Fine-Grained Security: Protecting HR Data with Oracle VPD Policies in Blitz Report

Customer November 23, 2025 at 1:52 pm

We must secure sensitive HR data, such as employee salaries and national identifiers, especially when accessed through SQL-based reporting tools. Although Blitz Report runs under the highly privileged APPS user via the concurrent manager, we need to apply granular security measures. Can we leverage Oracle VPD (Virtual Private Database) policies to implement row and column security, ensuring that sensitive data is masked or restricted when running Blitz Reports, without affecting standard Oracle processes?

Viewing 4 reply threads

Author
Replies
- Support November 23, 2025 at 4:24 pm
  Yes, Oracle VPD is the precise tool for this fine-grained access control. Because Blitz Report runs under the APPS schema, the key is modifying the VPD policy function to utilize `sys_context` to check the application context. This allows us to detect specifically when the current session originates from a Blitz Report execution and enforce restrictions.
- Customer November 23, 2025 at 9:24 pm
  How do we define the policy function to specifically identify a Blitz Report session, ensuring minimal disruption to EBS forms?
- Support November 24, 2025 at 2:02 am
  The policy function includes a check using `sys_context (‘userenv’, ‘module’)` for the pattern `XXEN_REPORT – %`, which uniquely identifies the Blitz Report session. If the context matches, the predicate can return `’1=2’` for row-level restriction, or define `sec_relevant_cols` for column-level security to return NULL values for fields like salary or credit card info.
- Customer November 24, 2025 at 6:59 am
  We only want certain HR users to bypass these restrictions, but prevent external developers from seeing sensitive columns even if they run the report. How do we build that user-specific differentiation into the VPD logic?
- Support November 24, 2025 at 11:29 am
  You would introduce additional conditions within the VPD policy function, such as checking the user’s EBS responsibility or a custom profile option setting. This multilayered security ensures that VPD policies protect sensitive columns based on who is running the report, even when the underlying session executes as APPS.
Author
Replies

Viewing 4 reply threads

You must be logged in to reply to this post.