The DBMS_NETWORK_ACL_ADMIN
package provides the interface to administer the network Access Control List (ACL).
See Also:
80 DBMS_NETWORK_ACL_ADMIN. The DBMS_NETWORK_ACL_ADMIN package provides the interface to administer the network Access Control List (ACL). Access control lists are manipulated using the DBMS_NETWORK_ACL_ADMIN package. SELECT DBMS_NETWORK_ACL_UTILITY.domain_level('oel5-11g.localdomain'). The NETWORK_ACL_ADMIN package provides the interface to administer the. How to install the SQL Loader for Oracle 11g. Anybody here knows how to install a PLSQL package in Oracle 11g? I am trying to use these two packages: DBMS_NETWORK_ACL_ADMIN DBMS_NETWORK_ACL_UTILITY I am using Oracle Application Express and.
For more information, see 'Managing Fine-grained Access to External Network Services' in Oracle Database Security GuideThe chapter contains the following topics:
Examples
Using DBMS_NETWORK_ACL_ADMIN
Examples
Example1
Grant the connect and resolve privileges for host www.us.oracle.com to SCOTT.
Example 2
Grant the resolve privilege for www.us.oracle.com to ADAMS. Since an ACL for www.us.oracle.com exists already, just add the privilege for ADAMS.
Example 3
Assign the ACL www.xml to www-proxy.us.oracle.com so that SCOTT and ADAMS can access www-proxy.us.oracle.com also.
Example 4
Unassign the ACL from www.us.oracle.com so that no access to www.us.oracle.com is allowed.
Example 5
The DOMAINS Function in the DBMS_NETWORK_ACL_UTLILITY package returns all the domains a host belongs to. It can be used in conjunction with the CHECK_PRIVILEGE_ACLID Function in this package to determine the privilege assignments affecting a user's permission to access a network host. The function DOMAIN_LEVEL Function in the DBMS_NETWORK_ACL_UTILITY package returns the level of each domain and can be used to order the ACL assignments by their precedence.
For example, for SCOTT's permission to connect to www.us.oracle.com:
Example 6
For example, for SCOTT's permission to do domain name resolution for www.us.oracle.com:
Note that the 'resolve
' privilege takes effect only in ACLs assigned without any port range (when lower_port
and upper_port
are NULL
). For this reason, we do not include lower_port
and upper_port
columns in the query.
Summary of DBMS_NETWORK_ACL_ADMIN Subprograms
Table 80-1 DBMS_NETWORK_ACL_ADMIN Package Subprograms
Subprogram | Description |
---|---|
Adds a privilege to grant or deny the network access to the user in an access control list (ACL) | |
Assigns an access control list (ACL) to a network host, and optionally specific to a TCP port range | |
Checks if a privilege is granted to or denied from the user in an access control list (ACL) | |
Checks if a privilege is granted to or denied from the user in an ACL by specifying the object ID of the access control list | |
Creates an access control list (ACL) with an initial privilege setting | |
Deletes a privilege in an access control list (ACL) | |
Drops an access control list (ACL) | |
Unassigns the access control list (ACL) currently assigned to a network host. |
ADD_PRIVILEGE Procedure
This procedure adds a privilege to grant or deny the network access to the user. The access control entry (ACE) will be created if it does not exist.
Syntax
Parameters
Table 80-2 ADD_PRIVILEGE Function Parameters
Parameter | Description |
---|---|
| Name of the ACL. Relative path will be relative to '/sys/acls'. |
| Principal (database user or role) to whom the privilege is granted or denied. Case sensitive. |
| Network privilege to be granted or denied - |
| Network privilege to be granted or denied |
| Position (1-based) of the ACE. If a non- |
| Start date of the access control entry (ACE). When specified, the ACE will be valid only on and after the specified date. The |
| End date of the access control entry (ACE). When specified, the ACE will expire after the specified date. The |
Usage Notes
To remove the permission, use the DELETE_PRIVILEGE Procedure.
Examples
ASSIGN_ACL Procedure
This procedure assigns an access control list (ACL) to a host computer, domain, or IP subnet, and if specified, the TCP port range.
Syntax
Parameters
Table 80-3 ASSIGN_ACL Function Parameters
Parameter | Description |
---|---|
| Name of the ACL. Relative path will be relative to ' |
| Host to which the ACL will be assigned. The host can be the name or the IP address of the host. A wildcard can be used to specify a domain or a IP subnet. The host or domain name is case-insensitive. |
| Lower bound of a TCP port range if not |
| Upper bound of a TCP port range. If |
Usage Notes
Only one ACL can be assigned to any host computer, domain, or IP subnet, and if specified, the TCP port range. When you assign a new access control list to a network target, Oracle Database unassigns the previous access control list that was assigned to the same target. However, Oracle Database does not drop the access control list. You can drop the access control list by using the DROP_ACL Procedure. To remove an access control list assignment, use the UNASSIGN_ACL Procedure.
The ACL assigned to a domain takes a lower precedence than the other ACLs assigned sub-domains, which take a lower precedence than the ACLs assigned to the individual hosts. So for a given host say 'www.us.oracle.com', the following domains are listed in decreasing precedences:
- www.us.oracle.com
- *.us.oracle.com
- *.oracle.com
- *.com
- *
In the same way, the ACL assigned to an subnet takes a lower precedence than the other ACLs assigned smaller subnets, which take a lower precedence than the ACLs assigned to the individual IP addresses. So for a given IP address say '192.168.0.100', the following subnets are listed in decreasing precedences:
- 192.168.0.100
- 192.168.0.*
- 192.168.*
- 192.*
- *
The port range is applicable only to the 'connect' privilege assignments in the ACL. The 'resolve' privilege assignments in an ACL have effects only when the ACL is assigned to a host without a port range.
For the 'connect' privilege assignments, an ACL assigned to the host without a port range takes a lower precedence than other ACLs assigned to the same host with a port range.
When specifying a TCP port range, both lower_port and upper_port must not be
NULL
andupper_port
must be greater than or equal tolower_port
. The port range must not overlap with any other port ranges for the same host assigned already.To remove the assignment, use UNASSIGN_ACL Procedure.
Examples
CHECK_PRIVILEGE Function
This function checks if a privilege is granted to or denied from the user in an ACL.
Syntax
Parameters
Table 80-4 CHECK_PRIVILEGE Function Parameters
Parameter | Description |
---|---|
| Name of the ACL. Relative path will be relative to '/sys/acls'. |
| User to check against. If the user is |
| Network privilege to check |
Return Values
Returns 1 when the privilege is granted; 0 when the privilege is denied; NULL
when the privilege is neither granted or denied.
Examples
CHECK_PRIVILEGE_ACLID Function
This function checks if a privilege is granted to or denied from the user in an ACL by specifying the object ID of the access control list.
Syntax
Parameters
Table 80-5 CHECK_PRIVILEGE_ACLID Function Parameters
Parameter | Description |
---|---|
| Object ID of the ACL |
| User to check against. If the user is |
| Network privilege to check |
Return Values
Returns 1 when the privilege is granted; 0 when the privilege is denied; NULL
when the privilege is neither granted or denied.
CREATE_ACL Procedure
This procedure creates an access control list (ACL) with an initial privilege setting. An ACL must have at least one privilege setting. The ACL has no access control effect unless it is assigned to network target.
Syntax
Parameters
Table 80-6 CREATE_ACL Function Parameters
Parameter | Description |
---|---|
| Name of the ACL. Relative path will be relative to '/sys/acls'. |
| Description attribute in the ACL |
| Principal (database user or role) to whom the privilege is granted or denied. Case sensitive. |
| Privilege is granted or not (denied) |
| Network privilege to be granted or denied - |
| Start date of the access control entry (ACE). When specified, the ACE will be valid only on and after the specified date. |
| End date of the access control entry (ACE). When specified, the ACE will expire after the specified date. The |
How To Install Dbms_network_acl_admin Package In 11g
Usage Notes
To drop the access control list, use the DROP_ACL Procedure.
Examples
DELETE_PRIVILEGE Procedure
This procedure deletes a privilege in an access control list.
Syntax
Parameters
Table 80-7 DELETE_PRIVILEGE Function Parameters
Parameter | Description |
---|---|
| Name of the ACL. Relative path will be relative to '/sys/acls'. |
| Principal (database user or role) for whom all the ACE will be deleted |
| Privilege is granted or not (denied). If a null value is given, the deletion is applicable to both granted or denied privileges. |
| Network privilege to be deleted. If a |
Examples
DROP_ACL Procedure
This procedure drops an access control list (ACL).
Syntax
Parameters
Table 80-8 DROP_ACL Function Parameters
Dbms_network_acl_admin Package
Parameter | Description |
---|---|
| Name of the ACL. Relative path will be relative to '/sys/acls'. |
Examples
UNASSIGN_ACL Procedure
This procedure unassigns the access control list (ACL) currently assigned to a network host.
Syntax
Parameters
Table 80-9 UNASSIGN_ACL Function Parameters
Parameter | Description |
---|---|
| Name of the ACL. Relative path will be relative to '/sys/acls'. If acl is |
| Host from which the ACL will be removed. The host can be the name or the IP address of the host. A wildcard can be used to specify a domain or a IP subnet. The host or domain name is case-insensitive. If host is null, the ACL will be unassigned from any host. If both |
| Lower bound of a TCP port range if not |
| Upper bound of a TCP port range. If |
Examples