229 lines
7.7 KiB
MySQL
229 lines
7.7 KiB
MySQL
-- ============================================================
|
|
-- 51_kb_vpd_admin_token.sql
|
|
--
|
|
-- Creates an application-level KB VPD administrator. This is not an
|
|
-- EXEMPT ACCESS POLICY database account: the token is resolved to an
|
|
-- application context and the existing VPD policy function returns ALL
|
|
-- only because KB_VPD_ADMIN_ROLE has explicit ALL permissions.
|
|
-- ============================================================
|
|
WHENEVER SQLERROR EXIT SQL.SQLCODE
|
|
SET ECHO OFF
|
|
SET FEEDBACK ON
|
|
SET DEFINE OFF
|
|
SET SERVEROUTPUT ON
|
|
|
|
PROMPT === Creating KB VPD administrator, permissions, and one-time token ===
|
|
GRANT EXECUTE ON cb_agent_ctx_pkg TO POC_2;
|
|
|
|
DECLARE
|
|
c_stakeholder_user_id CONSTANT VARCHAR2(30) := 'KB_VPD_ADMIN';
|
|
c_role_name CONSTANT VARCHAR2(80) := 'KB_VPD_ADMIN_ROLE';
|
|
c_token_description CONSTANT VARCHAR2(200) := 'KB VPD admin full-access token';
|
|
|
|
v_admin_role_id NUMBER;
|
|
v_identity_role_id NUMBER;
|
|
v_app_user_id NUMBER;
|
|
v_permission_id NUMBER;
|
|
v_bearer_token VARCHAR2(128);
|
|
v_count NUMBER;
|
|
|
|
PROCEDURE ensure_role(
|
|
p_role_name IN VARCHAR2,
|
|
p_level IN VARCHAR2,
|
|
p_role_id OUT NUMBER
|
|
) IS
|
|
BEGIN
|
|
SELECT role_id
|
|
INTO p_role_id
|
|
FROM cb_app_role
|
|
WHERE role_name = p_role_name;
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
SELECT NVL(MAX(role_id), 0) + 1
|
|
INTO p_role_id
|
|
FROM cb_app_role;
|
|
INSERT INTO cb_app_role(role_id, role_name, max_sensitivity_level)
|
|
VALUES (p_role_id, p_role_name, p_level);
|
|
END;
|
|
|
|
PROCEDURE ensure_user_role(p_user_id IN NUMBER, p_role_id IN NUMBER) IS
|
|
BEGIN
|
|
SELECT COUNT(*)
|
|
INTO v_count
|
|
FROM cb_user_role
|
|
WHERE user_id = p_user_id
|
|
AND role_id = p_role_id;
|
|
|
|
IF v_count = 0 THEN
|
|
INSERT INTO cb_user_role(user_id, role_id) VALUES (p_user_id, p_role_id);
|
|
END IF;
|
|
END;
|
|
|
|
PROCEDURE ensure_all_permission(p_target_name IN VARCHAR2) IS
|
|
BEGIN
|
|
SELECT MIN(perm_id)
|
|
INTO v_permission_id
|
|
FROM cb_permission
|
|
WHERE role_id = v_admin_role_id
|
|
AND target_name = p_target_name
|
|
AND action_name = 'SELECT';
|
|
|
|
IF v_permission_id IS NULL THEN
|
|
SELECT cb_permission_seq.NEXTVAL INTO v_permission_id FROM dual;
|
|
INSERT INTO cb_permission(
|
|
perm_id, role_id, target_name, action_name, permission_effect
|
|
) VALUES (
|
|
v_permission_id, v_admin_role_id, p_target_name, 'SELECT', 'ALLOW'
|
|
);
|
|
ELSE
|
|
UPDATE cb_permission
|
|
SET permission_effect = 'ALLOW'
|
|
WHERE perm_id = v_permission_id;
|
|
END IF;
|
|
|
|
DELETE FROM cb_permission_rule WHERE perm_id = v_permission_id;
|
|
INSERT INTO cb_permission_rule(rule_id, perm_id, rule_column, rule_type, rule_value)
|
|
VALUES (cb_permission_rule_seq.NEXTVAL, v_permission_id, NULL, 'STATIC_SQL', '1 = 1');
|
|
|
|
-- CB_ORDS is the non-exempt data runtime. VPD still applies after
|
|
-- this object privilege is granted.
|
|
EXECUTE IMMEDIATE
|
|
'GRANT SELECT ON POC_2.' || DBMS_ASSERT.SIMPLE_SQL_NAME(p_target_name) || ' TO CB_ORDS';
|
|
END;
|
|
|
|
PROCEDURE allow_original_column(
|
|
p_target_name IN VARCHAR2,
|
|
p_column_name IN VARCHAR2
|
|
) IS
|
|
BEGIN
|
|
SELECT MIN(perm_id)
|
|
INTO v_permission_id
|
|
FROM cb_permission
|
|
WHERE role_id = v_admin_role_id
|
|
AND target_name = p_target_name
|
|
AND action_name = 'SELECT';
|
|
|
|
SELECT COUNT(*)
|
|
INTO v_count
|
|
FROM cb_permission_column
|
|
WHERE permission_id = v_permission_id
|
|
AND column_name = p_column_name;
|
|
|
|
IF v_count = 0 THEN
|
|
INSERT INTO cb_permission_column(permission_id, column_name)
|
|
VALUES (v_permission_id, p_column_name);
|
|
END IF;
|
|
END;
|
|
BEGIN
|
|
MERGE INTO poc_2.kb_stakeholders target
|
|
USING (
|
|
SELECT c_stakeholder_user_id AS user_id,
|
|
'VPD 관리자' AS user_nm,
|
|
'관리자' AS role,
|
|
'관리자채널' AS channel,
|
|
'전체 KB 원장 및 민감 컬럼 접근' AS access_scope,
|
|
'권한 테이블의 KB_VPD_ADMIN_ROLE / ALL 규칙으로 적용' AS rls_filter
|
|
FROM dual
|
|
) source
|
|
ON (target.user_id = source.user_id)
|
|
WHEN MATCHED THEN UPDATE SET
|
|
target.user_nm = source.user_nm,
|
|
target.role = source.role,
|
|
target.channel = source.channel,
|
|
target.access_scope = source.access_scope,
|
|
target.rls_filter = source.rls_filter
|
|
WHEN NOT MATCHED THEN INSERT (
|
|
user_id, user_nm, role, channel, access_scope, rls_filter
|
|
) VALUES (
|
|
source.user_id, source.user_nm, source.role, source.channel,
|
|
source.access_scope, source.rls_filter
|
|
);
|
|
|
|
BEGIN
|
|
SELECT user_id
|
|
INTO v_app_user_id
|
|
FROM cb_app_user
|
|
WHERE stakeholder_user_id = c_stakeholder_user_id;
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
SELECT NVL(MAX(user_id), 0) + 1 INTO v_app_user_id FROM cb_app_user;
|
|
INSERT INTO cb_app_user(
|
|
user_id, user_name, employee_no, dept_code,
|
|
stakeholder_user_id, can_read_contents, active
|
|
) VALUES (
|
|
v_app_user_id, 'VPD 관리자', c_stakeholder_user_id, '관리자채널',
|
|
c_stakeholder_user_id, 'Y', 'Y'
|
|
);
|
|
END;
|
|
|
|
UPDATE cb_app_user
|
|
SET user_name = 'VPD 관리자',
|
|
employee_no = c_stakeholder_user_id,
|
|
dept_code = '관리자채널',
|
|
can_read_contents = 'Y',
|
|
active = 'Y'
|
|
WHERE user_id = v_app_user_id;
|
|
|
|
ensure_role(c_role_name, 'RESTRICTED', v_admin_role_id);
|
|
ensure_role('KB_STAKEHOLDER_IDENTITY_ROLE', 'INTERNAL', v_identity_role_id);
|
|
ensure_user_role(v_app_user_id, v_admin_role_id);
|
|
ensure_user_role(v_app_user_id, v_identity_role_id);
|
|
|
|
FOR object_name IN (
|
|
SELECT column_value
|
|
FROM TABLE(sys.odcivarchar2list(
|
|
'KB_CUSTOMERS', 'KB_PRODUCTS', 'KB_CONTRACTS', 'KB_COVERAGES',
|
|
'KB_CLAIMS', 'KB_EXTERNAL_HOLDINGS', 'KB_STAKEHOLDERS'
|
|
))
|
|
) LOOP
|
|
ensure_all_permission(object_name.column_value);
|
|
END LOOP;
|
|
|
|
allow_original_column('KB_CUSTOMERS', 'CUST_NM');
|
|
allow_original_column('KB_CUSTOMERS', 'RRN_MASKED');
|
|
allow_original_column('KB_CLAIMS', 'CLAIM_AMT');
|
|
allow_original_column('KB_CLAIMS', 'PAID_AMT');
|
|
allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_INSURER');
|
|
allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_PRODUCT_GRP');
|
|
allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_PRODUCT_TYPE');
|
|
|
|
-- Re-running this script rotates the only full-access administrator token.
|
|
UPDATE cb_agent_bearer_key
|
|
SET active = 'N',
|
|
revoked_at = SYSDATE
|
|
WHERE stakeholder_user_id = c_stakeholder_user_id
|
|
AND active = 'Y';
|
|
|
|
v_bearer_token := 'kbvpdadm_' || DBMS_RANDOM.STRING('x', 48);
|
|
INSERT INTO cb_agent_bearer_key(
|
|
key_id, user_id, stakeholder_user_id, key_prefix, key_hash,
|
|
issued_at, expires_at, revoked_at, active, description
|
|
) VALUES (
|
|
cb_agent_bearer_key_seq.NEXTVAL, v_app_user_id, c_stakeholder_user_id,
|
|
'kbvpdadm', STANDARD_HASH(v_bearer_token, 'SHA256'),
|
|
SYSDATE, ADD_MONTHS(SYSDATE, 12), NULL, 'Y', c_token_description
|
|
);
|
|
|
|
COMMIT;
|
|
|
|
-- This is the application step that binds the Bearer Token to the trusted
|
|
-- context. DBMS_RLS then invokes CB_AGENT_DOC_VPD_FILTER automatically.
|
|
cb_agent_ctx_pkg.set_user_by_bearer(v_bearer_token);
|
|
DBMS_OUTPUT.PUT_LINE('STAKEHOLDER_USER_ID='
|
|
|| SYS_CONTEXT('CB_AGENT_CTX', 'STAKEHOLDER_USER_ID'));
|
|
DBMS_OUTPUT.PUT_LINE('EFFECTIVE_ROLE=' || c_role_name);
|
|
DBMS_OUTPUT.PUT_LINE('KB_CUSTOMERS_PREDICATE='
|
|
|| cb_agent_doc_vpd_filter('POC_2', 'KB_CUSTOMERS'));
|
|
DBMS_OUTPUT.PUT_LINE('KB_CLAIMS_PREDICATE='
|
|
|| cb_agent_doc_vpd_filter('POC_2', 'KB_CLAIMS'));
|
|
DBMS_OUTPUT.PUT_LINE('KB_EXTERNAL_HOLDINGS_PREDICATE='
|
|
|| cb_agent_doc_vpd_filter('POC_2', 'KB_EXTERNAL_HOLDINGS'));
|
|
cb_agent_ctx_pkg.clear_user;
|
|
|
|
-- Show once. The raw token is never stored; only its SHA-256 hash remains.
|
|
DBMS_OUTPUT.PUT_LINE('BEARER_TOKEN=' || v_bearer_token);
|
|
END;
|
|
/
|
|
|
|
PROMPT === KB VPD administrator token ready ===
|