LDAP in authentication and authorization

Question

Hey guys,
so i'm trying to develop a security model for my company using apex and active directory and i'm running into a few barriers.
what i need is to have a application that connects to active directory, authenticates that they are on the network and then be assigned a authorization scheme based on AD group membership.
i had a authentication function that worked perfectly until i need to check which authorization scheme to assign to the user. my challenge being is that my AD stores users by LastName, FirstName, but usernames are in FirstName, LastName. My script currently is launched from the login page in apex which provides p_username, p_password. i can bind to AD no problem, using the samaccountname however in order to use the compare_s method i need to provide the DN of the user (unless there is a different way, please please tell me) so i have the search_s method scour the entire AD for the user and retrieve the DN of the user and then it provides this to the compare_s so that the group membership can be validated returning true/false on whether the user is part of the group.
my new challenge is that i need to validate against multiple groups that are assigned to different authorization schemes so what i wanted to do is authenticate to AD to retrieve the DN then pass along the DN (either POST, global variable, anything really) so that the authorization schemes can run their functions to see which group membership to apply. however, i have had no luck passing the global variable to the application or putting the DN in the POST.
any ideas on this would be greatly appreciated...

Answer 1

so currently i have this in the authentication function:
create or replace function authenticate_aduser(
     p_username          in          varchar2,
     p_password          in          varchar2)
return boolean
is
     l_user               varchar2(256);
     l_ldap_server     varchar2(256)     := 'theserver';
     l_domain          varchar2(256)     := 'thedomain';
     l_ldap_port          number               := 389;
     l_retval          pls_integer;
     l_session          dbms_ldap.session;
     l_cnt               number;
begin
     l_user               := p_username||'@'||l_domain;
     l_session          := dbms_ldap.init( l_ldap_server, l_ldap_port ); -- start session
     l_retval          := dbms_ldap.simple_bind_s( l_session, l_user, p_password ); -- auth as user
     l_retval          := dbms_ldap.unbind_s( l_session ); -- unbind
     return true;
exception when others then
     l_retval := dbms_ldap.unbind_s( l_session );
     return false;
end;
how would you recommend changing this into a post process??