How To Install Dbms_network_acl_admin Package In 11g

Posted on 11-05-2021 by admin

The DBMS_NETWORK_ACL_ADMIN package provides the interface to administer the network Access Control List (ACL).

How To Install Dbms_network_acl_admin Package In 11g
Dbms_network_acl_admin Package

Using DBMS_NETWORK_ACL_ADMIN

Examples

Example1

Grant the connect and resolve privileges for host www.us.oracle.com to SCOTT.

Example 2

Grant the resolve privilege for www.us.oracle.com to ADAMS. Since an ACL for www.us.oracle.com exists already, just add the privilege for ADAMS.

Example 3

Assign the ACL www.xml to www-proxy.us.oracle.com so that SCOTT and ADAMS can access www-proxy.us.oracle.com also.

Example 4

Unassign the ACL from www.us.oracle.com so that no access to www.us.oracle.com is allowed.

Example 5

The DOMAINS Function in the DBMS_NETWORK_ACL_UTLILITY package returns all the domains a host belongs to. It can be used in conjunction with the CHECK_PRIVILEGE_ACLID Function in this package to determine the privilege assignments affecting a user's permission to access a network host. The function DOMAIN_LEVEL Function in the DBMS_NETWORK_ACL_UTILITY package returns the level of each domain and can be used to order the ACL assignments by their precedence.

For example, for SCOTT's permission to connect to www.us.oracle.com:

Example 6

For example, for SCOTT's permission to do domain name resolution for www.us.oracle.com:

Note that the 'resolve' privilege takes effect only in ACLs assigned without any port range (when lower_port and upper_port are NULL). For this reason, we do not include lower_port and upper_port columns in the query.

Summary of DBMS_NETWORK_ACL_ADMIN Subprograms

Table 80-1 DBMS_NETWORK_ACL_ADMIN Package Subprograms

Subprogram	Description
Adds a privilege to grant or deny the network access to the user in an access control list (ACL)
Assigns an access control list (ACL) to a network host, and optionally specific to a TCP port range
Checks if a privilege is granted to or denied from the user in an access control list (ACL)
Checks if a privilege is granted to or denied from the user in an ACL by specifying the object ID of the access control list
Creates an access control list (ACL) with an initial privilege setting
Deletes a privilege in an access control list (ACL)
Drops an access control list (ACL)
Unassigns the access control list (ACL) currently assigned to a network host.

ADD_PRIVILEGE Procedure

This procedure adds a privilege to grant or deny the network access to the user. The access control entry (ACE) will be created if it does not exist.

Syntax

Parameters

Table 80-2 ADD_PRIVILEGE Function Parameters

Parameter	Description
`acl`	Name of the ACL. Relative path will be relative to '/sys/acls'.
`principal`	Principal (database user or role) to whom the privilege is granted or denied. Case sensitive.
`is_grant`	Network privilege to be granted or denied - `'connect` \| `resolve'` (case sensitive). A database user needs the `connect` privilege to an external network host computer if he or she is connecting using the `UTL_TCP`, `UTL_HTTP`, `UTL_SMTP`, and `UTL_MAIL` utility packages. To resolve a host name that was given a host IP address, or the IP address that was given a host name, with the `UTL_INADDR` package, grant the database user the `resolve` privilege.
`privilege`	Network privilege to be granted or denied
`position`	Position (1-based) of the ACE. If a non-`NULL` value is given, the privilege will be added in a new ACE at the given position and there should not be another ACE for the principal with the same `is_grant` (grant or deny). If a `NULL` value is given, the privilege will be added to the ACE matching the principal and the `is_grant` if one exists, or to the end of the ACL if the matching ACE does not exist.
`start_date`	Start date of the access control entry (ACE). When specified, the ACE will be valid only on and after the specified date. The `start_date` will be ignored if the privilege is added to an existing ACE.
`end_state`	End date of the access control entry (ACE). When specified, the ACE will expire after the specified date. The `end_date` must be greater than or equal to the `start_date`. The `end_date` will be ignored if the privilege is added to an existing ACE.

Usage Notes

To remove the permission, use the DELETE_PRIVILEGE Procedure.

Examples

ASSIGN_ACL Procedure

This procedure assigns an access control list (ACL) to a host computer, domain, or IP subnet, and if specified, the TCP port range.

Syntax

Parameters

Table 80-3 ASSIGN_ACL Function Parameters

Parameter	Description
`acl`	Name of the ACL. Relative path will be relative to '`/sys/acls`'.
`host`	Host to which the ACL will be assigned. The host can be the name or the IP address of the host. A wildcard can be used to specify a domain or a IP subnet. The host or domain name is case-insensitive.
`lower_port`	Lower bound of a TCP port range if not `NULL`
`upper_port`	Upper bound of a TCP port range. If `NULL`, lower_port is assumed.

Usage Notes

Only one ACL can be assigned to any host computer, domain, or IP subnet, and if specified, the TCP port range. When you assign a new access control list to a network target, Oracle Database unassigns the previous access control list that was assigned to the same target. However, Oracle Database does not drop the access control list. You can drop the access control list by using the DROP_ACL Procedure. To remove an access control list assignment, use the UNASSIGN_ACL Procedure.
The ACL assigned to a domain takes a lower precedence than the other ACLs assigned sub-domains, which take a lower precedence than the ACLs assigned to the individual hosts. So for a given host say 'www.us.oracle.com', the following domains are listed in decreasing precedences:
- www.us.oracle.com
- *.us.oracle.com
- *.oracle.com
- *.com
- *
In the same way, the ACL assigned to an subnet takes a lower precedence than the other ACLs assigned smaller subnets, which take a lower precedence than the ACLs assigned to the individual IP addresses. So for a given IP address say '192.168.0.100', the following subnets are listed in decreasing precedences:
- 192.168.0.100
- 192.168.0.*
- 192.168.*
- 192.*
- *
The port range is applicable only to the 'connect' privilege assignments in the ACL. The 'resolve' privilege assignments in an ACL have effects only when the ACL is assigned to a host without a port range.
For the 'connect' privilege assignments, an ACL assigned to the host without a port range takes a lower precedence than other ACLs assigned to the same host with a port range.
When specifying a TCP port range, both lower_port and upper_port must not be NULL and upper_port must be greater than or equal to lower_port. The port range must not overlap with any other port ranges for the same host assigned already.
To remove the assignment, use UNASSIGN_ACL Procedure.

Examples

CHECK_PRIVILEGE Function

This function checks if a privilege is granted to or denied from the user in an ACL.

Syntax

Parameters

Table 80-4 CHECK_PRIVILEGE Function Parameters

Parameter	Description
`acl`	Name of the ACL. Relative path will be relative to '/sys/acls'.
`user`	User to check against. If the user is `NULL`, the invoker is assumed. The username is case-sensitive as in the `USERNAME` column of the `ALL_USERS` view.
`privilege`	Network privilege to check

Return Values

Returns 1 when the privilege is granted; 0 when the privilege is denied; NULL when the privilege is neither granted or denied.

Examples

CHECK_PRIVILEGE_ACLID Function

This function checks if a privilege is granted to or denied from the user in an ACL by specifying the object ID of the access control list.

Syntax

Parameters

Table 80-5 CHECK_PRIVILEGE_ACLID Function Parameters

Parameter	Description
`aclid`	Object ID of the ACL
`user`	User to check against. If the user is `NULL`, the invoker is assumed. The username is case-sensitive as in the `USERNAME` column of the `ALL_USERS` view.
`privilege`	Network privilege to check

Return Values

Returns 1 when the privilege is granted; 0 when the privilege is denied; NULL when the privilege is neither granted or denied.

CREATE_ACL Procedure

This procedure creates an access control list (ACL) with an initial privilege setting. An ACL must have at least one privilege setting. The ACL has no access control effect unless it is assigned to network target.

Syntax

Parameters

Table 80-6 CREATE_ACL Function Parameters

Parameter	Description
`acl`	Name of the ACL. Relative path will be relative to '/sys/acls'.
`description`	Description attribute in the ACL
`principal`	Principal (database user or role) to whom the privilege is granted or denied. Case sensitive.
`is_grant`	Privilege is granted or not (denied)
`privilege`	Network privilege to be granted or denied - `'connect` \| `resolve'` (case sensitive). A database user needs the `connect` privilege to an external network host computer if he or she is connecting using the `UTL_TCP`, `UTL_HTTP`, `UTL_SMTP`, and `UTL_MAIL` utility packages. To resolve a host name that was given a host IP address, or the IP address that was given a host name, with the `UTL_INADDR` package, grant the database user the `resolve` privilege.
`start_date`	Start date of the access control entry (ACE). When specified, the ACE will be valid only on and after the specified date.
`end_state`	End date of the access control entry (ACE). When specified, the ACE will expire after the specified date. The `end_date` must be greater than or equal to the `start_date`.