7 Configuring Factors

7.1 What Are Factors?

A factor is a named variable or attribute, such as a user location, database IP address, or session user, that Oracle Database Vault can recognize. You can use factors for activities such as authorizing database accounts to connect to the database or creating filtering logic to restrict the visibility and manageability of data.

Oracle Database Vault provides a selection of factors that lets you set controls on such components as the domain for your site, IP addresses, databases, and so on. "Default Factors" describes the default factors in detail. You also can create custom factors, using your own PL/SQL retrieval methods.

You can use factors in combination with rules in rule sets. The DVF factor functions described in "Oracle Database Vault PL/SQL Factor Functions" are factor-specific functions that you can use in rule expressions.

Factors have values (identities) and are further categorized by their factor types. "Factor Identification" explains more about factor identities. See "Factor Type" under "General" for information about factor types.

You also can integrate factors with Oracle Label Security labels. "Integrating Oracle Database Vault with Oracle Label Security" explains how. See "Example of Integrating Oracle Database Vault with Oracle Label Security" for more information.

You can run reports on the factors that you create in Oracle Database Vault. See "Related Reports" for more information.

This chapter explains how to configure factors by using Oracle Database Vault Administrator. To configure factors by using the PL/SQL interfaces and packages provided by Oracle Database Vault, refer to the following appendixes:

• Appendix H, "PL/SQL Interfaces to Oracle Database Vault"

• Appendix E, "Oracle Database Vault DVSYS.DBMS_MACADM Package"

7.2 Default Factors

Oracle Database Vault provides a set of default factors. You can create custom factors based on these default factors using your own PL/SQL retrieval methods. See "Oracle Database Vault PL/SQL Factor Functions" for a listing of the PL/SQL functions for these factors.

You can use the default factors in your own security configurations. If you do not need them, you can remove them. (That is, they are not needed for internal use by Oracle Database Vault.)

• Authentication_Method: Returns the method of authentication. In the list that follows, the type of user is followed by the method returned:

  • Password-authenticated enterprise user, local database user, or SYSDBA/SYSOPER using Password File; proxy with user name using password: PASSWORD

  • Kerberos-authenticated enterprise or external user: KERBEROS

  • SSL-authenticated enterprise or external user: SSL

  • Radius-authenticated external user: RADIUS

  • Operating system-authenticated external user or SYSDBA/SYSOPER: OS

  • DCE-authenticated external user: DCE

  • Proxy with certificate, distinguished name (DN), or user name without using password: NONE

  You can use IDENTIFICATION_TYPE to distinguish between external and enterprise users when the authentication method is Password, Kerberos, or SSL.

• Client_IP: Defines the IP address and retrieval method for a client to the database server.

• Database_Domain: Defines the domain of the database as specified in the DB_DOMAIN initialization parameter.

• Database_Hostname: Defines the host name and retrieval method for a database.

• Database_Instance: Defines the instance identifier and retrieval method for a database instance.

• Database_IP: Defines the IP address and retrieval method for a database server.

• Database_Name: Defines the name of the database as specified in the DB_NAME initialization parameter.

• Domain: Defines a named collection of physical, configuration, or implementation-specific factors in the run-time environment (for example, a networked IT environment or subset of it) that operates at a specific sensitivity level. You can identify a domain using factors such as host name, IP address, and database instance names of the Database Vault nodes in a secure access path to the database. Each domain can be uniquely determined using a combination of the factor identifiers that identify the domain. You can use these identifying factors and possibly additional factors to define the Maximum Security Label within the domain. This restricts data access and commands, depending on the physical factors about the Database Vault session. Example domains of interest may be Corporate Sensitive, Internal Public, Partners, and Customers.

• Enterprise_Identity: Returns enterprise-wide identity for the user:

  • For enterprise users: the Oracle Internet Directory-distinquished name (DN).

  • For external users: the external identity (Kerberos principal name, Radius and DCE schema names, operating system user name, certificate DN).

  • For local users and SYSDBA/SYSOPER logins: NULL.

  The value of the attribute differs by proxy method:

  • For a proxy with DN: the Oracle Internet Directory DN of the client.

  • For a proxy with certificate: the certificate DN of the client for external users; the Oracle Internet Directory DN for global users.

  • For a proxy with user names: the Oracle Internet Directory DN if the client is an enterprise user; NULL if the client is a local database user.

• Identification_Type: Returns the way the user schema was created in the database. Specifically, it reflects the IDENTIFIED clause in the CREATE/ALTER USER syntax. In the list that follows, the syntax used during schema creation is followed by the identification type returned:

  • IDENTIFIED BY password: LOCAL

  • IDENTIFIED EXTERNALLY: EXTERNAL

  • IDENTIFIED GLOBALLY: GLOBAL SHARED

  • IDENTIFIED GLOBALLY AS DN: GLOBAL PRIVATE

• Lang: Returns the ISO abbreviation for the language name, a shorter form than the existing LANGUAGE parameter.

• Language: Returns the language and territory your session currently uses, along with the database character set, in the following form:

  language_territory.characterset
  

  For example:

  AMERICAN_AMERICA.WE8MSWIN1252
  

  Refer to Oracle Database Globalization Support Guide for more information about languages, territories, and character sets.

• Machine: Returns the name of the computer that was used for the current session. If you need to find out whether the computer was used for a client or server session, you can compare this setting with the Database_Hostname factor to make the determination.

• Network_Protocol: Returns the network protocol being used for communication, as specified in the PROTOCOL=protocol portion of the connect string.

• Proxy_Enterprise_Identity: Returns the Oracle Internet Directory DN when the proxy user is an enterprise user.

• Proxy_User: Returns the name of the database user who opened the current session on behalf of SESSION_USER.

• Session_User: Returns the database user name by which the current user is authenticated. This value remains the same throughout the session.

7.3 Creating a Factor

In general, to create a factor, you first create the factor itself, and then you edit the factor to include its identity. "Guidelines for Designing Factors" provides advice on designing factors.

To create a factor:

1. Log in to Oracle Database Vault Administrator using a database account that has been granted the DV_OWNER role.

   At a minimum, you must have the DV_ADMIN role. "Starting Oracle Database Vault Administrator" explains how to log in.

2. In the Administration page, under Database Vault Feature Administration, click Factors.

3. In the Factors page, click Create.

4. In the Create Factor page, enter the following settings, and then click OK:

   • General

   • Factor Identification

   • Evaluation

   • Factor Labeling

   • Retrieval Method

   • Validation Method

   • Assignment Rule Set

   • Audit Options

   • Error Options

General

In the General area, enter the following information:

• Name: Enter a name up to 30 characters in mixed-case, without spaces. Oracle Database Vault will create a valid Oracle identifier for the factor function to be created in the DVF schema based on the name of the factor chosen. For example, if you create a factor named Network, Oracle Database Vault creates the DVF.F$NETWORK function. This attribute is mandatory.

  "Oracle Database Vault PL/SQL Factor Functions" describes the DVF factor functions.

• Description: Enter a text description of the factor. It can have up to 1024 characters in mixed-case. This attribute is optional.

• Factor Type: From the list, select the type or category of the factor. This attribute is mandatory.

  Factor types have a name and description and are used only to help classify factors. A factor type is the category name used to classify the factor. The default physical factor types include authentication method, host name, host IP address, instance identifiers, database account information, and others. (See "Default Factors" for more information.) You can create user-defined factor types, such as application name, certificate information, and so on in addition to the installed factor types, such as time and geography.

  Note:

  To create user-defined factor types by using the Oracle Database Vault DVSYS.DBMS_MACADM package, use the CREATE_FACTOR_TYPE procedure, described in "CREATE_FACTOR_TYPE Function".

Factor Identification

Under Factor Identification, select how to resolve the identity of a factor. This attribute is mandatory. The values are as follows:

• By Method (default): Sets the factor identity by executing the PL/SQL expression specified in the Retrieval Method field.

  For example, suppose the expression retrieves the system date:

  to_char(sysdate,'yyyy-mm-dd')
  

  On March 23, 2007, the By Method option would return the following value:

  2007-04-23
  

• By Constant: Resolves the factor identity by retrieving the constant value found in the Retrieval Method field.

• By Factors: Determines the factor identity by mapping the identities of the child factor to its parent factor. A parent factor is a factor whose values are resolved based on a second factor, called a child factor. To establish their relationship, you map their identities. (You do not need to specify a Retrieval Method expression for this option.)

  See "Mapping an Identity" for more information about mapping identities.

A factor identity is the actual value of a factor, for example, the IP address for a factor that uses the IP_Address type. A factor can have several identities depending on its retrieval method or its identity mapping logic. For example, a factor such as Database_Hostname could have multiple identities in an Oracle Real Application Clusters environment; a factor such as Client_IP can have multiple identities in any RDBMS environment. The retrieval method for these types of factors may return different values because the retrieval method is based on the database session.

Several reports allow you to track the factor identity configuration. See "Related Reports" for more information.

You can configure the assignment of a factor in the following ways:

• Assign the factor at the time a database session is established.

• Configure individual requests to retrieve the identity of the factor.

With the Oracle Label Security integration, you can label identities with an Oracle Label Security label. You can also assign an identity trust levels, which are numbers that indicate the magnitude of trust relative to other identities for the same factor. In general, the higher the trust level number is set, the greater the trust. Negative trust levels are not trusted.

Within a database session, a factor assigned identity is available to Oracle Database Vault and any application with a publicly accessible PL/SQL function that exists in the DVF schema (which contains functions that retrieve factor values) as follows:

dvf.f$factor_name

This allows the identifier for a factor to be accessed globally from within the Oracle database (using PL/SQL, SQL, Oracle Virtual Private Database, triggers, and so on). For example:

SQL> CONNECT macadmin/
Enter password: password    
SQL> SELECT dvf.f$database_ip FROM dual;
F$DATABASE_IP
-------------------------------------------------------------
172.16.0.3

You can also use the DVSYS.GET_FACTOR function to determine the identity of a factor that is made available for public access. For example:

SQL> SELECT get_factor('DATABASE_IP') FROM dual;
GET_FACTOR('DATABASE_IP')
-------------------------------------------------------------
172.16.0.3

Evaluation

Under Evaluation, select how you want the factor to be evaluated and assigned an identity. See "How Factors Affect Performance" for the performance effect of session factors. This attribute is mandatory.

The values are as follows:

• By Session (default): Evaluates the factor when a database session is created.

• By Access: Evaluates the factor each time it is accessed (say, referenced by an application) as well as when the database session is first created.

Factor Labeling

Under Factor Labeling, select how you want the factor identity to retrieve an Oracle Label Security (OLS) label. This setting applies if you plan to use the Oracle Label Security integration. This attribute is mandatory if you want to use an OLS label. (See also "Integrating Oracle Database Vault with Oracle Label Security" for information on integrating OLS labels with a factors.

The values are as follows:

• By Self (default): Labels the identities for the factor directly from the labels associated with an Oracle Label Security policy.

• By Factors: If there are multiple child factor labels, Oracle Database Vault merges the labels by using the Oracle Label Security Algorithm page that is associated with the applicable Oracle Label Security policy. For each applicable Oracle Label Security policy, a factor identity can have an assigned label.

Retrieval Method

Under Retrieval Method, enter a PL/SQL expression that retrieves the identity of a factor or a constant. It can use up to 255 characters in mixed-case. The Retrieval Method identifies factors where the factor identification is by method or constant. If the factor identification is by factors, Oracle Database Vault identifies it by its identity mappings.

You can create your own PL/SQL retrieval methods, or use the functions supplied with Oracle Database Vault. See the following sections for factor-specific and general utility functions that you can use to build the retrieval method:

• "Oracle Database Vault PL/SQL Factor Functions"

• "Factor Functions Within DVSYS.DBMS_MACADM"

• Appendix G, "Oracle Database Vault DVSYS.DBMS_MACUTL Package"

The following retrieval method sets a value of the DB_NAME factor by retrieving the database name (DB_NAME) from the USERENV namespace in a user's session.

UPPER(SYS_CONTEXT('USERENV','DB_NAME'))

See also the default factors provided with Oracle Database Vault for examples of retrieval methods. "Default Factors" describes these factors.

The Retrieval Method field is mandatory if you have selected the following settings under Factor Identification:

• By Method: Enter a method in the Retrieval Method field.

• By Constant: Enter a constant in the Retrieval Method field.

The value returned as the factor identity must be a VARCHAR2 string or otherwise convertible to one.

You can include any package function or standalone function in the expression. Ensure that the expression is a fully qualified function, such as schema.function_name. Do not include complete SQL statements. If you are using application packages or functions, you must provide DVSYS with the GRANT EXECUTE privilege on the object.

Write the function signature using the following format:

FUNCTION get_factor RETURN VARCHAR2

Validation Method

Under Validation Method, enter a PL/SQL expression that returns a Boolean value (TRUE or FALSE) to validate the identity of a factor being retrieved (with the DVSYS.GET_FACTOR function) or the value to be assigned to a factor (with the DVSYS.SET_FACTOR function). If the method is evaluated to false for the value being retrieved or to be assigned, then the factor identity is set to null. This optional feature provides an additional level of assurance that the factor is properly retrieved and set. This field can have up to 255 characters in mixed-case.

You can include any package function or standalone function in the expression. Ensure that the expression is a fully qualified function, such as schema.function_name. Do not include complete SQL statements. If you are using application packages or functions, you must provide DVSYS with the GRANT EXECUTE privilege on the object.

Write the function using one of the following formats:

• FUNCTION is_valid RETURN BOOLEAN

  In this form, you can use the DVF.F$factor_name function inside the function logic. This is more appropriate for factors that are evaluated by session.

• FUNCTION is_valid(p_factor_value VARCHAR2) RETURN BOOLEAN

  In this form, the factor value is passed to the validation function directly. This is more appropriate for factors that are evaluated by access. It is also valid for factors evaluated by session.

See the following sections for factor-specific and general utility functions that you can use to build the validation method:

• "Oracle Database Vault PL/SQL Factor Functions"

• "Factor Functions Within DVSYS.DBMS_MACADM"

• Appendix G, "Oracle Database Vault DVSYS.DBMS_MACUTL Package"

Assignment Rule Set

Under Assignment Rule Set, select a rule set from the list if you want to use a rule set to control when and how a factor identity is set. For example, you can use a rule set to determine when a database session originates from a known application server or program. Chapter 5, "Configuring Rule Sets" explains how to create rule sets.

This attribute is particularly useful for situations where database applications, such as a Web application using a JDBC connection pool, must dynamically set a factor identity for the current database session. For example, a Web application may want to assign the geographic location for a database account logging in to the Web application. To do so, the Web application can use the JDBC Callable Statement, or Oracle Data Provider for .NET (ODP.NET) to execute the PL/SQL function DVSYS.SET_FACTOR, for example:

DVSYS.SET_FACTOR('GEO_STATE','VIRGINIA');

Then you can create an assignment rule for the GEO_STATE factor to allow or disallow the setting of the GEO_STATE factor based on other factors or rule expressions. See "How Factors Are Set" for more information.

Audit Options

Under Audit Options, select from the settings to generate a custom Oracle Database Vault audit record. You can use the Factor Audit Report to display the generated audit records. (See "Related Reports" for more information.) In addition, you can select multiple audit options at a time. Each option is converted to a bit mask and added to determine the aggregate behavior. Note that there is little performance impact in auditing, unless the factor has errors. This attribute is mandatory.

The values are as follows:

• Never: Does not audit.

• Always: Always creates an audit record when a factor is evaluated. You can select from the conditions, described next.

• Sometimes: Creates an audit record based on one or more conditions. When you select Sometimes, by default the Retrieval Error and Retrieval NULL options are selected.

  You can select from the following conditions listed next.

Conditions that you can select for the Always and Sometimes options are as follows:

• Retrieval Error: Creates an audit record when the identity of a factor cannot be resolved and assigned, due to an error (such as No data found or Too many rows).

• Retrieval NULL: Creates an audit record when the identity of a factor is resolved to NULL.

• Validation Error: Creates an audit record when the validation method (if provided) returns an error.

• Validation False: Creates an audit record when the validation method (if provided) returns FALSE.

• Trust Level NULL: Creates an audit record when the resolved identity of a factor has an assigned trust level of NULL.

  See "Creating and Configuring an Identity" for more information about trust levels.

• Trust Level Less Than Zero: Creates an audit record when the resolved identity of a factor has an assigned trust level less than zero.

Error Options

Under Error Options, select from the following to specify the processing that occurs when a factory identity cannot be resolved. This attribute is mandatory.

The values are as follows:

• Show Error Message (default): Displays an error message to the database session.

• Do Not Show Error Message: Does not display the error message.

  An advantage of selecting Do Not Show Error Message and then enabling auditing is that you can track the activities of a potential intruder. The audit report reveals the activities of the intruder, yet the intruder is unaware that you are doing this because he or she does not see any error messages.

After you have created a new factor, you are ready to configure its identity. To do so, edit the factor and then add its identity.

7.4 Editing a Factor

To edit a factor:

1. In the Oracle Database Vault Administration page, select Factors.

2. In the Factors page, select the factor that you want to edit.

3. Click Edit.

4. Modify the factor as necessary, and then click OK.

7.5 Adding an Identity to a Factor

After you create a new factor, you can add an identity to it. An identity is the actual value of the factor. For example, the identity of an IP_Address factor could be the IP address of 234.43.41.99.

A factor identity for a given database session is assigned at run time using the Factor Identification and Retrieval Method fields described in "Creating a Factor". You can further configure the identity for the following reasons:

• To define the known identities for a factor

• To add a trust level to a factor identity

• To add an Oracle Label Security label to a factor identity

• To resolve a factor identity through its child factors, by using Identity Mapping

See "How Factors Work" for more information about how a factor behaves during a database session.

FUNCTION get_trust_level(p_factor IN VARCHAR2) RETURN NUMBER

FUNCTION get_trust_level_for_identity(p_factor IN VARCHAR2, p_identity IN VARCHAR2) RETURN NUMBER

DVSYS.GET_TRUST_LEVEL('Network') > 5

SQL> SELECT value, trust_level from dvsys.dba_dv_identity 
 WHERE trust_level >= 5 
 AND factor_name='Network'

F$NETWORK GET_TRUST_LEVEL('NETWORK')
------------------------------------
VPN                                5
INTRANET                          10

7.6 Deleting a Factor

Before you delete a factor, you can locate the various references to the factor and its identities by querying the factor-related Oracle Database Vault views. See "Oracle Database Vault Public Views" for more information.

To delete a factor:

1. Delete any references to the factor, such as factor identities, and Oracle Label Security policy associations.

   You cannot delete a factor that has references.

2. In the Oracle Database Vault Administration page, select Factors.

3. In the Factors page, select the factor that you want to remove.

4. Click Remove.

5. In the Confirmation page, click Yes.

7.7 How Factors Work

The following topics in this section explain how Oracle Database Vault processes factors:

• How Factors Are Processed When a Session Is Established

• How Factors Are Retrieved

• How Factors Are Set

SQL> SELECT get_factor('client_ip') FROM DUAL;

java.sql.Connection connection ; 
...
java.sql.CallableStatement statement = 
   connection.prepareCall("{call DVSYS.SET_FACTOR('FACTOR_X', ?)}");
statement.setString(1, "MyValue");
boolean result = statement.execute();
...

7.8 Example of How Factors Work

Oracle Database Vault provides a set of default factors that can be used for routine tasks such as finding host names, IP addresses, names of database instances, and names of session users (See "Default Factors".) However, you can create custom factors if you want. For example, you can create a Program factor that returns the name of the program that is running in the current session. To create this factor, the security administrator used the following settings:

• Factor Type: Application

  This setting was selected because the Program factor is used to identify the name of the program that established the current session.

• Factor Identification: By method

  The method the factor uses is defined under Retrieval Method.

• Evaluation: By Session

  This setting was selected so that the factor can be evaluated when the database session begins.

• Factor Labeling: By Self

  This setting labels the identities directly, rather than merging the labels of the identities for the factors that form an identity map.

• Retrieval Method: DVSYS.DBMS_MACADM.GET_SESSION_INFO('PROGRAM')

  "Oracle Database Vault PL/SQL Factor Functions" provides more information about all the functions available for factors, including GET_SESSION_INFO.

• Validation Method: None specified

  No validation methods are needed. The retrieval method performs all necessary functions.

• Assignment Rule Set: None selected

  No rule set is needed for this type of factor.

• Audit Options: Always, and then select Trust Level Less Than Zero.

• Error Options: Show Error Message

  When you call DVSYS.GET_FACTOR and if there is an error, you could use this setting to reveal any configuration problems. (See "Oracle Database Vault Run-Time PL/SQL Procedures and Functions" for more information about GET_FACTOR.)

• Identities: None created.

  No identities are needed for this type of factor.

When the Program factor was created, it was immediately available for use in database sessions and applications using standard Oracle SQL and PL/SQL expressions. You can query this factor by using standard SQL or by using it in PL/SQL expressions, because it has been exposed as an Oracle function to all database sessions.

Example 7-3 shows how to query the current value of the Program factor using an account with the DV_OWNER role

sqlplus macsys
Enter password: password
SQL> SELECT DVSYS.DBMS_MACADM.GET_SESSION_INFO('PROGRAM') FROM dual;
F$PROGRAM
---------------------
sqlplus@stadb38 (TNS V1-V3)

This example showed how a fairly simple factor works. For a more complex example on how to integrate an Oracle Database Vault factor with an Oracle Label Security label, see "Example of Integrating Oracle Database Vault with Oracle Label Security".

7.9 Guidelines for Designing Factors

Follow these guidelines for designing factors:

• You can use the Oracle utility packages such as UTL_TCP, UTL_HTTP, DBMS_LDAP, and DBMS_PIPE to integrate security or other contextual information about the session from external systems.

• Do not specify a retrieval method if the factor identification is set to Identified By Factors. Retrieval methods are only needed if you set the factor to By Method or By Constant.

• Consider using a validation method if a factor has an assignment rule set. Doing so helps to verify that invalid identities are not submitted.

• Use the client-supplied factors such as Program, OS User, and others with caution, because the values that are supplied can only be trusted when the client software is trusted and the communications channel from the client software is known to be secure.

• Only specify an evaluation option of By Access if the value returned by the retrieval method could change from one invocation to the next in the same session, for example, time-based factors.

• Optimize the internal logic of a function used for the factor retrieval method using traditional SQL and PL/SQL optimization techniques. For more information about performance and optimization, see Oracle Database Performance Tuning Guide.

• If the discrete values returned by the retrieval method are known, be sure to define identities for each value so that you can assign trust levels for them. Trust levels add value to factors as you also can use the trust level in application logic based on factors.

• A security policy based on more factors is generally considered stronger than one based on fewer factors. You can create a new factor that is identified by other factors to store combinations of factors into logical grouping using identity maps. This also makes it easier to label the parent factor when you integrate the factors with the Oracle Label Security labels. (See "Integrating Oracle Database Vault with Oracle Label Security" for more information.)

• It is generally easier to configure and debug a factor that is labeled By Self than one labeled By Factors when integrating the Oracle Label Security.

• You can design a database client application to pass one or more security, end-user, or environmental attributes so that they are available to an associated database session. To do this, create a single factor for each attribute and then use an assignment rule set to control when these attributes can be assigned, for example only when using a specific Web application on specified named application server computers. Oracle Database Vault factors used in this fashion are very much like the Oracle procedure DBMS_SESSION.SET_IDENTIFIER but also include a capability to control when they can be set. For more information about the DBMS_SESSION package, see Oracle Database PL/SQL Packages and Types Reference.

7.10 How Factors Affect Performance

Each factor has elements that are processed, such as its validation method, trust level, and so on. For factors that are evaluated by the session, such as Database_Hostname and Proxy_User, Oracle Database Vault performs this processing during session initialization, and then caches the results for subsequent requests for that value.

The 17 default factors listed in "Default Factors" are cached because they are likely candidates for a typical security policy. However, if you only use five factors, for example, in rule sets or other components, the other factors consume resources that could otherwise be used elsewhere. In this case, you should remove the uneccessary factors by deleting them. (Oracle Database Vault does not use any of these factors internally, so you can remove them if you do not need them.)

If you have a large number of users or if your application server frequently must create and destroy connections, the resources used can affect system performance. You can delete the unnecessary factors.

You can check system performance by running tools such as Oracle Enterprise Manager (including Oracle Enterprise Manager Database Control, which is installed by default with Oracle Database), Statspack, and TKPROF. For more information about Oracle Enterprise Manager, see the Oracle Enterprise Manager documentation set. For information about Database Control, refer to its online Help. Oracle Database Performance Tuning Guide describes the Statspack and TKPROF utilities.

7.11 Related Reports

Table 7-1 lists Oracle Database Vault reports that are useful for analyzing factors and their identities. See Chapter 11, "Oracle Database Vault Reports" for information about how to run these reports.