Start the Database Vault Administration Web interface by pointing your Web browser to "http://<hostname>:<port>/dva" and log in as the owner of Database Vault:
Click on "Label Security Integration":
Click on "Create":
Pick your OLS policy from the drop-down-list
Select "LII" as the algorithm
Select the lowest level of your policy as the label to be used for initialization errors
Move "Domain" from the "Available Factors" to the "Selected Factors"
Click "OK"
Confirm and click on the "Database Instance: <sid>" breadcrump:
Click on "Factors":
Select the "Domain" Factor and click on "Edit":
Select "IP Address" from the drop down list; scroll down:
Under "Identities" click on "Create":
Name the Identity "Local Connection", assign a "Trust Level", move the highest label from "Available OLS Labels" to "Selected OLS Labels" and click on "OK":
Scroll down and click "Create":
Name the Identity "Remote Connection", assign a "Trust Level", move the lowest label from "Available OLS Labels" to "Selected OLS Labels" and click on "OK":
Scroll down, select "Local Connection" and click "Edit":
Under "Map Identity" click "Create":
For "Local Connection", select "Client IP" as the Contributing Factor; select "Is Null" as the Map Condition and enter "local" in "Low Value". (When a database is accessed locally, the request does not go through the Listener, so the query "select sys_context('userenv','ip_address')" returns NULL). Click "OK":
Verify and click "OK":
Scroll down, select "Remote Connection" and click "Edit":
Under "Map Identity" click "Create":
For "Remote Connection", select "Client IP" as the Contributing Factor; select "Is Not Null" as the Map Condition and enter "remote" in "Low Value". (When a database is accessed remotely, the request goes through the Listener, so the query "select sys_context('userenv','ip_address')" is never NULL). Click "OK":
Verify and click "OK":
SKing (who has the "SENS:PII" label) connects remotely, but cannot see the "SALARY" column. His remote connection has the "CONF" label, which does not allow access to the "SALARY" column. The label attached to his IP Address dominates his session label:
When SKing connects locally, his connection has the "SENS:PII" label and access to the SALARY column is granted.
Bookmark
