Custom Sentry Function

Question

All,
Is there any documentation on writing custom sentry functions? I've been able to find some miscellaneous blog entries, but nothing definitive.
Thanks,
-David

Answer 1

Tyson,
I don't think authorization's the right line of thought, in this case.
Let me explain what I'm trying to do: I've set up our APEX applications to use a common authentication procedure (all applications redirect to a central "launchpad" application for authentication). However, some of our applications need the user to be authenticated against Oracle EBS (for authorization, populating the who columns, etc.), while others need the user authenticated against LDAP (since everyone has an LDAP account, but not necessarily an EBS one). I've built a table which maps applications to the necessary authentication method, and the custom authentication process looks at the FSP_AFTER_LOGIN_URL variable to figure out which application the user is trying to get to, authenticating appropriately. This all works.
However, if a user logs in to an EBS application and then tries to access an LDAP application, they're not currently forced to re-authenticate, as APEX doesn't know that they need to. (Remember, both applications use the launchpad's authentication, which sets a common cookie for all applications.) This is extremely problematic, for obvious reasons. So, my thought was to set up a post-authentication process to store session ID's, APP_USER, and the authentication method used, and a page sentry process that checks to make sure that the current session ID, APP_USER, and required authentication method actually match.
I feel like I've almost got this working. Here're my two functions:
procedure after_authentication is
     l_session_id number;
     l_username varchar2(250);
     l_authentication_method number := 0;
begin
     l_session_id := apex_custom_auth.get_session_id_from_cookie;
     l_username := apex_custom_auth.get_username;
     -- Since this runs as part of the Launchpad, we need to check where we're
     -- going instead of where we are.
     if v('FSP_AFTER_LOGIN_URL') is not null then
          -- Wrap this in begin/end to suppress exceptions.
          declare
               l_url varchar2(250) := v('FSP_AFTER_LOGIN_URL');
               l_start number; l_end number;
               l_app_id number;
          begin
               l_start := instr(l_url,'=')+1;
               l_end := instr(l_url,'|');
               l_app_id := substr(l_url,l_start,l_end-l_start);
               select authentication_method_id into l_authentication_method
               from apex_app_auth_map am
               where am.application_id = l_app_id;
          exception
               when others then
                    l_authentication_method := 1;
          end;
     end if;
     insert into apex_session_tracking( session_id, last_login_date, authentication_method, app_user )
     values( l_session_id, sysdate, l_authentication_method, l_username );
end after_authentication;
-- Page sentry function to check if the used authentication method matches the current one.
function page_sentry( p_apex_user in varchar2 ) return boolean is
     l_session_id number;
     l_username varchar2(250);
     l_valid_session number := 0;
begin
     -- check to ensure that we are running as the correct database user 
     if user != upper(p_apex_user) then  
          return false;  
     end if; 
     l_session_id := apex_custom_auth.get_session_id_from_cookie;
     l_username := apex_custom_auth.get_username;
     select count(*) into l_valid_session
     from apex_session_tracking ast,
          apex_app_auth_map am
     where ast.session_id = l_session_id
          and am.application_id = apex_application.g_flow_id
          and upper(ast.app_user) = l_username
          and am.authentication_method_id = ast.authentication_method;
     if l_valid_session = 1 then
          return true;
     else
          delete from apex_session_tracking ast where ast.session_id = l_session_id;
          return false;
     end if;
end page_sentry;From what I've been able to figure out, this should work. But it's not; the sentry function seems to constantly kick the user back to the login screen. Through testing, it seems like the post-authentication process and the sentry process are getting different session ID's back from apex_custom_auth, which I don't understand. And neither ID matches the session ID in the URL, which has me even more confused.
I'm about ready to punt and just rely on the APP_USER value to identify records in the apex_session_tracking table, but that seems like it'd be inherently less secure. But I'm not seeing what I'm doing wrong, either.
-David