Owa_cookie.get('DIVEPORT_COOKIE');
I am trying to bypass the login screen but know who is logged in.
We have a deployment site in DI Diver which will launch a APEX application from a URL.
The user logs into DI DIver and we can write a cookie out stating who is logged in.
I want to allow the user to launch APEX without logging in. When we try to use
Shared components > authentication schemas Set to database we bypass the login screen,
However I need to get the userid out of the cookie and set a text field to the user_id so that I can control displays in the application.
declare
v varchar2(255) := null;
c owa_cookie.cookie;
begin
c := owa_cookie.get('DIVEPORT_COOKIE');
:P1_X := c.vals(1);
exception when others then null;
end;
I may be off base with my approach but I am tring to figure out APEX as I go.
Thanks
Please tell us your first name.
Cookies don't work that way. Browsers send cookies in requests to sites that sent the cookies, in general. If the DI Diver application from host A sends a cookie to your browser and your browser then requests an Application Express page from host B, the DI Diver cookie isn't going to get sent.
Scott
Similar Messages
-
OWA_COOKIE.GET and error message ORA-01403
Hello Everyone,
I have a process Get Username Cookie as below:
declare
v varchar2(255) := null;
c owa_cookie.cookie;
begin
c := owa_cookie.get('LOGIN_USERNAME_COOKIE');
:P101_USERNAME := c.vals(1);
exception when others then null;
end;
When the process run, it raises an error message,
"Invalid PL/SQL expression condition: ORA-01403: no data found Invalid PL/SQL expression condition: ORA-01403: no data found"
How do I not show this error on the screen but something more meaningful?
Thanks so much in advance.
MTHi,
I think error do not come from that code you did post.
Check what is that process condition.
Regards,
Jari -
I had a function in a procedure that got the current browser session cookie. I used owa_cookie.get('SESSION_ID') to retrieve it. This function, however, is not available to use in a webform - how can a form get the current browser session? Is there a new function for 9i webforms?
Thanks!
SteveHi,
the Forms session ID cannot be accessed in Forms, neither by owa_cookie, nor by Forms itself. In theroy the session ID could be obtained by the Forms Listener servlet (not the f90servlet), which is difficult to obtain a handle to from a client. If you feel that knwing about the session ID is important, you can file this as an enhancement request with customer support.
Frank -
Problems with OWA_COOKIE send and get
Hi all,
I have a problem with OWA_COOKIE-package. What I'm trying to do is to integrate Oracle eBS and an APEX app. The application resides on different databases and servers.
I'm basing my code on this white paper:
http://www.oracle.com/technology/products/database/application_express/pdf/Extend_Oracle_Applications_11i.pdf
I have the function set up in eBS and it redirects me to my APEX login page. The next step is to pass a cookie with the user name password to the APEX app. Here the problems begins.
My launch code in the eBS database (lots of hardcoded values just for the test):
PROCEDURE xxapex_launch (application IN NUMBER DEFAULT 107
, page IN NUMBER DEFAULT 1
, request IN VARCHAR2 DEFAULT null
, item_names IN VARCHAR2 DEFAULT NULL
, item_values IN VARCHAR2 DEFAULT NULL) AS
BEGIN
OWA_UTIL.mime_header('text/html', false);
OWA_COOKIE.send (name => 'APEX_APPS_107',
value => 'daniel:development',
expires => sysdate + 365,
path=>'/');
OWA_UTIL.redirect_url('http://server:8090'||'/apex/f?p='||
application||':'||page||'::'||request||':::'||
item_names||':'||item_values);
END xxapex_launch;
The application process in APEX that should read the cookie(on-load before header):
DECLARE
c OWA_COOKIE.cookie;
a wwv_flow_global.vc_arr2;
BEGIN
c := OWA_COOKIE.get('APEX_APPS_107');
a := htmldb_util.string_to_table(c.vals(1));
:P160_USERNAME := a(1);
:P160_PASSWORD := a(2);
IF :P160_PASSWORD IS NOT NULL THEN
wwv_flow_custom_auth_std.login(
P_UNAME => :P160_USERNAME,
P_PASSWORD => :P160_PASSWORD,
P_SESSION_ID => v('APP_SESSION'),
P_FLOW_PAGE => :APP_ID||':160');
__END IF;
END;The error I get is no-data-found when this is run:
:P160_USERNAME := a(1);
The c.num_vals is 0 and what I can understand OWA_COOKIE.get does not find my cookie. Is there anybody out there that can point on what I'm doing wrong?
Regards DanielBack on this....
Is there somebody that have successfully implemented the solution described in?
http://www.oracle.com/technology/products/database/application_express/pdf/Extend_Oracle_Applications_11i.pdf
Questions:
Should I create a custom login page or use the default (that using my custom Authentication Scheme)?
In the white paper where it's described on how to create the application process (that reads the cookie) it says (page 5):
"This process should be conditional and should not be run if the login page is processing a logout request."
Does somebody know on how to achive this?
In my case my eBS is on one server and the APEX installation is on another server, I don't know if that's
what preventing it to work.
I'm trying to make a very simple proof of conecpt, my app only contain one login page (the default) and
one blank HTML-page. I have a database link between my APEX and EBS database (using APPS user). My
app works fine in a stand-alone scenario. But when I start it from EBS I get the login page (the appl.
process code has not fired) and if I tries to login using a username and a pwd I can se that the
appl. process fires and is reading the cookie correctly. The problem is that it "hangs" and it seems that
appl. process fires over and over again (can see that in my log table).
My code:
The Authentication Function
create or replace FUNCTION demo_ebiz_suite_auth
(p_username in VARCHAR2,
p_password in VARCHAR2) return BOOLEAN is
begin
__return true; /* can log in with whatever */
end;
Application Process - On load: Before header (page template header)
DECLARE
__c OWA_COOKIE.cookie;
__a wwv_flow_global.vc_arr2;
BEGIN
__demo_toLog('APEX process', '1');
__c := OWA_COOKIE.get('APEX_APPS_'||:APP_ID);
__a := htmldb_util.string_to_table(c.vals(1));
__:P101_USERNAME := a(1);
__:P101_PASSWORD := a(2);
__demo_toLog('APEX process', ':P101_USERNAME '||:P101_USERNAME);
__demo_toLog('APEX process', ':P101_PASSWORD '||:P101_PASSWORD);
__demo_toLog('APEX process', ':APP_ID '||:APP_ID);
__IF :P101_PASSWORD IS NOT NULL THEN
____demo_toLog('APEX process', 'before trying to login');
____wwv_flow_custom_auth_std.login(
______P_UNAME => :P101_USERNAME,
______P_PASSWORD => :P101_PASSWORD,
______P_SESSION_ID => v('APP_SESSION'),
______P_FLOW_PAGE => :APP_ID||':1'
____demo_toLog('APEX process', 'after login');
__END IF;
EXCEPTION
__WHEN OTHERS THEN
____demo_toLog('APEX process', 'Fel: '||SQLERRM);
END;
Maybe I'm doing some simple misstake here but I can't see it. I need a second opinion.
Thanks.
/Daniel -
Getting Logged on User'Information in an Oracle-Form SSO Partner Application
Hi.
I could run Flight-of Fancy Application and capture user's information by calling the
"Parse_cookie " Procedure.(use the Scenario 2 - Access the Portal and then the FOF App)
and defined an Oracle-Form application as Partner application like FOF.
I want to have Logged on user'Information in the "Oracle-Form" . But the Fucntion owa_cookie.get dosen't work correctly.please let me know what can I do ?
Thanks in advanced.Hi.
I could run Flight-of Fancy Application and capture user's information by calling the
"Parse_cookie " Procedure.(use the Scenario 2 - Access the Portal and then the FOF App)
and defined an Oracle-Form application as Partner application like FOF.
I want to have Logged on user'Information in the "Oracle-Form" . But the Fucntion owa_cookie.get dosen't work correctly.please let me know what can I do ?
Thanks in advanced. If you're writing your own partner application, then you are correct to get the user information from the output variables
from the parse_url_cookie procedure. You should then set the information you want to keep track of in the cookie, or combination
of cookie and persistent storage in the database. Take care of the security implications while doing this.
On subsequent calls to your application, the user info should be obtained from the cookie and the database, if you
are using a combination of the cookie and database storage to keep your info.
The owa_cookie.get routine is used to read the cookie, which is generated with owa_cookie.send.
These routines work fine, when invoked correctly.
If you are having trouble with them, you're probably not using the calls properly.
The following code provides an example of how to use the owa_cookie calls...
create or replace package testcookie
is
procedure show (p_name IN VARCHAR2);
procedure send
p_name IN VARCHAR2,
p_value IN VARCHAR2,
p_path IN VARCHAR2 default null,
p_expires IN VARCHAR2 default null
end testcookie;
show error package testcookie
create or replace package body testcookie is
procedure show (p_name IN VARCHAR2) is
v_cookie owa_cookie.cookie;
begin
v_cookie := owa_cookie.get(upper(p_name));
htp.htmlopen;
htp.bodyopen;
htp.print(v_cookie.vals(1));
htp.bodyclose;
htp.htmlclose;
exception
when others then
htp.htmlopen;
htp.bodyopen;
htp.print('NO COOKIE FOUND.');
htp.print(SQLERRM);
htp.bodyclose;
htp.htmlclose;
end;
procedure send
p_name IN VARCHAR2,
p_value IN VARCHAR2,
p_path IN VARCHAR2 default null,
p_expires IN VARCHAR2 default null
is
v_cookie owa_cookie.cookie;
l_agent varchar2(30);
l_expires varchar2(30);
l_path varchar2(100);
begin
if p_expires is null then
l_expires := null;
else
l_expires := to_date(p_expires, 'MMDDYYYY');
end if;
if p_path = 'ALL' then
l_path := '/';
else
l_path := null;
end if;
owa_util.mime_header('text/html', FALSE);
l_agent := owa_util.get_owa_service_path;
l_agent := substr(l_agent, 1, length(l_agent) - 1 ) ;
owa_cookie.send(
name => upper(p_name),
value => p_value,
expires => l_expires,
path => l_path
owa_util.http_header_close;
htp.htmlopen;
htp.headopen;
htp.headclose;
htp.bodyopen;
htp.print ('Cookie set.');
htp.bodyclose;
htp.htmlclose;
end;
end testcookie;
show error package body testcookie;
grant execute on testcookie to public;If you load this into a schema which a DAD can access, then you can invoke the show and send procedures to view and
generate cookies.
To generate a cookie, issue the following from your browser ...
http://server.domain.com/pls/dad/schema.testcookies.send?p_name=test&p_value=hello
To view the cookie:
http://server.domain.com/pls/dad/schema.testcookies.show?p_name=test -
How do I get the _pageid using wwpro_api_parameters for a form published as a portlet
Hi, I need to be able to determine which page my form component is running on.
Is it possible using the pl/sql api to determine the value of the _pageid parameter?
The wwpro_api_parameters package does not expose all of the parameters in the URL. I need the _pageid parameter.
The only alternative I can think of, is to output some Javascript in the before form PL/SQL section that stores the document url in a cookie, which is then retrieved using the OWA_COOKIE package.
Surely there is a better alternative?
I am running 3.0.9.8.1 (patched) on Windows NT.
I know report components published as portlets have access to p_page_url? Is there something similar for form components?
I know I am unlikely to get a response!
kind regards,
Matt.Resorted to cookies!
Before page pl/sql ...
begin
htp.p('^script language="Javascript1.1"^SetCookie("PageURL",unescape(document.location),expire(1,0,0,0),"/",".disney.com");<^script^');
end;
declare
lv_page_url VARCHAR2(256) := null;
pageurlCookie owa_cookie.cookie;
ln_type_id number := -1;
lv_currenttab varchar2(64);
begin
begin
pageurlCookie := owa_cookie.get('PageURL');
if pageurlCookie.num_vals != 0 then
lv_page_url := substr(pageurlCookie.vals(pageurlCookie.vals.first),1,256);
end if;
exception
when others then
null;
end;
if lv_page_url is not null then
lv_page_url := bvhe_page_utils.unencode(lv_page_url);
end if;
lv_currenttab :=
bvhe_portal.bvhe_page_utils.get_idname(
bvhe_portal.bvhe_page_utils.process_pageid(
bvhe_portal.bvhe_page_utils.get_pageid(lv_page_url)
null -
Owa_cookie login username cookie lost after logout
I have a problem with owa_cookie. It seems very simple. When I am logged in, username appears automatically in screen, but after I have logged out, username is not retrieved.
It seems that the cookie is not saved, as I do not find a trace of it in the cookie directory. Any suggestions?
Code listed below:
On load / before header:
declare
c owa_cookie.cookie;
v varchar2(255) := null;
begin
c := owa_cookie.get( 'LOGIN_USERNAME_COOKIE' );
:P4_USERNAME := lower( c.vals(1) );
exception
when others then null;
end;
On submit / after computations and validations:
begin
if :P4_USERNAME is not null
then
owa_util.mime_header( 'text/html', FALSE );
owa_cookie.send( name => 'LOGIN_USERNAME_COOKIE'
, value => lower( :P4_USERNAME )
, domain => 'dev.naturalmoney.org'
end if;
end;Hi,
Try
begin
owa_util.mime_header('text/html', FALSE);
owa_cookie.send(
name => 'LOGIN_USERNAME_COOKIE'
,value => lower(:P101_USERNAME)
,expires => sysdate + 356
exception when others then null;
end;Regards,
Jari
Edited by: jarola on Jul 29, 2011 1:11 PM -
Using owa_cookie to manage user browser sessions
Hi,
I need to build a check in my HTMLDB application that rejects user from logging in multiple times.
There have been several threads and discussions regarding the concept of "active" user session, and from what I gather, in general there is no way to capture the action of closing the browser by simply hitting the close button in IE. (Please correct me if I'm wrong)
I am wondering if it is possible to use a session cookie to do this? Since a session cookie is automatically removed on closing the browser, can you build an application level process (fired upon authentication) that checks for cookie existence, and rejects login if there is already a cookie (ie. if there is another browser window open)?
I have tried this by having an application level process similar to this:
DECLARE
return_cookie owa_cookie.cookie;
current_session_num PLS_INTEGER;
BEGIN
return_cookie := owa_cookie.get('test');
current_session_num := return_cookie.vals(1);
IF current_session_num = 1 THEN
/* CODE TO REJECT LOGIN */
END IF;
EXCEPTION
WHEN no_data_found THEN
owa_util.mime_header('text/html', FALSE);
owa_cookie.send (name => 'test'
,value => 1
owa_util.http_header_close();
But it doesn't seem to work, it always goes to the exception block no matter how many browser windows I have open.
Any thoughts?
Thanks,
IvanIvan,
Is there a reason you are putting this cookie code in an application level process rather than in the authentication scheme? Scott Spadafore will correct me if I'm wrong, but I fairly certain that that's where you want to put any authentication related logic.
Sergio -
Hello!
I'm new to this forum and I have subscribed because I started working in an Oracle partner in Portugal.
I am programming a dynamic menu and I have a problem using cookies (I need them to transmit menu selections informations between different pages). For that, I use pl/sql to select data and HTP.P protocol to wirte the code. When i send cookies in the DECLARE block of my pl/sql program, the cookies go visible in the HTML, which is my problem!
cke := OWA_COOKIE.GET(op_pai_des);
IF cke.num_vals=0 THEN
OWA_COOKIE.SEND(name => op_pai_des,value => 0,expires => NULL);
END IF;
op_pai_des is a variable. In my web browser, the following message is displayed:
Set-Cookie: Funcionário=0;
Do you know how I can send this information hidden?
Thank you for the attention!
HenriqueHello!
I'm new to this forum and I have subscribed because I started working in an Oracle partner in Portugal.
I am programming a dynamic menu and I have a problem using cookies (I need them to transmit menu selections informations between different pages). For that, I use pl/sql to select data and HTP.P protocol to wirte the code. When i send cookies in the DECLARE block of my pl/sql program, the cookies go visible in the HTML, which is my problem!
cke := OWA_COOKIE.GET(op_pai_des);
IF cke.num_vals=0 THEN
OWA_COOKIE.SEND(name => op_pai_des,value => 0,expires => NULL);
END IF;
op_pai_des is a variable. In my web browser, the following message is displayed:
Set-Cookie: Funcionário=0;
Do you know how I can send this information hidden?
Thank you for the attention!
Henrique -
OWA_COOKIE anyone using it with Forms 6i?
Help please!!!
I am trying to access cookie information from the browser within an Oracle Form (6i). Looking at the PL/SQL programming guide it gives a nice example.
I enter the following into my trigger of the form:
DECLARE
v_Cookie OWA_COOKIE.COOKIE;
BEGIN
v_Cookie := OWA_COOKIE.GET('UserID');
IF (v_Cookie.num_vals > 0) THEN
:CONTROL.USERNAME := v_Cookie.vals(1);
ELSE
:CONTROL.USERNAME := 'No Cookie Found';
END IF;
END;
When I compile the form it says the the 'identifier OWA_COOKIE.COOKIE must be declared'
I can see the package when I select * from ALL_OBJECTS and
my DBA's say that I have access to it.
Please help....!
JoeHelp please!!!
I am trying to access cookie information from the browser within an Oracle Form (6i). Looking at the PL/SQL programming guide it gives a nice example.
I enter the following into my trigger of the form:
DECLARE
v_Cookie OWA_COOKIE.COOKIE;
BEGIN
v_Cookie := OWA_COOKIE.GET('UserID');
IF (v_Cookie.num_vals > 0) THEN
:CONTROL.USERNAME := v_Cookie.vals(1);
ELSE
:CONTROL.USERNAME := 'No Cookie Found';
END IF;
END;
When I compile the form it says the the 'identifier OWA_COOKIE.COOKIE must be declared'
I can see the package when I select * from ALL_OBJECTS and
my DBA's say that I have access to it.
Please help....!
Joe To run OWA packages in forms you need this before you call the procedure,
DECLARE
name_arr OWA.VC_ARR;
value_arr OWA.VC_ARR;
BEGIN
OWA.INIT_CGI_ENV(0, NAME_ARR, VALUE_ARR);
END;
BUT
I have been told by oracle that you cannot use OWA_COOKIE to set cookies within web Forms, tho they have as yet not given me an alternative to set cookies in a web form -
Getting Browser Session from WebForm
Is it possible to retrieve the cookie session ID from a webform? The built-in owa_cookie.get doesn't work from the webform. Anyone have any workarounds for this?
Thanks!@
SteveSteve,
still not possible. I remember having answered a similar question last week.
Frank -
Partner Application in SSO logout does'nt synchronize
Hi All,
I've setup two separate application on different workspace and different server as partner Application. I've follow the instruction from http://www.oracle.com/technology/products/database/application_express/howtos/sso_partner_app.html
. And everything working fine, but the "logout" seen doesn't work correctly.
Example: I'm login to Application "A" from single sign on homepage, after enter username and password, it direct me to Application "A". After that, i've click on Application "B" which also located on single sign on homepage and direct me to application "B" (that's correct). When I clicked on the "logout" link in Application "A" it work fine, but the other Application (B) doesn't log me out. I can do the normal work on Application "B" even the Application "A" already logout.Hi Scott,
Thank you for your reply. I've read the two link above and I don't figure out how to resolve my problem yet. From the link: Logout URL for 9iAS SSO Partner App
you said:
Steve - Here's a logout URL that unsets the app's session cookie first, then goes to Single Sign-off, then back to a public page in the app:
https://host:port/pls/DAD/wwv_flow_custom_auth_std.logout_then_go_to_url?p_args=&APP_ID.:https://login.yourlogin.com/pls/orasso/orasso.wwsso_app_admin.ls_logout?p_done_url=https://host:port/pls/DAD/f?p=&APP_ID.:PUBLIC_PAGECan set the authentication schema logout URL of application "A" something like: unsets app's session cookies first, then goes to Single Sing-off, then goes to Application "B" sign-off, and then back to a public page in the app. That way will be logout the Application "A", logout the Single Sign-On, and logout the Application "B" when i click on the "logout" link from Application "A". Am I correct?
The other question is how can i get the SSO cookie. I've used the owa_cookie.get('cookie_name') function, but it doesn't work for SSO.
Thanks,
Kevin -
Login from ebs to apex directly .
Hi All,
I have been using the Cabot consulting paper for login to apex from ebs directly .
i placed the following code as onload process
BEGIN
wfa_sec.getsession(:P101_USERNAME);
:P101_PASSWORD :=
XXAPX_SECURITY_PKG.generate_hash
(FND_GLOBAL.user_name);
IF :P101_PASSWORD IS NOT NULL THEN
APEX_CUSTOM_AUTH.login(
P_UNAME => :P101_USERNAME,
P_PASSWORD => :P101_PASSWORD,
P_SESSION_ID => v('APP_SESSION'),
P_APP_PAGE => :APP_ID||':1'
END IF;
EXCEPTION WHEN OTHERS THEN NULL;
END;
But the wfa_sec.getsession(:P101_USERNAME); is not working properly , its redirecting me to ERP home page .
Kindly! help me.
Regards,
Nandini Thakur.This is how we do it...
1) Call a function from apps, passing in the app number and page separated by a pipe symbol:
PROCEDURE launch_application(app_page IN VARCHAR2)
IS
l_url VARCHAR2(256);
l_page NUMBER;
c OWA_COOKIE.cookie;
l_application NUMBER;
BEGIN
l_application := TO_NUMBER(SUBSTR(app_page, 1, INSTR(app_page, '|') - 1));
l_page := TO_NUMBER(SUBSTR(app_page, INSTR(app_page, '|') + 1));
OWA_UTIL.mime_header('text/html', FALSE);
OWA_COOKIE.send(
name => 'APEX_EBS_' || l_application,
VALUE => fnd_global.user_name
|| ':'
|| generate_hash(fnd_global.user_name)
|| ':'
|| fnd_global.user_id
|| ':'
|| fnd_global.resp_id
|| ':'
|| fnd_global.resp_appl_id
|| ':'
|| fnd_global.resp_name
|| ':'
|| fnd_global.application_short_name,
expires => SYSDATE + 1 / (24 * 60 * 6), --Expire in 10 seconds
PATH => '/'
l_url :=
fnd_profile.VALUE('APPS_FRAMEWORK_AGENT')
|| '/pls/apex/f?p='
|| l_application
|| ':'
|| l_page
|| '::LAUNCH';
OWA_UTIL.redirect_url(l_url);
END launch_application;Then the APEX login page has a on-header process:
DECLARE
c OWA_COOKIE.cookie;
a wwv_flow_global.vc_arr2;
BEGIN
c:=OWA_COOKIE.get('APEX_EBS_'||:APP_ID);
a:=apex_util.string_to_table(c.vals(1));
:P101_USERNAME:=a(1);
:P101_PASSWORD:=a(2);
:GBL_USER_ID:=a(3);
:GBL_RESP_ID:=a(4);
:GBL_RESP_APPL_ID:=a(5);
:GBL_RESP_NAME := a(6);
:GBL_APPLICATION_SHORT_NAME:=a(7);
wwv_flow_custom_auth_std.login(
P_UNAME => :P101_USERNAME,
P_PASSWORD => :P101_PASSWORD,
P_SESSION_ID => v('APP_SESSION'),
P_FLOW_PAGE => :APP_ID||':1'
EXCEPTION WHEN OTHERS THEN NULL;
END;We set up the globla variables you see above.
We then have an authentication scheme which calls an authentication function:
RETURN xxfnd_apps_to_apex_pk.authorise_userwhich looks like this:
FUNCTION authorise_user(
p_username IN VARCHAR2,
p_password IN VARCHAR2
RETURN BOOLEAN
IS
BEGIN
IF fnd_web_sec.validate_login(p_username, p_password) = 'Y' --This part not really requried but kept in for compatibility
OR validate_hash(p_username, p_password) THEN
RETURN TRUE;
ELSE
RETURN FALSE;
END IF;
END;Our validate hash function is checking hashes over a period of time against the calculated hash. This means that the hash is only valid within 10 seconds of being generated - makes things more secure. We also use a salt value which is based on a hash of the apps password. You will have to chose what level of complexity to go into.
Then we have a VPD entry in the APEX Application Security definition:
BEGIN
fnd_global.apps_initialize(NVL(:gbl_user_id,0),
NVL(:gbl_resp_id,0),
NVL(:gbl_resp_appl_id,0)
END;This ensures that apps context is maintained throughout the application. -
Single log in for multiple apex application in same workspace
hi forum.
We created 5 applications based on same schema and all in one workspace now. Actually, initially they were created on different machines. now, we have to authenticate users from AD and depending on user type, have to allow or deny some modules. i have created one pager application which have 5 buttons and can control rendering of buttons according to user logged in but...the problem is, inside the applications, i have restrictions on some reports for some users...now one way was to do that is to create a log in for every application separately and thus every application would exactly know who is logged in. but that would be impractical as we need single-sign-on kind of functionality.
please let me know how to have a single log in page work for all application inside the apex workspace so that every application would know name of the user currently logged in.
for the 5 applications, i actually use No_Authentication authentication scheme. and i use following function initially for my one pager application to render the buttons to user or deny
create or replace function getUserName return varchar2
is
userName varchar2(20);
c owa_cookie.cookie;
begin
c := owa_cookie.get('LOGIN_USERNAME_COOKIE');
userName := c.vals(1);
return trim(userName);
end;but i cannot user this function obviously in my 5 actual applications.
help is requested please.
bundle of thanks in advance.You can create one application that does the login authentication according to your authentication scheme. When authenticated, this login app sets a cookie. That's all the login app does (and maybe show a list of available apps to choose from).
The other apps have an even simpler authentication scheme. The only thing they have to do is check the cookie and redirect to the login page (Session Not Valid URL) if there is no valid cookie. -
Integration of APEX in OBIEE 11g fails after upgrade to APEX 4.2.1
I used a document from the german APEX forum to integrate Oracle Business Intelligence 11g (OBIEE) with APEX.
After login in OBIEE a APEX page will be called without login in APEX.
The Document is called "APEX in Oracle Business Intelligence (Oracle BI) integrieren"
http://www.oracle.com/webfolder/technetwork/de/community/apex/tipps/biee-apex/index.html
In APEX 4.0 this worked great. After login in OBIEE I could call a APEX page without new login.
But after upgrading to APEX 4.2.1 now the APEX login mask is displayed.
OBIEE uses this function to create a APEX session and store the APEX session-id and username in the table apex_biee_session:
-- Function GET_APEX_SESSION_ID
-- sets up an APEX session for a BIEE user
FUNCTION get_apex_session_id (p_username IN VARCHAR2,p_days_valid IN NUMBER DEFAULT 1) RETURN VARCHAR2
IS
pragma autonomous_transaction;
l_session_id NUMBER;
l_valid_to DATE;
l_count NUMBER;
l_password VARCHAR2(4000);
BEGIN
l_valid_to := SYSDATE + NVL(p_days_valid,1);
-- Let us delete expired records:
BEGIN
DELETE FROM apex_biee_session
WHERE valid_to < TRUNC(SYSDATE,'DD');
COMMIT;
EXCEPTION
WHEN NO_DATA_FOUND THEN NULL;
END;
-- get next APEX session id:
l_session_id := apex_custom_auth.get_next_session_id;
-- Insert the BIEE user and the APEX session id in table APEX_BIEE_SESSION
INSERT INTO apex_biee_session (username, sessioN_id, valid_to)
VALUES (UPPER(p_username),l_session_id,l_valid_to);
COMMIT;
-- define an APEX user session:
apex_custom_auth.define_user_session(
p_user => UPPER(p_username),
p_session_id => l_session_id);
htmldb_application.g_unrecoverable_error := TRUE; -- tell apex engine to quit
RETURN l_session_id;
EXCEPTION
WHEN OTHERS THEN RETURN '-99';
END get_apex_session_id;
CREATE TABLE "APEX_BIEE_SESSION"
( "USERNAME" VARCHAR2(60),
"SESSION_ID" NUMBER,
"VALID_TO" DATE,
CONSTRAINT "APEX_BIEE_SESSION_PK" PRIMARY KEY ("USERNAME","SESSION_ID")
In APEX this page sentry function is called:
-- Function PAGE_SENTRY
-- used as page sentry function in APEX applications
FUNCTION page_sentry RETURN BOOLEAN
IS
l_current_sid NUMBER;
l_biee_userid VARCHAR2(255);
l_cookie owa_cookie.cookie;
l_c_value VARCHAR2(255) := NULL;
l_cookie_tom owa_cookie.cookie;
l_c_value_tom VARCHAR2(255) := NULL;
l_session_id NUMBER;
l_biee_auth VARCHAR2(1) := 'N';
BEGIN
BEGIN
-- If normal APEX user authentication is used, cookie LOGIN_USERNAME_COOKIE will be used
l_cookie_tom := owa_cookie.get('LOGIN_USERNAME_COOKIE');
l_c_value_tom := l_cookie_tom.vals(1);
l_biee_userid := UPPER(l_cookie_tom.vals(1));
EXCEPTION
WHEN OTHERS THEN NULL;
END;
l_session_id := apex_custom_auth.get_session_id; -- in APEX 4.2.1 this returns NULL
-- Do we have a record in table APEX_BIEE_SESSION with the current session id
BEGIN
SELECT UPPER(username) INTO l_biee_userid
FROM apex_biee_session
WHERE session_id = l_session_id AND valid_to > SYSDATE;
l_biee_auth := 'Y';
EXCEPTION
WHEN NO_DATA_FOUND THEN l_biee_userid := 'Failed';
END;
IF l_biee_userid = 'Failed' THEN
IF l_c_value_tom IS NULL THEN
l_biee_userid := NULL;
ELSE
l_biee_userid := UPPER(l_c_value_tom);
END IF;
END IF;
-- If l_biee_userid is NULL we need to call the APEX login page (done by RETURN FALSE)
IF l_biee_userid IS NULL THEN
RETURN FALSE;
END IF;
IF l_biee_auth = 'N' THEN
l_current_sid := apex_custom_auth.get_session_id_from_cookie;
ELSE
l_current_sid := l_session_id;
END IF;
-- This is the built-in part of the session verification
IF apex_custom_auth.is_session_valid THEN
wwv_flow.g_instance := l_current_sid;
IF apex_custom_auth.get_username IS NULL THEN
apex_custom_auth.define_user_session(
p_user => UPPER(l_biee_userid),
p_session_id => l_current_sid);
RETURN TRUE;
ELSE
IF UPPER(l_biee_userid) = UPPER(apex_custom_auth.get_username) THEN
apex_custom_auth.define_user_session(
p_user =>UPPER(l_biee_userid),
p_session_id =>l_current_sid);
RETURN TRUE;
ELSE -- username mismatch. Unset the session cookie and redirect back here to take other branch
apex_custom_auth.logout(
p_this_app=>v('APP_ID'),
p_next_app_page_sess=>v('APP_ID')||':'||nvl(v('APP_PAGE_ID'),0)||':'||l_current_sid);
wwv_flow.g_unrecoverable_error := true; -- tell htmldb engine to quit
RETURN FALSE;
END IF;
END IF;
ELSE -- application session cookie not valid; we need a new apex session
IF l_biee_auth <> 'Y' THEN
l_session_id := apex_custom_auth.get_next_session_id;
END IF;
apex_custom_auth.define_user_session(
p_user => l_biee_userid,
p_session_id => l_session_id);
wwv_flow.g_unrecoverable_error := true; -- tell htmldb engine to quit
IF owa_util.get_cgi_env('REQUEST_METHOD') = 'GET' THEN
wwv_flow_custom_auth.remember_deep_link(
p_url=>'f?'||wwv_flow_utilities.url_decode2(owa_util.get_cgi_env('QUERY_STRING')));
ELSE
wwv_flow_custom_auth.remember_deep_link(
p_url=>'f?p='||
TO_CHAR(wwv_flow.g_flow_id)||':'||
TO_CHAR(nvl(wwv_flow.g_flow_step_id,0))||':'||
TO_CHAR(wwv_flow.g_instance));
END IF;
apex_custom_auth.post_login( -- register session in htmldb sessions table, set cookie, redirect back
p_uname => l_biee_userid,
p_app_page => wwv_flow.g_flow_id||':'||nvl(wwv_flow.g_flow_step_id,0));
RETURN FALSE;
END IF;
END page_sentry;
The problem seems to be that in line "l_session_id := apex_custom_auth.get_session_id;" the call of apex_custom_auth.get_session_id is returning NULL in APEX 4.2.1.
In APEX 4.0 the call of apex_custom_auth.get_session_id returned the APEX session id.
What can I do to get this working again ?
Kind Regards,
Markus
Edited by: asmodius1 on Jan 10, 2013 2:06 PMHi,
this integration relies on session fixation, that's an insecure practice which is not allowed anymore since 4.1:
http://en.wikipedia.org/wiki/Session_fixation
Since the cookie value for the session id is missing, Apex rejects the session id and sets it to null, before calling the sentry function.
If you absolutely want to use this kind of integration, you will have to parse the value of owa_util.get_cgi_env('QUERY_STRING') in the sentry function to get the session id. To make it a bit more secure, the row in APEX_BIEE_SESSION should only be valid for a very short time (e.g. 1 sec). A person from Oracle Support contacted me about possible improvements to this authentication a few weeks ago. I replied with the following suggestions:
I would at least add a Y/N flag (e.g. SESSION_JOINED_BY_APEX) to the
APEX_BIEE_SESSION table. The page sentry should only accept the session
without an accompanying cookie if the flag is still N. It has to set it
to Y afterwards. This way, you ensure that the session joining without
cookie can only be done once. Maybe there should also be an alternative
way to log in to APEX, e.g. via page 101. Currently, this authentication
only accepts session IDs that were generated via OBIEE.
Users could log out of APEX or the APEX session could expire. Therefore,
the APEX app should have a post logout procedure that deletes the row in
the OBIEE session table. On the OBIEE side, APEX_SESSION_ID should
therefore be initialized on each request. The initialization code should
also check APEX_WORKSPACE_SESSIONS to make sure the session still
exists.
Regards,
Christian
Maybe you are looking for
-
How do I get on-screen keyboard to work in tablet mode for Satellite Radius?
I have a Radius P55W-B5318. I love it, but when I use it in tablet mode, I can't seem to figure out how to get the on-screen touch keyboard to come up, which is necessary if I'm going to use it as a tablet. Any solutions? What am I missing here?
-
I had been trying to update an app on my IMac and when it came to do it, it said I must close down the app site, in this case WeatherEye. However, I could not close it down and update says it is waiting. I have tried everything I know to get rid of
-
The 'selected items' color randomly changes and I can't figure out why.
Hi everybody, I recently upgraded to Firefox 13, which appears to be the most stable browser version so far and I really like it. I have loved Firefox very much, having used it since somewhere between versions 2 and 3. After upgrading to version 13 I
-
Question about new BIOS on Satellite L20-182
Hi :) I've got one question: may I install new BIOS 2.20 on my Satellite L20-182 model no. PSL2XE? If I can't, why users PSL2X can do this? Are there so many differences on both models? Greetings and sorry for my English - I'n not the best :)
-
How to get facetime on my mac?
how to get facetime on my mac?