HTML DB with Microsoft Active Directory access

Question

HTML DB Authentication works fine, but autherization gives the following error. We hope someone has similar experience in this forum. The following error we got after we added password to the is_member function. If use NULL for password it always gives No autherization to page error.
Error Message : ORA-31202: DBMS_LDAP: LDAP client/server error: Invalid
credentials. 80090308: LdapErr: DSID-0C09030F, comment: AcceptSecurityContext
error, data 525, vece
Exception encountered .. exiting

Answer 1

Thanks Scott, We got answers from your earlier discussion on following threads.. We are posting the points in your discussion again and it may help others..
LDAP Setup - How ?
Let's focus on authentication first. I assume you have a login page in the app. Create a new authentication scheme based on the LDAP model (follow the wizard.) Edit the scheme, changing the authentication function from -LDAP- to: return function_name;, giving the name of a function in your schema which does the ldap authentication. This function must have the signature(p_username in varchar2, p_password in varchar2) return boolean. Null out any other ldap-related fields in this new authentication scheme and make sure it points to the login page in your app for the Invalid Session Page attribute. Save changes and then make this the current scheme. Your login page is already set up to call the HTML DB login API and because your authentication scheme specifies an authentication function, that's what it will use to check credentials when the login page which captured username and password is submitted. If the credentials check out, the login API will redirect to the page specified in the login pages login process' p_flow_page argument, e.g., p_flow_page=>&APP_ID.:1, for page 1. Change this page ID as required.
Authorization schemes are simpler. They will probably be of type PL/SQL function returning boolean which will use the current value of :APP_USER to consult the LDAP directory for specific information. After creating the schemes, you can attach them to whatever components you need to, e.g., regions, buttons, processes.
function userInGroup(p_username in varchar2,p_group in varchar2)
return boolean
as
l_retval PLS_INTEGER := -1;
l_session DBMS_LDAP.session;
l_attrs DBMS_LDAP.string_collection;
l_message DBMS_LDAP.message;
l_entry DBMS_LDAP.message;
l_attr_name VARCHAR2(256);
l_ber_element DBMS_LDAP.ber_element;
l_vals DBMS_LDAP.string_collection;
l_found boolean := false;
begin
DBMS_LDAP.use_exception := false;
--connect to LDAP and authenticate
l_session := DBMS_LDAP.init(hostname => g_host,
portnum => g_port);
l_retval := DBMS_LDAP.simple_bind_s(ld => l_session,
dn => g_ldap_user,
passwd => g_ldap_pwd);
--Get Group Membership
l_attrs(1) := 'memberOf';
l_retval := DBMS_LDAP.search_s(ld => l_session,
base => g_ldap_user_base,
scope => DBMS_LDAP.SCOPE_SUBTREE,
filter => 'cn='||p_username||'*',
attrs => l_attrs,
attronly => 0,
res => l_message);
IF DBMS_LDAP.count_entries(ld => l_session, msg => l_message) > 0 THEN
-- Get all the entries returned by our search.
l_entry := DBMS_LDAP.first_entry(ld => l_session,
msg => l_message);
l_attr_name := DBMS_LDAP.first_attribute(ld => l_session,
ldapentry => l_entry,
ber_elem => l_ber_element);
l_vals := DBMS_LDAP.get_values (ld => l_session,
ldapentry => l_entry,
attr => l_attr_name);
<< values_loop >>
FOR i IN l_vals.FIRST .. l_vals.LAST LOOP
if l_vals(i) like '%'||p_group||'%' then
l_found := true;
exit; --exit if found
end if;
END LOOP values_loop;
END IF;
--must unbind from LDAP
l_retval := DBMS_LDAP.unbind_s(ld => l_session);
if l_found then
return true;
else
return false;
end if;
exception
when others then
l_retval := DBMS_LDAP.unbind_s(ld => l_session);
return false;
end userInGroup;