73 lines
4.2 KiB
XML
73 lines
4.2 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" width="1240" height="700" viewBox="0 0 1240 700" role="img" aria-labelledby="title desc">
|
|
<title id="title">DDS Bearer Key 처리 검증</title>
|
|
<desc id="desc">ORDS Handler가 Bearer Key를 읽어도 DDS EndUserSecurityContext가 붙지 않으면 DATA GRANT가 Key 사용자를 인식하지 못하는 흐름.</desc>
|
|
<rect width="1240" height="700" fill="#f8fafc"/>
|
|
<defs>
|
|
<marker id="arrow" markerWidth="9" markerHeight="9" refX="7.5" refY="4.5" orient="auto">
|
|
<path d="M 0 0 L 9 4.5 L 0 9 z" fill="#475569"/>
|
|
</marker>
|
|
<style>
|
|
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 35px; font-weight: 700; fill: #0f172a; }
|
|
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 20px; fill: #475569; }
|
|
.title { font-family: Arial, Helvetica, sans-serif; font-size: 21px; font-weight: 700; fill: #0f172a; }
|
|
.text { font-family: Arial, Helvetica, sans-serif; font-size: 17px; fill: #334155; }
|
|
.mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #0f172a; }
|
|
.mono-small { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #0f172a; }
|
|
.card { fill: #ffffff; stroke: #cbd5e1; stroke-width: 2.2; }
|
|
.ok { fill: #ecfdf5; stroke: #059669; stroke-width: 2.2; }
|
|
.warn { fill: #fff7ed; stroke: #ea580c; stroke-width: 2.2; }
|
|
.bad { fill: #fef2f2; stroke: #dc2626; stroke-width: 2.2; }
|
|
.driver { fill: #eff6ff; stroke: #2563eb; stroke-width: 2.2; }
|
|
.arrow { stroke: #475569; stroke-width: 2.2; marker-end: url(#arrow); fill: none; }
|
|
.dash { stroke: #94a3b8; stroke-width: 2.2; stroke-dasharray: 8 7; marker-end: url(#arrow); fill: none; }
|
|
</style>
|
|
</defs>
|
|
|
|
<text x="42" y="56" class="h1">DDS Bearer Key 검증 결과</text>
|
|
<text x="42" y="90" class="sub">ORDS Handler의 Header 매핑과 DDS EndUserSecurityContext 전파는 별도 단계</text>
|
|
|
|
<rect x="42" y="126" width="320" height="122" rx="10" class="card"/>
|
|
<text x="68" y="166" class="title">1. Agent 요청</text>
|
|
<text x="68" y="204" class="mono">Authorization:</text>
|
|
<text x="68" y="230" class="mono">Bearer cb_hr_key</text>
|
|
|
|
<line x1="362" y1="187" x2="432" y2="187" class="arrow"/>
|
|
|
|
<rect x="448" y="126" width="344" height="122" rx="10" class="ok"/>
|
|
<text x="474" y="166" class="title">2. ORDS Handler</text>
|
|
<text x="474" y="204" class="text">Header 필수값 확인</text>
|
|
<text x="474" y="230" class="text">Key를 내부 사용자로 매핑</text>
|
|
|
|
<line x1="792" y1="187" x2="862" y2="187" class="arrow"/>
|
|
|
|
<rect x="878" y="126" width="320" height="122" rx="10" class="warn"/>
|
|
<text x="904" y="166" class="title">3. DB Session</text>
|
|
<text x="904" y="204" class="mono">SESSION_USER = CB_ORDS</text>
|
|
<text x="904" y="230" class="mono">DDS username = null</text>
|
|
|
|
<path d="M 1038 248 C 1038 302, 620 302, 620 346" class="arrow"/>
|
|
|
|
<rect x="448" y="346" width="344" height="142" rx="10" class="bad"/>
|
|
<text x="474" y="386" class="title">검증된 차단 결과</text>
|
|
<text x="474" y="424" class="mono-small">mapped_end_user=cb_dds_hr</text>
|
|
<text x="474" y="452" class="mono">dds_context_username=null</text>
|
|
<text x="474" y="480" class="mono">ORA-00942 / EXPECTED_BLOCKED</text>
|
|
|
|
<path d="M 448 417 C 344 417, 318 312, 250 260" class="dash"/>
|
|
<text x="82" y="310" class="text">Key 사용자명을 변수로</text>
|
|
<text x="82" y="335" class="text">보관하는 것만으로는</text>
|
|
<text x="82" y="360" class="text">DDS 사용자가 되지 않음</text>
|
|
|
|
<rect x="42" y="540" width="530" height="104" rx="10" class="driver"/>
|
|
<text x="68" y="580" class="title">DDS로 Bearer 적용 시 필요한 경로</text>
|
|
<text x="68" y="610" class="text">지원 드라이버 또는 호출 앱 계층이</text>
|
|
<text x="68" y="634" class="text">DB 호출 전에 EndUserSecurityContext Attach</text>
|
|
|
|
<line x1="572" y1="592" x2="642" y2="592" class="arrow"/>
|
|
|
|
<rect x="658" y="540" width="540" height="104" rx="10" class="ok"/>
|
|
<text x="684" y="580" class="title">DDS DATA GRANT 적용</text>
|
|
<text x="684" y="610" class="text">DB가 End-user Identity와 DATA ROLE 인식</text>
|
|
<text x="684" y="634" class="text">보호 객체(VIEW/TABLE) 조회 허용</text>
|
|
</svg>
|