[Developer] #567 use backoffice account for SQL evidence
This commit is contained in:
@@ -94,16 +94,6 @@ public class OrdsMetadataService {
|
||||
.toList();
|
||||
}
|
||||
|
||||
/**
|
||||
* Uses the optional CB_ORDS metadata connection when configured. SQL cursor
|
||||
* evidence must be read from the parsing schema's database context, rather
|
||||
* than from an unrelated backoffice connection.
|
||||
*/
|
||||
public JdbcTemplate executionEvidenceJdbcTemplate() {
|
||||
return ordsMetadataJdbcTemplate;
|
||||
}
|
||||
|
||||
|
||||
public String objectQueryHandlerSource(long objectId) {
|
||||
ProtectedObject object = protectedObjectService.assertEnabled(objectId);
|
||||
rejectGenericVectorHandler(object);
|
||||
|
||||
@@ -60,7 +60,6 @@ public class OrdsProbeService {
|
||||
private final ObjectMapper objectMapper;
|
||||
private final SettingService settingService;
|
||||
private final JdbcTemplate jdbcTemplate;
|
||||
private final OrdsMetadataService ordsMetadataService;
|
||||
private final Clock clock;
|
||||
|
||||
public OrdsProbeService(
|
||||
@@ -72,7 +71,6 @@ public class OrdsProbeService {
|
||||
ObjectMapper objectMapper,
|
||||
SettingService settingService,
|
||||
JdbcTemplate jdbcTemplate,
|
||||
OrdsMetadataService ordsMetadataService,
|
||||
Clock clock
|
||||
) {
|
||||
this.tokenService = tokenService;
|
||||
@@ -83,7 +81,6 @@ public class OrdsProbeService {
|
||||
this.objectMapper = objectMapper;
|
||||
this.settingService = settingService;
|
||||
this.jdbcTemplate = jdbcTemplate;
|
||||
this.ordsMetadataService = ordsMetadataService;
|
||||
this.clock = clock;
|
||||
}
|
||||
|
||||
@@ -259,8 +256,8 @@ public class OrdsProbeService {
|
||||
if (evidence == null) {
|
||||
if (lookup.sqlCatalogAccessUnavailable()) {
|
||||
return result.withExecutionEvidence(null,
|
||||
"SQL_ID 실행 증적을 수집할 권한이 없습니다. 현재 권한 검증 결과는 정상입니다. "
|
||||
+ "DBA에게 ORDS 실행 계정의 V$SQL 및 DBMS_XPLAN 조회 권한을 요청하세요.");
|
||||
"백오피스 DB 연결이 실제 DB cursor SQL을 읽지 못했습니다. 현재 권한 검증 결과는 정상입니다. "
|
||||
+ "V$SQL과 DBMS_XPLAN은 일반 데이터 접근과 별도인 SYS 진단 권한입니다.");
|
||||
}
|
||||
return result.withExecutionEvidence(null,
|
||||
"최근 2분 내 이 보호 대상의 실행 cursor를 찾지 못했습니다. "
|
||||
@@ -279,24 +276,11 @@ public class OrdsProbeService {
|
||||
}
|
||||
|
||||
private ExecutionEvidenceLookup findRecentExecutionEvidence(ProtectedObject object) {
|
||||
JdbcTemplate evidenceJdbcTemplate = ordsMetadataService.executionEvidenceJdbcTemplate();
|
||||
boolean sqlCatalogAccessUnavailable = false;
|
||||
try {
|
||||
SqlExecutionEvidence evidence = findRecentExecutionEvidence(evidenceJdbcTemplate, object);
|
||||
if (evidence != null || evidenceJdbcTemplate == jdbcTemplate) {
|
||||
return new ExecutionEvidenceLookup(evidence, false);
|
||||
}
|
||||
} catch (RuntimeException exception) {
|
||||
sqlCatalogAccessUnavailable = isSqlCatalogAccessUnavailable(exception);
|
||||
log.debug("ORDS parsing-schema cursor evidence is unavailable: {}", exception.getMessage());
|
||||
}
|
||||
try {
|
||||
return new ExecutionEvidenceLookup(
|
||||
findRecentExecutionEvidence(jdbcTemplate, object), sqlCatalogAccessUnavailable);
|
||||
return new ExecutionEvidenceLookup(findRecentExecutionEvidence(jdbcTemplate, object), false);
|
||||
} catch (RuntimeException exception) {
|
||||
log.debug("Backoffice cursor evidence is unavailable: {}", exception.getMessage());
|
||||
return new ExecutionEvidenceLookup(null,
|
||||
sqlCatalogAccessUnavailable || isSqlCatalogAccessUnavailable(exception));
|
||||
return new ExecutionEvidenceLookup(null, isSqlCatalogAccessUnavailable(exception));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user