Kapadia Mitesh-C23457 wrote:

Hello.
I would like to explore Connection Pooling as opposed to direct JDBC calls
to an Oracle V8.1.6 database in a STRUTS application.
The queries that are being executed have some kind of security built into
them such that they only return results based on the User Id ( a look up of
the User Id is conducted in this query to determine the level of security)
My question: If I were to implement Connection Pooling, is it possible to
individually identiffy each user in the connection pool when a connection is
being used? If a user is using a pool from the DB Connection Pool, can the
user still be individually identified by their User ID as opposed to the
User ID used to create the DB Connection Pool?
This would be a requirement since the user id would be used to determine the
level of security in the queries on the DB.
Any assistance you can provide would be most appreciated.

Thanks in advance.

Mitesh



Some connection pools (not including commons-dbcp) do support the ability to pool connections that are registered to individual database usernames. However, this is going to reduce the reusability of the connections -- the connection that user "foo" just put back into the pool cannot be used by user "bar".

For Oracle in particular, I've had a lot of success doing things based on database roles, rather than usernames. Then, in your DAO object you would acquire a generic connection (one that has a valid username/password, but no access to any tables) and then do a SET ROLE statement based on who the current user is. Then, before you return the connection to the pool, you will want to reset the role again. Using this approach maximizes the usefulness of any connection pool.

Craig



---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Reply via email to