Allowing oracle db login only to specific application?

Question

We want to allow DB access (Oracle) to our users only through our own application - let\'s call it \"ourTool.exe\", installed locally on the users computers. Currently, the

Answer 1

Since it's your application and you have control of the source, you can use either password protected database roles or Secure Application Roles that are enabled from ourTool.exe. (see http://www.oracle.com/technology/obe/obe10gdb/security/approles/approles.htm ).

For example, with a password-protected database role, the initial connection would be with only the CREATE SESSION privilege, and then ourTool.exe would issue the SET ROLE with password known only to you. Any other application doesn't have the information to set the role. Obviously, the privileges are granted only to the role and not directly to the user in this configuration.

Answer 2

I renamed my sqlplus.exe to myTool.exe and after making a connection with myTool.exe

SELECT  program
FROM    V$SESSION
where username = 'SYSTEM';

Returns: myTool.exe

So be aware, as Quassnoi said: although usable in some circumstances it's certainly not bullit proof.

Answer 3

By default, OCI transmits the calling application EXE name and you can access it by querying v$session:

SELECT  program
FROM    V$SESSION

, which you can do in an AFTER LOGON trigger.

But this can be easily overriden and should not be relied upon.