Consolidate data access control backoffice updates
This commit is contained in:
devmrko
88
docs/assets/agent-ords-security-dds-object-model.svg
Normal file
88
docs/assets/agent-ords-security-dds-object-model.svg
Normal file
@@ -0,0 +1,88 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="760" viewBox="0 0 1280 760" role="img" aria-labelledby="title desc">
|
||||
<title id="title">DDS 보안 오브젝트 모델</title>
|
||||
<desc id="desc">END USER, APPLICATION IDENTITY, DATA ROLE, DATA GRANT, 보호 객체와 중앙 확인 뷰의 관계.</desc>
|
||||
<rect width="1280" height="760" fill="#f8fafc"/>
|
||||
|
||||
<defs>
|
||||
<marker id="arrow" markerWidth="8" markerHeight="8" refX="7" refY="4" orient="auto">
|
||||
<path d="M 0 0 L 8 4 L 0 8 z" fill="#475569"/>
|
||||
</marker>
|
||||
<style>
|
||||
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 34px; font-weight: 700; fill: #0f172a; }
|
||||
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 19px; fill: #475569; }
|
||||
.label { font-family: Arial, Helvetica, sans-serif; font-size: 15px; font-weight: 700; fill: #475569; }
|
||||
.title { font-family: Arial, Helvetica, sans-serif; font-size: 22px; font-weight: 700; fill: #0f172a; }
|
||||
.text { font-family: Arial, Helvetica, sans-serif; font-size: 17px; fill: #334155; }
|
||||
.mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #1e293b; }
|
||||
.card { fill: #ffffff; stroke: #cbd5e1; stroke-width: 2; }
|
||||
.identity { fill: #eff6ff; stroke: #2563eb; stroke-width: 2; }
|
||||
.role { fill: #f5f3ff; stroke: #7c3aed; stroke-width: 2; }
|
||||
.grant { fill: #ecfdf5; stroke: #059669; stroke-width: 2; }
|
||||
.object { fill: #fff7ed; stroke: #ea580c; stroke-width: 2; }
|
||||
.audit { fill: #eef2ff; stroke: #4f46e5; stroke-width: 2; }
|
||||
.deny { fill: #fef2f2; stroke: #dc2626; stroke-width: 2; }
|
||||
.chip { fill: #ffffff; stroke: #bbf7d0; stroke-width: 1.5; }
|
||||
.arrow { stroke: #475569; stroke-width: 2.2; marker-end: url(#arrow); fill: none; }
|
||||
.dash { stroke: #64748b; stroke-width: 2; stroke-dasharray: 7 6; marker-end: url(#arrow); fill: none; }
|
||||
</style>
|
||||
</defs>
|
||||
|
||||
<text x="48" y="58" class="h1">DDS 보안 오브젝트 모델</text>
|
||||
<text x="48" y="90" class="sub">권한은 업무 매핑 테이블이 아니라 Oracle 보안 오브젝트와 DATA GRANT로 선언</text>
|
||||
|
||||
<text x="48" y="130" class="label">사용자 식별</text>
|
||||
<rect x="48" y="146" width="270" height="132" rx="8" class="identity"/>
|
||||
<text x="74" y="184" class="title">END USER</text>
|
||||
<text x="74" y="222" class="text">스키마를 소유하지 않는</text>
|
||||
<text x="74" y="248" class="text">DDS 보안 사용자</text>
|
||||
|
||||
<rect x="48" y="330" width="270" height="112" rx="8" class="card"/>
|
||||
<text x="74" y="366" class="title">APPLICATION IDENTITY</text>
|
||||
<text x="74" y="402" class="text">애플리케이션 자체 권한이</text>
|
||||
<text x="74" y="426" class="text">필요할 때 쓰는 확장</text>
|
||||
|
||||
<text x="390" y="130" class="label">역할 묶음</text>
|
||||
<rect x="390" y="146" width="270" height="132" rx="8" class="role"/>
|
||||
<text x="416" y="184" class="title">DATA ROLE</text>
|
||||
<text x="416" y="222" class="text">데이터 권한 묶음</text>
|
||||
<text x="416" y="248" class="mono">CB_DDS_HR_ROLE</text>
|
||||
|
||||
<text x="730" y="130" class="label">권한 선언</text>
|
||||
<rect x="730" y="118" width="420" height="244" rx="8" class="grant"/>
|
||||
<text x="760" y="158" class="title">DATA GRANT</text>
|
||||
<text x="760" y="194" class="text">보호 객체에 대한 작업, 행, 컬럼 범위</text>
|
||||
<rect x="760" y="218" width="358" height="36" rx="6" class="chip"/>
|
||||
<text x="780" y="242" class="mono">AS SELECT</text>
|
||||
<rect x="760" y="264" width="358" height="36" rx="6" class="chip"/>
|
||||
<text x="780" y="288" class="mono">WHERE dept_code = 'HR'</text>
|
||||
<rect x="760" y="310" width="358" height="36" rx="6" class="chip"/>
|
||||
<text x="780" y="334" class="mono">ALL COLUMNS EXCEPT contents</text>
|
||||
|
||||
<text x="730" y="410" class="label">보호 대상</text>
|
||||
<rect x="730" y="426" width="420" height="114" rx="8" class="object"/>
|
||||
<text x="760" y="466" class="title">VIEW / TABLE</text>
|
||||
<text x="760" y="502" class="mono">ADMIN.CB_DDS_V_SEARCH_DOCUMENTS</text>
|
||||
<text x="760" y="526" class="text">DATA GRANT가 있는 범위만 조회 가능</text>
|
||||
|
||||
<line x1="318" y1="212" x2="382" y2="212" class="arrow"/>
|
||||
<text x="326" y="197" class="label">GRANT</text>
|
||||
<path d="M 318 386 C 350 386, 356 246, 382 230" class="dash"/>
|
||||
<text x="330" y="352" class="label">선택 확장</text>
|
||||
<line x1="660" y1="212" x2="722" y2="212" class="arrow"/>
|
||||
<text x="684" y="197" class="label">TO</text>
|
||||
<path d="M 940 362 L 940 418" class="arrow"/>
|
||||
<text x="954" y="398" class="label">ON</text>
|
||||
|
||||
<rect x="48" y="574" width="540" height="104" rx="8" class="deny"/>
|
||||
<text x="74" y="614" class="title">DATA GRANT 없음</text>
|
||||
<text x="74" y="650" class="text">권한 미부여 END USER에게는 객체 자체가 보이지 않음</text>
|
||||
<text x="74" y="674" class="mono">ORA-00942</text>
|
||||
|
||||
<rect x="640" y="574" width="510" height="104" rx="8" class="audit"/>
|
||||
<text x="666" y="614" class="title">중앙 확인</text>
|
||||
<text x="666" y="650" class="mono">DBA_DATA_ROLE_GRANTS</text>
|
||||
<text x="666" y="674" class="mono">DBA_DATA_GRANTS / DBA_DATA_ROLES</text>
|
||||
|
||||
<rect x="48" y="704" width="1102" height="42" rx="8" fill="#ecfdf5" stroke="#059669" stroke-width="2"/>
|
||||
<text x="74" y="731" class="text">요점: DDS는 사용자별 권한을 DATA ROLE과 DATA GRANT로 선언하고, Dictionary View로 적용 상태를 확인한다.</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 5.2 KiB |
Reference in New Issue
Block a user