Problem during configuring SSO with APEX 4.1

Question

Hello everybody,
I'm trying to configure my APEX application to use SSO, but I have big problems with ssosdk902.zip file.
During execution of the loadsdk.sql script it creates package "wwsec_sso_enabler" but APEX 4.1 wants to have "wwsec_sso_enabler_private". For me it a clear sign, that I'm using some old SSOSDK.
Can somebody tell me where to find the current "ssosdk"?
I'm using OAS10gR2 and the interesting thing is that in the DB schema ORASSO package "wwsec_sso_enabler_private" exists, but it doesn't helps me. It is at the other machine. I must have it on the same instance, where APEX is running.
It looks like packaging error by Oracle. Can somebody help me?
Thanks,
Ianko

Answer 1

Hi Anton,
that's why I added the IF statement around the code block, to guarantee that it only runs if the URL contains auto-login data (i.e. P101_UNAME). Setting FSP_AFTER_LOGIN_URL to null avoids a loop when the login fails. If we keep FSP_AFTER_LOGIN_URL, the wwv_flow_custom_auth_std.login procedure will redirect to page 101 and the before header process will run again, re-executing wwv_flow_custom_auth_std.login , etc.
It might be clearer to put the before header code into the authentication itself. The invalid session procedure is the right place for that, but it's use is very sparsely documented yet.
I created a 2nd copy of your original application (22274), where I removed the before header process and added this invalid session procedure:
procedure autologon_on_invalid_session
is
  v_user                VARCHAR2(4000);
  v_pass                VARCHAR2(4000);
  v_fsp_after_login_url VARCHAR2(4000) := :FSP_AFTER_LOGIN_URL;
  v_user_pos            pls_integer    := instr(v_fsp_after_login_url, 'P101_UNAME:');
BEGIN
  if apex_application.g_flow_step_id != 101 and v_user_pos > 0 then
    v_user := substr(v_fsp_after_login_url, v_user_pos+11);
    wwv_flow_custom_auth_std.login(
        P_UNAME       => v_user,
        P_PASSWORD    => v_pass,
        P_SESSION_ID  => v('APP_SESSION'),
        P_FLOW_PAGE   => :APP_ID||':1' );
    apex_application.stop_apex_engine;
  end if;
END;If the current page is not 101 (the login page) and the URL (which was copied into the deep link item) contains the autologin credentials, call login. The finall call to apex_application.stop_apex_engine stops Apex from continuing it's default invalid session handling, which is to redirect to the login page.
Regards,
Christian