Read Only Schema in Oracle APPS 11i

Written by Anil Passi Saturday, 02 September 2006 In this article I have discussed how to create and maintain a read only schema for APPS in Oracle eBusiness Suite.

| Print |


Whilst in the past I have known clients to implement this using synonyms. However the approach discussed below is designed without the need of having to create a single synonym in APPS_QUERYschema. Step 1 Create the read-only schema, in this case lets call it APPS_QUERY. Step 2. Surely, the schema created in above Step 1 will be given read only grants to objects in apps. There will be cases where the grant command might fail. To monitor such failures create a table as below conn xx_g4g/&2 ;

--For APPS_QUERY. This table will capture the exceptions during Grants PROMPT create table XX_GRANTS_FAIL_APPS_QUERY create table XX_GRANTS_FAIL_APPS_QUERY ( object_name VARCHAR2(100) ,sqlerrm varchar2(2000) ,creation_date DATE );

grant all on XX_GRANTS_FAIL_APPS_QUERY to apps with grant option; grant select on XX_GRANTS_FAIL_APPS_QUERY to apps_query ; Step 3 In this step we grant select on all the existing views and synonyms in apps schema to apps_query.

conn apps/&1 ; PROMPT This can take upto 15-30 minutes PROMPT Granting SELECT on All synonyms and views to apps_query DECLARE --One off script to execute grants to apps_query v_error VARCHAR2(2000); BEGIN FOR p_rec IN (SELECT * FROM all_objects WHERE owner = 'APPS' AND object_type IN ('SYNONYM', 'VIEW') AND object_name NOT LIKE '%_S') LOOP BEGIN EXECUTE IMMEDIATE 'grant select on ' || p_rec.object_name || ' to apps_query'; EXCEPTION WHEN OTHERS THEN v_error := substr(SQLERRM, 1, 2000); INSERT INTO bes.XX_GRANTS_FAIL_apps_query (object_name ,SQLERRM ,creation_date ) VALUES (p_rec.object_name ,v_error ,sysdate ); END; END LOOP; COMMIT; END; /
Step 4

BEGIN IF (ora_dict_obj_type IN ('SYNONYM'.Write a after logon trigger on apps_query schema. end.'. REPLACE(l_str. Note 4 ALTER SESSION SET CURRENT_SCHEMA =APPS This facilitates users to run their queries as if they were connected to apps schema.SCHEMA DECLARE l_str VARCHAR2(255). you will then have to set the org I'd after loggiong on to apps query schema. END. PROMPT CREATE OR REPLACE TRIGGER xx_grant_apps_query CREATE OR REPLACE TRIGGER xx_grant_apps_query --16Jun2006 By Anil Passi -AFTER CREATE ON APPS. then would have been set as in Step 4 above. Note 2 Only views and synonyms will be granted access. Please note that. 'VIEW')) AND (ora_dict_obj_name NOT LIKE '%_S') THEN l_str := 'execute immediate "grant select on ' || ora_dict_obj_name || ' to apps_query". all the APPS objects (views and synonyms) that existed in APPS schema prior to the implementation of this design. would have been granted read-only access to apps_query in Step 2.submit(l_job. but yet retaining apps_query resitrictions --Also sets the org_id AFTER logon ON apps_query. In case you have only one single ORG_ID. conn apps/&1 . Please note that I am excluding grants for sequences.In doing so your logon will retain the permissions of apps_query schema(read_only). / Step 5 Create a Trigger on the apps schema to issue select only grants for all new views and synonyms. SELECT grants for views and synonyms will be provided to apps_query as and when such objects are created in APPS. The main purpose of this trigger is to alter the session to apps schema. Howerver it will be able to reference the apps objects with exactly the same name as does a direct connection to apps schema. Note 3 If your site has multi org enabled. '''')). END. conn apps/&1 . END IF.SCHEMA DECLARE BEGIN EXECUTE IMMEDIATE 'declare begin ' || 'dbms_application_info. PROMPT CREATE OR REPLACE TRIGGER xx_apps_query_logon_trg CREATE OR REPLACE TRIGGER xx_apps_query_logon_trg --16Jun2006 By Anil Passi --Trigger to toggle schema to apps. EXECUTE IMMEDIATE 'ALTER SESSION SET CURRENT_SCHEMA =APPS'. their previliges will be restricted to those of apps_query Note 5 It is assumed that ALTER SESSION privilege will exist for APPS_QUERY schema. dbms_job. such that the CurrentSchema will be set to apps for the session(whilst retaining apps_query restrictions). .set_client_info ( 101 ). '"'.'. Objects in your xx_g4g(bespoke) schema should have their synonyms in apps already in place. You will need to agree with your DBAs upfront for the permissions. Most importantly it must not be given grant for “EXECUTE/CREATE ANY PROCEDURE”. l_job NUMBER. However. / Some notes for this design Note1 You need to ensure that the schema created in Step 1 has very limited permissions.

Sign up to vote on this title
UsefulNot useful