ed91306ee3
Replaces the original APAC-vs-all 2-user demo (vpduser_a/b on KR_ANALYSTS/GLOBAL_ADMINS groups) with a 2x2 source-access matrix: vpduser_my -> MY_ONLY group -> MySQL view only vpduser_pg -> PG_ONLY group -> Postgres view only vpduser_both -> BOTH_SOURCES group -> both views vpduser_none -> (no group) -> nothing (default deny) Why: source-level segmentation is the more common production permission story than region-level filtering. Region filtering remains available as an opt-in variant via commented UPDATE in sql/adb/03_seed.sql. Key changes: - 03_seed.sql, 07_end_users.sql, 00_cleanup.sql, .env.example, run.sh updated for the new 4-user model. All 4 users get identical view GRANTs; the only differentiator is the permission table (proves the model is "data-driven, not GRANT-driven"). - 08-11 split into one file per user: my (+ 5 bypass attempts), pg, both, none (default-deny verification). - 12_tests_admin_audit.sql uses LEFT JOIN so vpduser_none shows up as NULL permissions, and filters by object_owner=USER to exclude cross-schema policies. - Removed inline "-- comment" after ";" lines in 03_seed.sql: SQL*Plus silently skipped the inserts (documented gotcha). - README.md + docs/01,02 updated for the 4-user matrix. docs/03 detailed guide keeps the region-filter example but now has a preface explaining it's a variant of the default 4-user model. - docs/04: db_type='mysql_community' note added (RDS MySQL). E2E verified: PG=0/MY=17, PG=12/MY=0, PG=12/MY=17, PG=0/MY=0 plus all 5 bypass attempts blocked. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
54 lines
2.6 KiB
Plaintext
54 lines
2.6 KiB
Plaintext
# ============================================================
|
|
# .env.example → cp .env.example .env 후 값 채워서 사용
|
|
# 모든 run.sh / scripts 가 이 파일을 source 합니다.
|
|
# 절대 .env 자체를 git 에 올리지 마세요 (.gitignore 등록됨).
|
|
# ============================================================
|
|
|
|
# --- (1) 클라이언트 도구 경로 ---
|
|
# Oracle Instant Client (sqlplus) 가 PATH 에 있어야 함.
|
|
# macOS 예: /Users/<you>/devkit/instantclient
|
|
# Linux 예: /opt/oracle/instantclient_21_12
|
|
export PATH="${HOME}/devkit/instantclient:${PATH}"
|
|
|
|
# Oracle wallet 디렉토리 (cwallet.sso, tnsnames.ora 포함된 풀린 경로)
|
|
export TNS_ADMIN="" # 예: /Users/you/devkit/Wallet_D8AUKRO81636MON0
|
|
|
|
# --- (2) ADB 접속 ---
|
|
export ADB_TNS="" # tnsnames.ora alias (예: d8aukro81636mon0_tp)
|
|
export ADB_USER="admin"
|
|
export ADB_PASSWORD="" # 비워두면 run.sh 가 read -s 로 프롬프트
|
|
# 편의: sqlplus 한 줄 connect 문자열 (자동 합성됨; 직접 안 건드려도 됨)
|
|
# export ADB_CONN="${ADB_USER}/${ADB_PASSWORD}@${ADB_TNS}"
|
|
|
|
# --- (3) 데모용 ADB 엔드유저 비밀번호 (sql/adb/07_end_users.sql 에서 사용) ---
|
|
# ADB 비번 정책: 12자 이상, 대/소/숫자/특수 조합.
|
|
# 4명의 데모 유저:
|
|
# vpduser_my → MySQL view 만 SELECT 가능
|
|
# vpduser_pg → Postgres view 만 SELECT 가능
|
|
# vpduser_both → 양쪽 view 모두 SELECT 가능
|
|
# vpduser_none → 양쪽 view 모두 fail-closed (0 rows)
|
|
export VPDUSER_MY_PASSWORD="RowFilter#My2026"
|
|
export VPDUSER_PG_PASSWORD="RowFilter#Pg2026"
|
|
export VPDUSER_BOTH_PASSWORD="RowFilter#Both26"
|
|
export VPDUSER_NONE_PASSWORD="RowFilter#None26"
|
|
|
|
# --- (4) 원격 Postgres (AWS RDS, Cloud SQL, ...) ---
|
|
# sql/source/postgres_setup.sql 가 여기로 customers 테이블/seed 생성.
|
|
# ADB 의 RDS_POSTGRES_LINK 가 이 인스턴스를 가리킴.
|
|
export PG_HOST="" # 예: vpd-poc.xxxxx.ap-northeast-2.rds.amazonaws.com
|
|
export PG_PORT="5432"
|
|
export PG_DB="vpdpoc" # CREATE DATABASE 미리 되어 있어야 함
|
|
export PG_USER="postgres"
|
|
export PG_PASSWORD=""
|
|
|
|
# --- (5) 원격 MySQL ---
|
|
export MY_HOST=""
|
|
export MY_PORT="3306"
|
|
export MY_DB="ecommerce_poc" # CREATE DATABASE 미리 되어 있어야 함
|
|
export MY_USER="admin"
|
|
export MY_PASSWORD=""
|
|
|
|
# --- (6) ADB → 원격 DB Link 이름 (관례적으로 고정 — 굳이 안 바꿔도 됨) ---
|
|
export DBLINK_PG_NAME="RDS_POSTGRES_LINK"
|
|
export DBLINK_MY_NAME="RDS_LINK"
|