Step 6: Create the ACCESS_LOCATIONS Policy User Authorizations

Next, you are ready to create user authorizations for the policy.

To create user authorizations for the policy:  

1. Return to the Label Security policies page by selecting the Label Security Policies link.

2. Select the selection button for the ACCESS_LOCATIONS policy.

3. In the Actions list, select Authorization, and then click Go.

   The Authorization page appears.

4. Click Add Users.

   The Add User: Users page appears.

5. Under Database Users, click Add.

   The Search and Select: Userpage appears. Enter SKING, and then click Go.

   Typically, a database user account already has been created in the database, for example, by using the CREATE USER SQL statement.

   The other option is Non Database Users. Most application users are considered nondatabase users. A nondatabase user does not exist in the database. This can be any user name that meets the Oracle Label Security naming standards and can fit into the VARCHAR2(30) length field. However, be aware that Oracle Database does not automatically configure the associated security information for the nondatabase user when the application connects to the database. In this case, the application must call an Oracle Label Security function to assume the label authorizations of the specified user who is not a database user.

6. Select the check box for user SKING, and then click Select.

   The Create User page lists user SKING.

7. Select the check box for user SKING and then click Next.

   (You may need to refresh the page to display user SKING's check box.)

8. In the Labels, Compartments and Groups page, enter the following settings:

   • Maximum Level: SENS (for SENSITIVE)

   • Minimum Level: CONF (for CONFIDENTIAL)

   • Default Level: SENS

   • Row Level: SENS

9. Click Next to go to the Privileges page.

10. In the Privileges page, select Next to move to the Audit page.

    Oracle Label Security enforces the policy through the label authorizations. The Privileges page enables the user to override the policy label authorization, so do not select any of its options.

11. In the Audit pane of the Add Users: Audit page, ensure that all of the audit operations are set to None, and then click Next.

    The Review page appears.

12. Ensure that the settings are correct, and then click Finish.

    The Review page lists all the authorization settings you have selected.

13. Repeat Step 4 through Step 12 to create the following authorizations for user KPARTNER, so that she can read confidential and public data in HR.LOCATIONS.

    • Labels, Compartments And Groups: Set all four levels to the following:

      • Maximum Level: CONF (for CONFIDENTIAL)

      • Minimum Level: PUB (for PUBLIC)

      • Default Level: CONF

      • Row Level: CONF

    • Privileges: Select no privileges.

    • Audit: Set all to None.

14. Create the following authorizations for user LDORAN, who is only allowed to read public data from HR.LOCATIONS:

    • Labels, Compartments And Groups: Set all four levels to PUB.

    • Privileges: Select no privileges.

    • Audit: Set all to None.