Need help on customizing a login page in APEX 3.0

Question

I am new to APEX 3.0 and I am trying to add another field to the standard login page. Basically, I would like to keep the username password field and add a PIN number and/or challenge question to the login 101 page. The user would enter a PIN # and/or response to a challenge question in addition to the username password and have it all processed to allow a login. In addition, if the user enters the correct PIN# and/or Challenge, I want to execute this code " EXECUTE IMMEDIATE DBMS_SESSION.SET_IDENTIFIER (':p101_client_id'). P_101_client_id being the item name I 've added to the login 101 page which should be initialized to the value entered as the PIN# Can anyone help me? Thanks!

Answer 1

Thanks for your response. I have an FGAC policy defined on a particular table to allow/disallow access to the table data. The policy in place is similar to this function:
BEGIN
IF (SYS_CONTEXT('USERENV','OS_USER')='ODS-SV1\George Jucan' AND
-- SYS_CONTEXT('USERENV','IP_ADDRESS')='192.168.0.2' AND
SYS_CONTEXT('USERENV','SESSION_USER')='APPSVR' AND
SYS_CONTEXT('USERENV','TERMINAL')='ODS-SV1')
OR
(SYS_CONTEXT('USERENV','SESSION_USER') = 'SHIP2004' AND
SYS_CONTEXT('USERENV','CLIENT_IDENTIFIER')='Administrator')
THEN
     cond := ' CARD_NO IS NOT NULL';
ELSE
     cond := ' CARD_NO IS NULL';
END IF;
RETURN (cond);
END sec_predicate ;
With this in place, I can not see the data I need for a report I have created. Which is expected behavior. What I want to do is upon logon to my APEX application add a third box i.e. PIN#, in addition to the standard username password and have this pin number processed as the SYS_CONTEXT('USERENV','CLIENT_IDENTIFIER')='Administrator') ('Administrator' being the correct "PIN"). If I go through SQL Plus and I have the correct login information mentioned in the above function, I can issue the dbms_session procedure initialized to 'Administrator' and gain access to the data. I do not want every database session to have acces to this data only the person(s) that meet the FGAC predicate. If not then you can not view this data. Other data can be visible. I am not sure how to implement this so my APEX interface can make use of my FGAC policy. Can you have a restriction on a particular page and/or page item that requests a "PIN" before you are allowed to view the page and/or item? I hope this provides more detail.