of this series provided some real-life scenarios for which Oracle Label
Security (OLS) could be used to effectively enforce the corresponding business
rules and the dynamics by which OLS secures data at the row level. In this
article, we will delve into how to set up OLS on an Oracle 9i database, how to
create a security policy and its label components, and how to apply those
security label components to both end users and to the data that needs to be
Installing OLS Components
Configuring the DBMS
The first step in applying OLS security
is to configure the database and server to utilize OLS. Unfortunately, OLS is
not one of the default options when the Oracle DBMS software is first installed
on the target server; it must be selected as a custom option from the Oracle
Universal Installer (OUI).
Fortunately, if OLS was not installed
initially, this can be easily remedied via OUI. Here is a sample OUI screen
showing where to locate the option under Oracle 9iR2 for Windows; of course,
your installation may vary for UNIX or other operating systems:
1. Installing OLS from OUI.
Configuring the Database.
After installing OLS via OUI, the
corresponding database objects must be installed on the target database as
well. The Oracle Database Configuration Assistant (DBCA) allows you to install
OLS features by first selecting the Configure database options in a database
choice, supplying the SYS user id and password and then selecting the Oracle
Label Security option (see below):
2. Installing OLS Components in an existing database.
if scripts are being used to create the new database, or if the target database
already exists, OLS can be installed by logging into the target database via
SQLPLUS, connecting as the SYS user in SYSDBA mode, and then executing the $ORAHOME\rdbms\admin\catols.sql script. This script creates a new user, LBACSYS,
with a default password of LBACSYS, and creates all necessary OLS objects and
stores them in the LBACSYS schema.
important to note that both of these aforementioned steps must be
completed for OLS to work properly, otherwise the Oracle Policy Manager feature
will not be able to manage security policy information.
has been installed in the DBMS and the database via the prior steps, it is a
good idea to verify that OLS is installed successfully by checking for the
existence of the LBACSYS user and its schema objects. The following queries
verify how many objects have been created and if they are in a VALID state, and
also query DBA_REGISTRY via the following script to show what version of OLS
has been successfully installed:
GROUP BY object_type;
PACKAGE BODY 22
TYPE BODY 5
13 rows selected
COL comp_name FORMAT A32
COL version FORMAT A16
COMP_ID COMP_NAME VERSION
------------------------------ -------------------------------- ---------
CATALOG Oracle9i Catalog Views 18.104.22.168.0
CATPROC Oracle9i Packages and Types 22.214.171.124.0
OWM Oracle Workspace Manager 126.96.36.199.0
JAVAVM JServer JAVA Virtual Machine 188.8.131.52.0
XML Oracle XDK for Java 184.108.40.206.0
CATJAVA Oracle9i Java Packages 220.127.116.11.0
CONTEXT Oracle Text 18.104.22.168.0
XDB Oracle XML Database 22.214.171.124.0
OLS Oracle Label Security 126.96.36.199.0
9 rows selected
3. Results of Successful OLS Install.
If the installation
has been unsuccessful, Oracle recommends that the CATOLS script mentioned
previously should be rerun. Be aware, however, that re-executing the script
causes the destruction and recreation of the LBACSYS user and its schema's
objects, so any OLS security policies and components information previously
created in that schema will cease to exist.
note that OLS can be completely removed from a database by running the $ORAHOME\rdbms\admin\catnools.sql
script from the SYS user in SYSDBA mode.