Establishing User Identity Through Authentication

Understanding How Authentication Works

You determine how your application interacts with users. If all users have the same rights and privileges, they are referred to as public users. However, if your application needs to track each user individually, you need to specify an authentication method.

Authentication establishes the identity of each user who accesses your application. Many authentication processes require that a user provide some type of credentials such as a user name and password. These credentials are then evaluated and they either pass or fail. If the credentials pass, the user has access to the application. Otherwise, access is denied.

Once a user has been identified, the Application Express engine keeps track of each user by setting the value of the built-in substitution string APP_USER. As a user navigates from page to page, the Application Express engine sets the value of APP_USER to identify the user. The Application Express engine uses APP_USER as one component of a key for tracking each user's session state.

From a programming perspective, you can access APP_USER using the following syntax:

• From PL/SQL:

  V('APP_USER')
  

• As a bind variable from either PL/SQL or SQL:

  :APP_USER
  

You can use APP_USER to perform your own security checks and conditional processing. For example, suppose you created the following table:

CREATE TABLE my_security_table (
  user_id   VARCHAR2(30),
  privilege VARCHAR2(30));

Once created, you could populate this table with user privilege information and then use it to control the display of pages, tabs, navigation bars, buttons, regions, or any other control or component.

Determining Whether to Include Authentication

As you create your application, you need to determine whether to include authentication. You can:

• Choose to not require authentication. Oracle Application Express does not check any user credentials. All pages of your application are accessible to all users.

• Select a built-in authentication scheme. Create an authentication method based on available preconfigured authentication schemes. Depending on which scheme you choose, you may also have to configure the corresponding components of Oracle 10giAS, Oracle Internet Directory, or other external services. See "Using Preconfigured Authentication Schemes" and "Changing the Authentication Scheme Associated with an Application".

• Create custom authentication scheme. Create a custom authentication method to have complete control over the authentication interface. To implement this approach, you must provide a PL/SQL function the Application Express engine executes before processing each page request. This function's Boolean return value determines whether the Application Express engine processes the page normally or displays a failure page. See "Creating an Authorization Scheme".

Creating an Authentication Scheme

To create an authentication scheme:

1. On the Workspace home page, click the Application Builder icon.

2. Select an application.

3. On the Application home page, click Shared Components.

   The Shared Components page appears.

4. Under Security, select Authentication Schemes.

   The Authentication Schemes page appears.

5. To create a new authentication scheme, click Create.

6. Specify how the scheme should be created by selecting one of the following:

   • Based on preconfigured scheme. See "Managing Existing Authentication Schemes".

   • As a copy of an existing scheme

   • From scratch

7. Follow the on-screen instructions.

Using Preconfigured Authentication Schemes

When you select a preconfigured authentication scheme, Oracle Application Express creates an authentication scheme for your application that follows a standard behavior for authentication and session management.

Topics in this section include:

• Open Door Credentials

• Oracle Application Express Account Credentials

• Database Account Credentials

• LDAP Credentials Verification

• DAD Credentials Verification

• Single Sign-On Server Verification

About Creating an Authentication Scheme from Scratch

Creating an authentication scheme from scratch gives you complete control over your authentication interface. This is the best approach for applications when any of the following is true:

• Database authentication or other methods are not adequate.

• You want to develop your own login form and associated methods.

• You want to delegate all aspects of user authentication to external services such as Oracle 10gAS Single Sign-On.

• You want to control security aspects of session management.

• You want to record or audit activity at the user or session level.

• You want to enforce session activity or expiry limits.

• You want to program conditional one-way redirection logic before Oracle Application Express page processing.

• You want to integrate your application with non-Oracle Application Express applications using a common session management framework.

• Your application consists of multiple applications that operate seamlessly (for example, more than one application ID).

Managing Existing Authentication Schemes

Once created, available authentication schemes display in the Authentication Schemes Repository.

To navigate to the Authentication Schemes Repository:

1. On the Workspace home page, click the Application Builder icon.

2. Select an application.

3. On the Application home page, click Shared Components.

   The Shared Components page appears.

4. Under Security, select Authentication Schemes.

   The Authentication Schemes page appears. You can change the appearance of the page by making a selection from the View list. Available options include:

   • Icons (the default) displays each authentication scheme as a large icon. To edit an authentication scheme, click the appropriate icon.

   • Details displays each application item as a line in a report.

     In Details view you can:

     • Edit an authentication scheme by selecting the scheme name

     • View a list of the steps performed on each page by clicking the Show icon

     • Apply an authentication scheme to an application by clicking the make current link

Viewing the Authentication Scheme Associated with an Application

To view the current authentication scheme for an application:

1. On the Workspace home page, click the Application Builder icon.

2. Select an application.

3. Click Shared Components.

4. Under Security, click Edit Security Attributes.

5. Locate the Authentication section. The current authentication scheme displays next to Authentication Scheme.

6. To link to the Authentication Scheme pages, select the scheme name.

Changing the Authentication Scheme Associated with an Application

To change the authentication scheme for an application:

1. Navigate to the Authentication Schemes:

   1. On the Workspace home page, click the Application Builder icon.

   2. Select an application.

   3. On the Application home page, click Shared Components.

      The Shared Components page appears.

   4. Under Security, select Authentication Schemes.

2. Click the Change Current tab at the top of the page.

3. Select a new authentication scheme and click Next.

4. Click Make Current.

Viewing Authentication Scheme Utilization Report

The Authentication Schemes report lists authentication scheme utilization for all applications in the current workspace.

To view the Authentication Schemes report:

1. On the Workspace home page, click the Application Builder icon.

2. Select an application.

   The Application home page appears.

3. On the Tasks list, click View Application Reports.

4. Click Cross Application Reports.

5. Select Authentication Schemes.

6. Click the application ID to link to the appropriate Application home page.