check_privilege function

Related topics

Contained in package wwsec_app_priv.

Call this function to check if the user has the privilege necessary to access an object. If the user does not, an error message is displayed.

If the user does not have the right privilege, it could mean that the user is not logged on and that the PUBLIC user does not have the necessary privilege. Alternatively, a logged on user may simply not have sufficient privileges.

In the first case, the user should login. In the second case, an appropriate message is displayed to the user.

function check_privilege

(

p_object in varchar2,

p_privilege in varchar2,

p_name in varchar2,

p_auto_redirect in boolean default TRUE,

p_requested_url in varchar2 default wwctx_api.get_product_schema || '.home',

p_owner in varchar2 default wwctx_api.get_product_schema

p_reqd_auth_level in NUMBER default wwctx_api.REQUIRED_AUTHENTICATION_LEVEL

)

return boolean;

Version: Oracle Portal 3.0.6.6.5 or later

Parameters:

p_object

The type of object being secured.

Note: For most UI administrative processes, the object type is wwsec_api.ADMIN_OBJ.

Datatype: in varchar2

p_privilege

The privilege name being checked.

Note: These names are specified with privilege name constants of the wwsec_api package. For most UI administrative processes, this is wwsec_api.EXECUTE_PRIV.

Datatype: in varchar2

p_name

A unique identifier for the specified object instance.

Datatype: in varchar2

p_auto_redirect

Indicates if the screen should display the Login Page if a user is not logged in and does not have sufficient privileges in PUBLIC mode to access the object. If FALSE returned, the user is redirected to the Login Page.

Note:Because this parameter defaults to TRUE, it has no effect if the user is already logged in.

Datatype: in boolean
Default: TRUE

p_requested_url

The URL of the object for which privileges are being checked.

Note: The p_requested_url parameter should point the user's browser to the page to be displayed after successful authorization.

Datatype: in varchar2
Default: wwctx_api.get_product_schema || '.home'

p_owner

The name of the schema that owns the p_name object.

Datatype: in varchar2
Default: wwctx_api.get_product_schema

p_reqd_auth_level

The minimum authentication level that a calling function requires in order to pass a privilege check.

The API fails the authorization check if the current authentication level (returned by wwctx_api.get_authentication_level) is less than the value of this parameter.

Note: If the object is granted PUBLIC access, the authentication level is not checked at all.

The default value for this parameter is REQUIRED_AUTHENTICATION_LEVEL and this is equivalent to PUBLIC_AUTHENTICATION. This implies that the user must be authenticated by the Single Sign-On Server for the authorization check to pass.

Portlets that require authorization fail the authorization check for a weakly authenticated user. If a portlet wants to display itself to a weakly authenticated user, it should pass p_reqd_auth_level as WEAK_AUTHENTICATION while invoking the authorization APIs.

Note: This parameter is available in Oracle Portal 3.0.9 or later.

Datatype: number
Default: wwctx_api.REQUIRED_AUTHENTICATION_LEVEL

Returns:

This function returns TRUE if the user can execute this procedure. If the user does not, it returns FALSE.

Exceptions:

None, any unexpected errors are stacked and an error page displayed if the user has insufficient privileges. No redirect takes place.

Example:

procedure display_user_mgr ( ... )
begin
-- always begin with a privilege check
if wwsec_app_priv.check_privilege

(
p_object => wwsec_api.PAGE_OBJ,
p_privilege => wwsec_api.VIEW_PRIV,
p_name => '0/156',
p_requested_url => wwctx_api.get_product_schema ||'.wwsec_app_user_mgr.display_user_mgr',
p_reqd_auth_level => wwctx_api.REQUIRED_AUTHENTICATION_LEVEL
)

then
-- will not reach here if no privileges...
-- privileged Application code may follow
end if;
end display_user_mgr;

Version: Oracle Portal 3.0.6.6.5 or later
Parameters:
p_object	The type of object being secured. Note: For most UI administrative processes, the object type is wwsec_api.ADMIN_OBJ. Datatype: in varchar2
p_privilege	The privilege name being checked. Note: These names are specified with privilege name constants of the wwsec_api package. For most UI administrative processes, this is wwsec_api.EXECUTE_PRIV. Datatype: in varchar2
p_name	A unique identifier for the specified object instance. Datatype: in varchar2
p_auto_redirect	Indicates if the screen should display the Login Page if a user is not logged in and does not have sufficient privileges in PUBLIC mode to access the object. If FALSE returned, the user is redirected to the Login Page. Note:Because this parameter defaults to TRUE, it has no effect if the user is already logged in. Datatype: in boolean Default: TRUE
p_requested_url	The URL of the object for which privileges are being checked. Note: The p_requested_url parameter should point the user's browser to the page to be displayed after successful authorization. Datatype: in varchar2 Default: wwctx_api.get_product_schema \|\| '.home'
p_owner	The name of the schema that owns the p_name object. Datatype: in varchar2 Default: wwctx_api.get_product_schema
p_reqd_auth_level	The minimum authentication level that a calling function requires in order to pass a privilege check. The API fails the authorization check if the current authentication level (returned by wwctx_api.get_authentication_level) is less than the value of this parameter. Note: If the object is granted PUBLIC access, the authentication level is not checked at all. The default value for this parameter is REQUIRED_AUTHENTICATION_LEVEL and this is equivalent to PUBLIC_AUTHENTICATION. This implies that the user must be authenticated by the Single Sign-On Server for the authorization check to pass. Portlets that require authorization fail the authorization check for a weakly authenticated user. If a portlet wants to display itself to a weakly authenticated user, it should pass p_reqd_auth_level as WEAK_AUTHENTICATION while invoking the authorization APIs. Note: This parameter is available in Oracle Portal 3.0.9 or later. Datatype: number Default: wwctx_api.REQUIRED_AUTHENTICATION_LEVEL
Returns: This function returns TRUE if the user can execute this procedure. If the user does not, it returns FALSE. Exceptions: None, any unexpected errors are stacked and an error page displayed if the user has insufficient privileges. No redirect takes place. Example: procedure display_user_mgr ( ... ) begin -- always begin with a privilege check if wwsec_app_priv.check_privilege ( p_object => wwsec_api.PAGE_OBJ, p_privilege => wwsec_api.VIEW_PRIV, p_name => '0/156', p_requested_url => wwctx_api.get_product_schema \|\|'.wwsec_app_user_mgr.display_user_mgr', p_reqd_auth_level => wwctx_api.REQUIRED_AUTHENTICATION_LEVEL ) then -- will not reach here if no privileges... -- privileged Application code may follow end if; end display_user_mgr;

Related topics
Security API package	PDK PL/SQL API Reference - Home