Authentication issue with 4.1

Question

We are using a custom authentication scheme. It calls the authenticatin api to authenticate agains active directory.
It is working in multiple apex aplications in apex version 3.2. We created a new install of 4.1 and imported the apps from 3.2
I can't get this authentication to work in 4.1. Here is the code that works in 3.2 but not in 4.1
This code is in the login process of page 101.
The error msg I get is Invalid Login Credentials
I have created the application at the oracle hosted site. id/wd id guest/Lock01$
Off course for simplicty, all the code does is emualte how I am logging in at the 3.2 install. All other code has not been copied over. This application works on our 3.2 install but not 4.1! Help!
{declare
b_result boolean := false;
c_result boolean := false;
d_result boolean := false;
begin
-- :IS_ADMIN_USER := 0;
-- :IS_IE_USER := 0;
:USERNAME := :P101_USERNAME;
:PASSWORD := :P101_PASSWORD;
-- for security reasons I commented out the server and base domain info. in this call.
b_result := LDAP2.AUTHENTICATE_ADUSER(:P101_USERNAME, :P101_PASSWORD, :P101_DOMAIN, '#####.####.com', 'DC=####,DC=####,DC=com');
if (b_result = true) then
-- I know that session is valid as i displayed a mesg if it was valid to be sure.
If APEX_CUSTOM_AUTH.IS_SESSION_VALID
--this was the old way in 3.2 that worked but doesn't in 4.1
-- wwv_flow_custom_auth_std.post_login(
-- P_UNAME => :USERNAME,
-- P_PASSWORD => :PASSWORD,
-- P_SESSION_ID => v('APP_SESSION'),
-- P_FLOW_PAGE => :APP_ID||':1'
-- I tried this in 4.1 but still doesn't work
APEX_CUSTOM_AUTH.POST_LOGIN (
p_uname => :USERNAME,
p_session_id => V('APP_SESSION'),
p_app_page => :APP_ID||':1');
End if;
else
owa_util.redirect_url('f?p=&APP_ID.:&LOGIN_PAGE.:&SESSION.');
apex_util.set_session_state('LOGIN_MESSAGE', 'Your ID or PASSWORD is incorrect. Please try again.');
end if;
-- :PASSWORD := null;
end;
Edited by: ashalon on Mar 16, 2012 11:23 AM
Edited by: ashalon on Mar 16, 2012 11:25 AM
Edited by: ashalon on Mar 16, 2012 12:20 PM
Edited by: ashalon on Mar 16, 2012 3:46 PM                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

Answer 1

Hi ashalon,
login processing normally calls the authentication scheme's login handler (aka authentication function). In many cases, this is done in a submit process on an Apex login page, that calls
apex_authentication.login (
    p_username => :P101_USERNAME,
    p_password => :P101_PASSWORD );This procedure (and it's variants, like wwv_flow_custom_auth_std.login) cause the Apex engine to
1. run the authentication scheme's pre-authentication procedure
2. pass username and password to the authentication scheme's authentication function, which should return true or false, depending on whether the credentials are valid
3. if true: run the post-authentication procedure
4. if true: save the username in session state
5. if true: prepare a redirect URL to the deep link (i.e. the page that triggered login)
6. if false: prepare a redirect URL to the login page with a notification_msg that contains the error
7. log success/failure of the login attempt
8. generate a new session cookie
9. perform the redirect
The exact order and technical details of these steps may vary from Apex version to version.
The authenentication function (2.) can check against the workspace users table (Apex authentication), the database, an LDAP repository or you can build your own.
Some authentication schemes rely on external mechanisms to check the credentials and a defined way for these to pass the username back to the authentication scheme. SSO does this in a very special way, the header-based authentication scheme simply relies on a HTTP header variable to transport the username. These authentication schemes never run 1. and 2. from above, but simply accept the username and run 3. - 9. This behaviour is exposed with the post_login procedure.
Your authentication scheme is interesting. It piggybacks on the Apex authentication scheme, but de facto uses nothing of it. The submit process on the login page checks LDAP credentials and then runs post_login, if the check was successful. You could surely rewrite this as a custom authentication, although the authentication function had to rely on v('P101_DOMAIN') in addition to the username and password that get passed to it by default. Whether the rewrite makes sense is up to you, of course. If you are comfortable with this authentication, stick to it. But it probably would be much easier to understand for others and also easier to reuse in other apps if the LDAP credentials checking was in the authentication scheme.
Regards,
Christian