问题
So Apex has "workspaces", which let you create users of three types - all of which are internal to the organization in nature. Also, there seems to be no way for a developer of an individual site on Apex to have "users" just for his site.
Am I missing something?
I need to be able to have external (business) users to be able to get access to just some features of the site, for example, accounting can only see pages A and B while executives can see A,B, and C.
I need to have ability to have several groups of people with difference degrees of access.
Can this only be done by creating workspaces/groups? Or can that be done internally on just my site?
回答1:
Although APEX has a built-in user management concept called "Groups" I must confess I have never used it, and a quick perusal of the documentation doesn't make it clear to me how you use these to control access (but see Tom's answer here for that).
You will probably need to create user/role tables within your database and use these in conjunction with APEX Authorization Schemes to control access to pages. A single Authorization Scheme of type "PL/SQL Function returning Boolean" could be created with the function body:
return my_auth_pkg.is_authorized (p_user => :app_user,
p_app_id => :app_id
p_page_id => :app_page_id);
You would then implement the package to look up the user's privileges and decide whether to return TRUE or FALSE for the application and page id.
Alternatively you could just perform the SQL to check for access directly in the Authorization Scheme:
(NB "user_roles" and "role_pages" are names I made up, to represent your tables)
回答2:
I just wish to expand on Tony's answer, which by itself is correct. I just want to show you another way, which i think would be easier on a total beginner and omits the creation of tables.
If your application uses Apex as authentication scheme, then your users are managed through the administration of the workspace itself. You can create, edit and delete users, but you can also define groups, and link users to groups. It is possible for you to create several "end user" type of users, and define a couple of groups, like "Executives".
When you have created your group, go to the user you wish to assign this group to, and add the group to the groups of that user
Once you have that set up, you still need the authorization schemes. The fact remains you need some pl/sql knowledge here, but it is possible to keep the coding to a minimum, thanks to some handy api-work.
The current_user_in_group does what it says: it checks for the current user if he has said group assigned. With some expanding using some simple IF-structures, you can ramp it up a bit!
Not that i'd totally recommend this method, i find it a bit tedious myself, and you need someone to go into APEX to actually maintain users and their groups, but it could well be that this is acceptable in your environment. You could use it to start out with however. You can very easily switch out authentication schemes, and with altering your authorization schemes so they comply with the new auth scheme, you can easily and quickly adjust this afterward. It depends on your priorities and goals of course.
回答3:
Authorization is a process of determining whether an authenticated/identified person is permitted to access a resource or do an operation. It is based on set of privileges or roles assigned to the user. For Example, In Oracle database, Administrator have privilege to schedule jobs, while an user cannot. How is Authorization different from Authentication? Often Authentication and Authorization work together. In other words, Authorization follows Authentication. Authentication determines Who are you? Authorization determines What you are allowed to do?
来源：https://stackoverflow.com/questions/7905159/authorization-and-user-roles-in-oracle-apex