Authorization scheme methods/techniques

Question

Hi all,
I'm currently using the Authorization Scheme that came with the Build a Menu Framework Application. Unfortunately, it doesn't work the way I want it to.
Can someone share any other techniques on how to set up a authorization scheme. My application has users divided in different roles where some pages are accessible by 1 role then other pages by another role.
Any suggestions will be appreciated.
Thanks and Regards,
Allen

Answer 1

Hi,
Let me give you my thoughts on this thread.
You need to be very careful about the use of the term Authentication and Authorization.
Authentication deals with making sure the user is who they say they are (normally by requesting a password).
Authorization deals with making sure a user can only do what they are allowed to do.
For Authentication you have a number of options. If none of the standard ApEx Authentication schemes work for you then you can create your own:
Create a database function that accepts a username and a password and returns TRUE or FALSE. For testing our applications we use a very simple function:
create or replace function "TESTING_SIGNON_FNC"
(p_username in VARCHAR2,
p_password in VARCHAR2)
return BOOLEAN
is
CURSOR c_valid_password
IS
SELECT 1 FROM DUAL
WHERE UPPER(p_username) = UPPER(p_password);
l_valid_password NUMBER;
BEGIN
OPEN c_valid_password;
FETCH c_valid_password INTO l_valid_password;
IF c_valid_password%FOUND THEN
CLOSE c_valid_password;
RETURN TRUE;
END IF;
CLOSE c_valid_password;
RETURN FALSE;
END;
Change the select to use whatever method you like.
Then Create an Authentization Scheme with an 'Authentication Function' of 'return TESTING_SIGNON_FNC;'
For Authorization you need to decide how you will control who can do what and how you maintain this. In our applications we need users (Administrators) of the application to be able to grant / revoke access to certain areas via the application UI.
The solution we have developed has five database tables:
SEC_PERSON
SEC_ROLES
SEC_FUNCTIONS
SEC_ROLE_FUNCTIONS
SEC_PERSON_ROLES
SEC_PERSON holds the Person Details
SEC_FUNCTIONS has the functions that we want to be able to grant ('create project' for instance)
SEC_ROLES has the roles that we want to be able to Grant to people ('Project Manager' for instance)
SEC_ROLE_FUNCTIONS has the functions assigned to a Role ('Project Manager' can 'Create Project')
SEC_PERSON_ROLES has the roles a person has ('Fred' is a 'Project Manager')
We have pages on each table to allow users to maintain the data.
In ApEx we then define Authorization Schemes for each function we want to control:
TPA-PRJ-PRJ-FED (TPA Application - Projects - Project Control - Full Edit) with the following SQL:
select
1
from
sec_person p,
sec_person_roles pr,
sec_roles r,
sec_role_functions rf,
sec_functions f
where
f.function_code = 'TPA-PRJ-PRJ-FED'
and
p.person_id = pr.person_id and
pr.role_id = r.role_id and
r.role_id = rf.role_id and
rf.function_id = f.function_id and
p.delete_flag = 'N' and
pr.delete_flag = 'N' and
r.delete_flag = 'N' and
rf.delete_flag = 'N' and
r.delete_flag = 'N' and
sysdate between p.start_date and nvl(p.end_date,sysdate) and
sysdate between pr.start_date and nvl(pr.end_date,sysdate) and
sysdate between r.start_date and nvl(r.end_date,sysdate) and
sysdate between rf.start_date and nvl(rf.end_date,sysdate) and
sysdate between f.start_date and nvl(f.end_date,sysdate) and
p.username = :APP_USER
This Authorization scheme can then be applied to Tabs, Pages, Buttons, Columns etc. as required.
Difficult to explain all this without pictures but I hope this helps.
Martin