[Net 2000 Ltd. Home][DataBee Home][DataBee Manual][DataBee FAQ]

Extraction and Load Proxy Accounts

A Proxy Account Configured on the Rule Controller Login Panel

In certain circumstances it is undesirable or not permitted to connect directly to the schema owner account in order to access the data. An example of such a requirement is the need to use the production database as the source for the extract. In that case, direct access to the schema which owns the tables would implicitly grant write permissions to the extraction process and this may be considered inappropriate for security reasons. A preferred method, in such a situation, would be to have the DataBee Set Extractor application connect via a separate login called a proxy login. The proxy login would be granted select access at the Oracle level to the tables in the real schema. The temporary tables required by the extraction process would also be created in the schema of the proxy login thus enabling the real schema owner of the tables to be entirely read-only to the extraction process.

The screen shot above shows a proxy login configured in the Login Panel of a Rule Controller. In the above example, the schema named source_user is the real owner of the tables. When the extraction set is run, the Rule Controller will connect to the source_proxy account to access the tables in the source_user schema. The source_proxy login has only read access to the tables in the source_user schema and it will also contain the temporary tables necessary for the extraction process.

Some notes on Proxy Accounts

  1. The proxy account information can be entered as part of the New Set Wizard. Alternatively, the Login Panel of the appropriate Rule Controller can be edited at a later time to configure access via proxy login.

  2. The proxy schema must be in the same database as the schema which owns the tables.

  3. The proxy schema must have at least read only access to the tables in the source schema.

  4. The proxy schema must contain the temporary tables. These tables can be created using the tools on the Rule Controller Options tab.

  5. It is not necessary to use synonyms in the proxy account to redirect the incoming Set Extractor SQL statements. The Set Extractor, once it knows it is using a proxy, will preface each table name with the appropriate schema name in the usual Oracle dot format. <Schema_Name>.<Table_Name>.

  6. If multiple Rule Controllers are used in the extraction set, it is possible to configure some accounts to use proxy logins and some without.

  7. If multiple Rule Controllers with proxy logins are used in the extraction set, each Rule Controller must have its own distinct proxy login. The reason for this is that the temporary tables will be located in the proxy login and these temporary tables cannot be used by multiple Rule Controllers at the same time.

  8. A Rule Controller in a loader set can also be configured to use proxy login access. This feature is mostly just included for completeness and is almost never used as the Rule Controller must have write access to the target schema in order to load the data. The only real reason to use a proxy login for loads is to locate the loader set temporary table in a different schema than the target.

[Net 2000 Ltd. Home][DataBee Home][DataBee Manual][DataBee FAQ]