Implementing VPD for Row/Column Security in Blitz Report EBS Reporting

Customer September 17, 2025 at 5:19 pm

We must secure sensitive employee data, such as salary (proposed_salary_n) and personal identifiers, from developers and unauthorized functional consultants who have direct SQL access, including those running ad-hoc reports via tools like Blitz Report. While the system needs to retain full access for standard EBS forms and processes (running as APPS user), we need a reliable Virtual Private Database (VPD) policy to dynamically hide or restrict access to specific rows and columns. How can we implement a VPD policy in our Oracle database that specifically targets and restricts the Blitz Report session, leaving core EBS functionality untouched?

Viewing 6 reply threads

Author
Replies
- Support September 17, 2025 at 11:14 pm
  This is an excellent use case for combining Oracle VPD with application context awareness. Since Blitz Report sessions execute using the APPS database user (which normally bypasses simple user-based restrictions), we must modify the VPD policy function to inspect the application session context (sys_context),. This allows the policy to enforce security based on *how* the data is being accessed, not just *who* is accessing it,.
- Customer September 18, 2025 at 1:16 am
  That makes sense. What specific application context attribute should our VPD policy function check to identify when a query originates from the Blitz Report engine?
- Support September 18, 2025 at 4:33 am
  You should configure the VPD policy function to check the `USERENV` namespace, specifically inspecting the `module` attribute for a pattern that identifies the Blitz Report session,. The recommended predicate checks if `sys_context(‘userenv’,’module’)` is `like ‘XXEN_REPORT – %’`, and if true, applies the restrictive condition (e.g., `1=2` for row restriction or masking columns for column restriction).
- Customer September 18, 2025 at 9:04 am
  If we apply a column-level VPD policy using this method on the HR table, what will non-privileged users see when running a Blitz Report that queries salary data?
- Support September 18, 2025 at 1:53 pm
  For unauthorized users running a Blitz Report against a table with column-level VPD enabled (using the `sec_relevant_cols` parameter), the data in the restricted columns will dynamically appear as NULL, while all other columns remain visible,,. This is extremely valuable as it allows visibility for necessary columns while securing sensitive data elements like salary or national identifiers,.
- Customer September 18, 2025 at 6:38 pm
  Is this fine-grained access control feature something we need to build entirely manually, or does Blitz Report provide tools to streamline the setup of these complex policies?
- Support September 18, 2025 at 10:46 pm
  Blitz Report includes setup and concurrent programs specifically designed to automatically create the necessary VPD policies and database functions. This simplifies the implementation of VPD policies that protect sensitive data at the row or column level when executing reports using Blitz Report,.
Author
Replies

Viewing 6 reply threads

You must be logged in to reply to this post.