ORA-31201 and APEX ERR-1082 LDAP sessions

Question

Hello!
While using Single-Sing-On from APEX against OID (Portal Applicationserver 10.1.4) we get the following error:
ORA-31201: DBMS_LDAP: allgemeiner Fehler: number of active LDAP sessions exceeded the limit of 63 sessions
Error ERR-1082 Error in executing authorization scheme code.
It works many times, but suddenly we seem to get a limit!
Details:
========
We use Application Express Version 2.2.1.00.04.
First we've tried to use the APEX-LDAP-Function is_member().
(See thread Re: Using Oracle Portal group for an authorization scheme
It worked, but we got the same error as above.
Then:
But as I read in thread ERR-1082 Error in executing authorization scheme code I changed the strategy and then used the CHECK_GROUP_MEMBERSHIP function.
We set the evaluation point for the authorization scheme to "Once per Session", too.
But we still got the error.
What am I doing wrong?
What can we check? OID or APEX?
Here is the code for both (main-function for checking the membership and a helping function which is getting the right value out of the OID on basis of the :APP_USER-Value).
Create or Replace Function PRUEFE_MITGLIEDSCHAFT (p_uid varchar2, p_gid varchar2) return BOOLEAN is
--CALL for testing:
--set serveroutput on;
--BEGIN
--IF PRUEFE_MITGLIEDSCHAFT('glasauerj','KV_OKL_P_SCHUL_ADM') THEN
--DBMS_OUTPUT.PUT_LINE('yes!');
--END IF;
--END;
--CALL for APEX:
--return PRUEFE_MITGLIEDSCHAFT(:APP_USER,'KV_OKL_P_SCHUL_ADM')
--Declarations
ldap_port PLS_INTEGER;
ldap_host VARCHAR2(256);
ldap_user VARCHAR2(256):= NULL;
ldap_passwd VARCHAR2(256):= NULL;
retval PLS_INTEGER;
my_session DBMS_LDAP.session;
group_handle DBMS_LDAP_UTL.HANDLE;
user_handle DBMS_LDAP_UTL.HANDLE;
user_type PLS_INTEGER;
user_id VARCHAR2(2000);
group_type PLS_INTEGER;
group_id VARCHAR2(2000);
begin
NULL;
ldap_host := 'host';
ldap_port := '389';
user_id := 'cn='||get_oid_cn(lower(p_uid))||','||get_oid_searchbase(lower(p_uid));
group_id := 'cn='||lower(p_gid)||', cn=portal30.060830.1405, cn=Groups, dc=lkh-ktn, dc=local';
my_session := DBMS_LDAP.init(ldap_host,ldap_port);
user_type := DBMS_LDAP_UTL.TYPE_DN;
group_type := DBMS_LDAP_UTL.TYPE_DN;
retval := DBMS_LDAP_UTL.create_user_handle(user_handle,user_type,user_id);
--DBMS_OUTPUT.PUT_LINE('create_user_handle='||retval);
retval := DBMS_LDAP_UTL.create_group_handle(group_handle,group_type,group_id);
--DBMS_OUTPUT.PUT_LINE('create_group_handle='||retval);
retval := DBMS_LDAP_UTL.check_group_membership( my_session,user_handle,group_handle,DBMS_LDAP_UTL.NESTED_MEMBERSHIP);
--DBMS_OUTPUT.PUT_LINE('check_group_membership='||retval);
IF retval = DBMS_LDAP_UTL.SUCCESS THEN
     --DBMS_OUTPUT.PUT_LINE('DBMS_LDAP_UTL.SUCCESS');
     return true;
else
     return false;
end if;
IF retval != DBMS_LDAP_UTL.SUCCESS THEN
DBMS_OUTPUT.PUT_LINE('Error : check_group_membership returns : ' || to_char(retval));
IF retval = DBMS_LDAP_UTL.PARAM_ERROR THEN
     DBMS_OUTPUT.PUT_LINE('DBMS_LDAP_UTL.PARAM_ERROR');
end if;
return false;
ELSE
NULL;
--DBMS_OUTPUT.PUT_LINE(': Successful.');
END IF;
DBMS_LDAP_UTL.free_handle(user_handle);
DBMS_LDAP_UTL.free_handle(group_handle);
return false;
End;
HELPING-FUNCTION
Create or Replace FUNCTION get_oid_searchbase(p_uid varchar2) return varchar2 is
l_dn varchar2(500);
l_searchbase varchar2(500);
l_uid varchar2(100);
my_session DBMS_LDAP.session;
my_message DBMS_LDAP.message;
my_attrs DBMS_LDAP.string_collection;
retval PLS_INTEGER;
ldap_host VARCHAR2(256):= 'host';
     ldap_port VARCHAR2(256):= '389';
ldap_user VARCHAR2(256):= NULL;
ldap_passwd VARCHAR2(256):= NULL;
ldap_userbase VARCHAR2(500) := 'cn=Users,dc=lkh-ktn,dc=local';
BEGIN
-- Beispiel dn und searchbase aufgrund von uid
-- Choosing exceptions to be raised by DBMS_LDAP library.
     DBMS_LDAP.USE_EXCEPTION := TRUE;
     -- Generieren der LDAP-message
     my_session := DBMS_LDAP.init(ldap_host,ldap_port);
retval := DBMS_LDAP.simple_bind_s(my_session, ldap_user, ldap_passwd);
my_attrs(1) := 'uid'; -- retrieve this attribute
l_uid := 'uid='||p_uid;
retval := DBMS_LDAP.search_s(my_session,
ldap_userbase,
DBMS_LDAP.SCOPE_SUBTREE,
l_uid,
my_attrs,
0,
my_message);
-- LDAP-message mit get_dn auslesen und cn wegschneiden
l_dn := DBMS_LDAP.get_dn(my_session,my_message);
l_searchbase := substr(l_dn,instr(l_dn,',')+1,length(l_dn));
return l_searchbase;
EXCEPTION
WHEN OTHERS THEN
DBMS_OUTPUT.PUT_LINE(' Error code : ' || TO_CHAR(SQLCODE));
DBMS_OUTPUT.PUT_LINE(' Error Message : ' || SQLERRM);
DBMS_OUTPUT.PUT_LINE(' Exception encountered .. exiting');
return null;
END;
sho err;
PLEASE, I would appreciate any help!
Joerg

Answer 1

I should have called it unreachable code. You have this block:
IF retval = DBMS_LDAP_UTL.SUCCESS THEN
--DBMS_OUTPUT.PUT_LINE('DBMS_LDAP_UTL.SUCCESS');
return true;
else
return false;
end if;
No code after this block will execute but there is code after it.
Scott