|
If it were my application, my first choice would be to use the database security that Oracle provides (i.e. separate user accounts and use database roles and grants along with VPD functionality if necessary). That way, you don't need to be concerned with *how* they connect to the database since all the security for your application is in the database anyway.
If that's not possible (for instance, with some COTS applications), you may be able to utilize a login trigger to check what application the user used to connect and force their session to be disconnected if they use anything other than your desired application.
One other technique I have seen is to create a password-enabled role that has all the application privileges in it and enable that role with your application only. That way, if users connect to the database as the application user, they have no privileges unless they enable the role (which would require a password that only your application knows).
|
