Callback with a piggyback function to set up security context
Under Backend Application Session Management (“BASM”), a DBMS not only creates an application session but also the respective adjunct security context to which to attach the adjunct security context. The middle tier does not need to create the application session or its adjunct security context. Instead, the middle tier sends an end-user token that the middle tier piggybacks to database requests that are sent through database connections. The end-user token identifies an end user and has been authenticated by the middle tier. The generation of the end-user token is concomitant to the process of the middle tier authenticating the end user. The DBMS invokes a user-defined function to generate an adjunct security context. The user-defined function generates the adjunct security context based on the end-user token. Application developers can customize the user-defined function to customize backend security for their needs.
1 . A method, comprising:
a DBMS receiving a database request to execute a database command, wherein said database request includes a first piggyback payload, said first piggyback payload including an authenticated end-user token;
said DBMS creating an application session based on said end-user token, said application session including an adjunct security context specifying first database privileges;
attaching said application session to a base database session, said base database session specifying second database privileges, said base database session including a database process;
said database process executing said database command according to said first database privileges specified in said first adjunct security context.
2 . The method of claim 1 , wherein creating said application session based on said end-user token includes creating said adjunct security context based on said end-user token.
3 . The method of claim 2 , wherein creating said adjunct security token based on said end-user context includes invoking a user-defined function that returns data specifying said first database privileges.
4 . The method of claim 1 , wherein said first database privileges are defined by a database dictionary of said DBMS.
5 . The method of claim 1 , wherein:
a middle tier includes one or more mid-tier servers, wherein said one or more mid-tier servers include said mid-tier server; and
wherein the method further includes the step of said middle tier authenticating said end-user token.
6 . The method of claim 1 , the method further including:
a middle tier authenticating an end user;
in response to authenticating said end user, said middle tier generating said end-user token for said end user;
transmitting said end-user token to said end user; and
said middle tier server receiving said end-user token from said end user with an end user request, said database request being generated for said end user request.
7 . The method of claim 6 , wherein said middle tier authenticating said end user includes using an identity provider to authenticate said end user.
8 . The method of claim 7 , the method further including said DBMS using said identity provider to obtain said data reflecting said first database privileges.
9 . The method of claim 7 , the method, wherein:
creating said application session based on said end-user token includes creating said adjunct security context based on said end-user token;
the method further includes:
using said identity provider to obtain data reflecting said first database privileges; and
creating said adjunct security context based on said data reflecting said first one or more database privileges.
10 . The method of claim 1 , wherein creating said adjunct security context based on said end-user token includes invoking a user-defined function that returns data specifying said first database privileges, wherein said user-defined function is defined by a database dictionary of said DBMS.
11 . One or more non-transitory computer-readable media storing one or more sequences of instructions that, when executed by one or more processors, cause:
a DBMS receiving a database request to execute a database command, wherein said database request includes a first piggyback payload, said first piggyback payload including an authenticated end-user token;
said DBMS creating an application session based on said end-user token, said application session including an adjunct security context specifying first database privileges;
attaching said application session to a base database session, said base database session specifying second database privileges, said base database session including a database process; and
said database process executing said database command according to said first database privileges specified in said first adjunct security context.
12 . The one or more non-transitory computer-readable media of claim 11 , wherein creating said application session based on said end-user token includes creating said adjunct security context based on said end-user token.
13 . The one or more non-transitory computer-readable media of claim 12 , wherein creating said adjunct security token based on said end-user context includes invoking a user-defined function that returns data specifying said first database privileges.
14 . The one or more non-transitory computer-readable media of claim 11 , wherein said first database privileges are defined by a database dictionary of said DBMS.
15 . The one or more non-transitory computer-readable media of claim 11 , wherein:
a middle tier includes one or more mid-tier servers, wherein said one or more mid-tier servers include said mid-tier server; and
wherein the one or more sequences of instructions include instructions that, when executed by said one or more processors, cause said middle tier authenticating said end-user token.
16 . The one or more non-transitory computer-readable media of claim 11 , wherein the one or more sequences of instructions include instructions that, when executed by said one or more processors, cause:
a middle tier authenticating an end user;
in response to authenticating said end user, said middle tier generating said end-user token for said end user;
transmitting said end-user token to said end user; and
said middle tier server receiving said end-user token from said end user with an end user request, said database request being generated for said end user request.
17 . The one or more non-transitory computer-readable media of claim 16 , wherein said said middle tier authenticating said end user includes using an identity provider to authenticate said end user.
18 . The one or more non-transitory computer-readable media of claim 17 , wherein the one or more sequences of instructions include instructions that, when executed by said one or more processors, said DBMS using said identity provider to obtain said data reflecting said first database privileges.
19 . The one or more non-transitory computer-readable media of claim 17 , wherein:
creating said application session based on said end-user token includes creating said adjunct security context based on said end-user token;
the method further includes:
using said identity provider to obtain data reflecting said first database privileges; and
creating said adjunct security context based on said data reflecting said first one or more database privileges.
20 . The one or more non-transitory computer-readable media of claim 11 , creating said adjunct security context based on said end-user token includes invoking a user-defined function that returns data specifying said first database privileges, wherein said user-defined function is defined by a database dictionary of said DBMS.