Problem with username/password using SQLAuthenticator

Question

I want to setup SQLAuthenticator but authentication is refused because wrong username/password.
I am using JDev Studio Edition Version 11.1.2.1.0 with integrated WLS.
As a base I take this two URLs:
http://weblogic-wonders.com/weblogic/2010/03/11/configuring-sql-authenticator-with-weblogic-server/ and
http://biemond.blogspot.com/2008/12/using-database-tables-as-authentication.html
1. I create db tables (default table names for SQLAuthenticator), but don't fill users and groups - OK
2. In WLS I create new SQLAuthenticator Authentication provider inside deafult realm myrealm - OK
3. I put this provider to the top among all three providers
4. In JDev I configure ADF Security - define Enterprise Roles to matching to the names in GROUPS table of SQLAuthenticator - ??
5. I Define Application users and roles and setup Resource grants
6. I run my application
7. In database tables USERS, GROUPMEMBERS, GROUPS I can see users and roles from Jdev, that means, at deploy time, this tables are filled too
8. In WLS I can see Users and Groups under myrealm which are transfered at deploy time and mirrors USERS, GROUPMEMBERS, GROUPS
9. In USERS table I can see password is encripted by {SHA-1}
But when try to login I am always rejected with "Invalid username or password".
Before setting up SQLAuthenticator (only default options) the logins were successful, so application shold be OK.
I try also with Plaintext Passwords Enabled and put into USERS table unencripted password, but without success.
I can confirm that SQLAuthenticator mechanism actually get password from USERS table. I replaced default SQL for getting password from
SELECT U_PASSWORD FROM USERS WHERE U_NAME = ?
to
select get_pwd(?) as U_PASSWORD from dual. In my get_pwd PL/SQL function I perform logging in I can see that this function was called.
So the problem is in WLS when comparing passwords.
Any suggestions, where to start digging?
Ragards,
Sašo
Edited by: Sašo C. on 5.10.2011 7:26
Edited by: Sašo C. on 5.10.2011 7:32

Answer 1

The problem is solved! Crucial was hint from http://biemond.blogspot.com/2008/12/using-weblogic-provider-as.html:
The Control Flag for my new SQLAuthenticator Authentication provider must be changed from Optional to Sufficient AND
the Control Flag for existing DefaultAuthenticator must be changed from Required to Sufficient!
It seems that before SQLAuthenticator took password from USERS table, but didn't use it in the authentication process.
Regards,
Sašo