Translations and Item Versioning

15 Implementing Content Security 15-1 15 Implementing Content Security This chapter describes how to use the APIs provided with Oracle Portal to ensure that your content is secure. It contains the following sections: ■ Section 15.1, Retrieving Object Privileges ■ Section 15.2, Setting Page Level Privileges ■ Section 15.3, Setting Item Level Privileges For more information about any of these APIs, refer to the Oracle Portal PLSQL API Reference on Portal Center: http:portalcenter.oracle.com In the Portal Focus Areas section, click Portlet Development, then in the APIs and References section, click PLSQL API Reference.

15.1 Retrieving Object Privileges

To retrieve a list of privileges that are currently defined for an object, use the wwsec_ api.grantee_list API. Example 15–1 prints the values of the grantee array for a page with an ID of 17623 in page group with an ID of 33. Example 15–2 prints the values of the grantee array for an item with a master ID of 32919 in a page group with an ID of 53. Example 15–1 Retrieving the List of Privileges for a Page grantee_list API declare l_grantees wwsec_api.grantee_array; l_object_type_name varchar25 := wwsec_api.PAGE_OBJ; l_name varchar260 := 3317623; begin -- Call the function. l_grantees := wwsec_api.grantee_list p_object_type_name = l_object_type_name, p_name = l_name ; -- Output the results if l_grantees is not null then if l_grantees.count 0 then for i in l_grantees.first..l_grantees.last loop if l_grantees.existsi then Tip: Remember, if you are calling the APIs from a Web provider or external application, you need to set the session context first. For more information, refer to Section 10.1, Setting the Session Context . 15-2 Oracle Fusion Middleware Developers Guide for Oracle Portal dbms_output.put_lineGRANTEE_TYPE ||to_chari||= ||l_granteesi.GRANTEE_TYPE; dbms_output.put_lineGRANTEE_ID ||to_chari||= ||l_granteesi.GRANTEE_ID; dbms_output.put_lineGRANTEE_NAME ||to_chari||= ||l_granteesi.GRANTEE_NAME; dbms_output.put_linePRIVILEGE ||to_chari||= ||l_granteesi.PRIVILEGE; end if; end loop; end if; end if; exception ... end; Example 15–2 Retrieving the List of Privileges for an Item declare l_grantees wwsec_api.grantee_array; p_object_type_name varchar25 := wwsec_api.ITEM_OBJ; p_name varchar260 := 5332919; begin -- Call the function. l_grantees := wwsec_api.grantee_listp_object_type_name, p_name; -- Output the results. if l_grantees is not null then if l_grantees.count 0 then for i in l_grantees.first..l_grantees.last loop if l_grantees.existsi then dbms_output.put.lineGRANTEE_TYPE ||to_chari||= ||l_ granteesi.GRANTEE_TYPE; dbms_output.put.lineGRANTEE_ID ||to_chari||= ||l_ granteesi.GRANTEE_ID; dbms_output.put.lineGRANTEE_NAME ||to_chari||= ||l_ granteesi.GRANTEE_NAME; dbms_output.put.linePRIVILEGE ||to_chari||= ||l_ granteesi.PRIVILEGE; end if; end loop; end if; end if; exception ... end; The grantee_list API takes the following three parameters: ■ p_object_type_name is the type of the object. Use the predefined constants in the WWSEC_API package to specify the value of this parameter, for example wwsec_ api.PAGE_OBJ or wwsec_api.ITEM_OBJ. ■ p_name is the reference to the object. Use the format page group IDobject ID. So for items, use page group IDmaster item ID, for example 5332919. ■ p_owner is the name of the schema that owns the object. For items, do not pass a value to this parameter as it defaults to the portal schema owner. Implementing Content Security 15-3 The API returns an array WWSEC_API.GRANTEE_ARRAY with the following columns: ■ grantee_type is either USER or GROUP ■ grantee_id is the unique ID of the user or group ■ grantee_name is the user name or group name ■ privilege is the privilege granted to the user or group

15.2 Setting Page Level Privileges

This section shows how to use APIs in the WWSEC_API package to set page level privileges.

15.2.1 Granting Page Level Privileges

Example 15–3 shows how to use the set_group_acl API to grant privileges to a group. Example 15–4 shows how to use the set_user_acl API to grant privileges to a user. Example 15–3 Granting Page Privileges to a Group set_group_acl API declare l_group_id number := wwsec_api.group_idMYGROUP; l_name varchar260 := 3317623; BEGIN wwsec_api.set_group_acl p_group_id = l_group_id, p_object_type_name = wwsec_api.PAGE_OBJ, p_name = l_name, p_privilege = wwsec_api.VIEW_PRIV ; end; Example 15–4 Granting Page Privileges to a User set_user_acl API declare l_person_id number := wwsec_api.idJOHN.SMITH; l_name varchar260 := 3317623; begin wwsec_api.set_user_acl p_person_id = l_person_id, p_object_type_name = wwsec_api.PAGE_OBJ, p_name = l_name, p_privilege = wwsec_api.VIEW_PRIV ; Note: You can also use the APIs listed in the following sections to set tab level access by using the following format for the p_name parameter: page group IDtab ID You do not need to specify the ID of the container page, as the tab ID is enough to uniquely identify the tab within the page group. 15-4 Oracle Fusion Middleware Developers Guide for Oracle Portal end; These two APIs take the following parameters: ■ p_group_id is the ID of the group to which you want to grant privileges set_ group_acl only ■ p_person_id is the ID of the user to whom you want to grant privileges set_ user_acl only ■ p_object_type_name is type of the object on which you want to grant privileges. Use the predefined constants in the WWSEC_API package to specify the value of this parameter, for example wwsec_api.PAGE_OBJ. ■ p_name is the reference to the object. Use the format page group IDpage ID, for example 3317623. ■ p_privilege is the level of privilege you want to grant to the user or group. Use the predefined constants in the WWSEC_API package to specify the value of this parameter, for example wwsec_api.VIEW_PRIV.

15.2.2 Removing Page Level Privileges

At some point, it may become necessary to remove a user or groups privileges from a page. Example 15–5 shows how to use the remove_group_acl API to remove a groups privileges. Example 15–6 shows how to use the remove_user_acl API to remove a users privileges. Example 15–5 Removing Page Privileges from a Group remove_group_acl API declare l_group_id number := wwsec_api.group_idMYGROUP; l_name varchar260 := 3317623; BEGIN wwsec_api.remove_group_acl p_object_type_name = wwsec_api.PAGE_OBJ, p_name = l_name, p_group_id = l_group_id, p_privilege = wwsec_api.MANAGE_PRIV ; end; Example 15–6 Removing Page Privileges from a User remove_user_acl API declare l_person_id number := wwsec_api.idJOHN.SMITH; l_name varchar260 := 3317623; BEGIN wwsec_api.remove_user_acl p_object_type_name = wwsec_api.GROUP_OBJ, p_name = l_name, p_person_id = l_person_id, p_privilege = wwsec_api.MANAGE_PRIV ; end; These two APIs take the following parameters: