ,label_value => 'LTA::GF' |
| 6 | ,data_label => TRUE |
| 7 | ); |
| 8 | SA_LABEL_ADMIN.CREATE_LABEL( |
| 9 | policy_name => 'PERSDAT' |
| 10 | ,label_tag => 2 |
| 11 | ,label_value => 'LTA::IT' |
| 12 | ,data_label => TRUE |
| 13 | ); |
| 14 | ::: |
| 15 | SA_LABEL_ADMIN.CREATE_LABEL( |
| 16 | policy_name => 'PERSDAT' |
| 17 | ,label_tag => 10 |
| 18 | ,label_value => 'AT::ITZ' |
| 19 | ,data_label => TRUE |
| 20 | ); |
| 21 | SA_LABEL_ADMIN.CREATE_LABEL( |
| 22 | policy_name => 'PERSDAT' |
| 23 | ,label_tag => 11 |
| 24 | ,label_value => 'AT::MA' |
| 25 | ,data_label => TRUE |
| 26 | ); |
| 27 | ::: |
| 28 | SA_LABEL_ADMIN.CREATE_LABEL( |
| 29 | policy_name => 'PERSDAT' |
| 30 | ,label_tag => 20 |
| 31 | ,label_value => 'TARIF::EK' |
| 32 | ,data_label => TRUE |
| 33 | ); |
| 34 | SA_LABEL_ADMIN.CREATE_LABEL( |
| 35 | policy_name => 'PERSDAT' |
| 36 | ,label_tag => 21 |
| 37 | ,label_value => 'TARIF::FE' |
| 38 | ,data_label => TRUE |
| 39 | ); |
| 40 | END; |
| 41 | / |
Definition der Benutzer-Label und deren Zuordnung zu User-IDs:
| 1 | BEGIN |
| 2 | SA_USER_ADMIN.SET_USER_LABELS( |
| 3 | policy_name => 'PERSDAT' |
| 4 | ,user_name => 'GF1' |
| 5 | ,max_read_label => 'LTA::GF' |
| 6 | ); |
| 7 | SA_USER_ADMIN.SET_USER_LABELS( |
| 8 | policy_name => 'PERSDAT' |
| 9 | ,user_name => 'HR_GL' |
| 10 | ,max_read_label => 'LTA::GF' |
| 11 | ); |
| 12 | SA_USER_ADMIN.SET_USER_LABELS( |
| 13 | policy_name => 'PERSDAT' |
| 14 | ,user_name => 'FE_MAN' |
| 15 | ,max_read_label => 'AT::FE' |
| 16 | ); |
| 17 | SA_USER_ADMIN.SET_USER_LABELS( |
| 18 | policy_name => 'PERSDAT' |
| 19 | ,user_name => 'HR_SB2' |
| 20 | ,max_read_label => 'AT::GF' |
| 21 | ); |
| 22 | ::: |
| 23 | SA_USER_ADMIN.SET_USER_LABELS( |
| 24 | policy_name => 'PERSDAT' |
| 25 | ,user_name => 'HR_SB3' |
| 26 | ,max_read_label => 'TARIF::IT' |
| 27 | ); |
| 28 | END; |
| 29 | / |
