Proxy Authentication with JDBC Datasource instead of JDBC URL?

Question

Hello,
A requirement for my current project (ADF 10g) is that a user should be able to log in with his regular database account. For the moment, this is implemented using Proxy Authentication, as described in the following article:
http://blogs.oracle.com/jheadstart/2008/01/using_proxy_authentication.html
For now, we are using a JDBC URL defined in the application module config for the BC. In short: a ProxyAuthConnectionPoolManager class was created that overrides the default ConnectionPoolManagerImpl. The getConnection method has been overridden to create a standard connection (with the username/pw defined on the AM), and additionally, create a proxy connection within this connection with the specific user credentials. The (simplified) code:
    public Connection getConnection(String key, String url, Properties props, String username, String pwd) {
        // first fetch a default connection from the pool through the superclass
        Connection connection = super.getConnection(key, url, props, username, pwd);
        // cast into an OracleConnection
        OracleConnection oraConnection = (OracleConnection) connection;
            // close any proxy sessions that would still exist on the connection
            if (oraConnection.isProxySession()) oraConnection.close(OracleConnection.PROXY_SESSION);
            // get a handle on the session scope
            Map sessionScope = ADFContext.getCurrent().getSessionScope();
            if (sessionScope != null) {
                // find the user object in the session (the account the user logs in with)
                ProxyAuthUser user = (ProxyAuthUser) sessionScope.get(ProxyAuthUser.JHS_USER_KEY);
                if (user != null) {
                    // create a property map with the end user credentials
                    Properties proxyProps = new Properties();
                    proxyProps.put(OracleConnection.PROXY_USER_NAME, user.getDbUsername() + "/" + user.getDbPassword());
                    proxyProps.put(OracleConnection.PROXY_USER_PASSWORD, user.getDbPassword());
                    // open the proxy session
                    oraConnection.openProxySession(OracleConnection.PROXYTYPE_USER_NAME, proxyProps);
            return oraConnection; 
    }Now, this works perfectly when using a JDBC URL. But when I switch the JDBC Datasource the ProxyAuthConnectionPoolManager class is not called anymore. This is all done in code in the Application Server. While using a JDBC Datasource is actually necessary: otherwise for each environment (dev, test, production,...) a different WAR file is needed.
What class can I override with code similar to the piece above, to open a proxy connection inside the existing connection, when using a JDBC Datasource?
Your help would be greatly appreciated!
Chris

Answer 1

Hello Krasimir,
Frank Nimphius gave me the solution to this problem. The prepareSession is indeed the best place to put the code:
   private OracleConnection oconn = null;
   public void prepareSession(SessionData SessionData) {
      super.prepareSession(SessionData);
      oconn = ((PrxyTransactionImpl)this.getDBTransaction()).getPrxyConnection();
      // Specify the user that connects through the proxy user and its roles
      Properties prop = new Properties();
      prop.put(OracleConnection.PROXY_USER_NAME,"hr");
      prop.put(OracleConnection.PROXY_USER_PASSWORD,"hr");
      //prop.put(OracleConnection.PROXY_ROLES, roles);
      // Open the proxy session (DB-authenticated users)
      try {
         oconn.openProxySession(OracleConnection.PROXYTYPE_USER_NAME, prop);
      catch (SQLException e) {
         // Close the connection, to avoid connection to remain open after exception
         oconn.abort();
         e.printStackTrace();
   }But Frank also created the following helper classes to extend the ADF BC behavior:
   package oracle.sample.dbprxy.adfbc;
   import oracle.jbo.server.DBTransactionImpl2;
   import oracle.jbo.server.DatabaseTransactionFactory;
    * TransactionFactory that returns PrxTransactionImpl, which is a subclass of
    * DBTransactionImpl2
    * @author Frank Nimphius
   public class PrxyDatabaseTransactionFactory extends DatabaseTransactionFactory {
      public PrxyDatabaseTransactionFactory() {
         super();
       * Override the create method to return an instance of PrxyTransactionImpl instead
       * of DBTransactionImpl2
       * @return PrxyTransactionImpl
      public DBTransactionImpl2 create() {
         return new PrxyTransactionImpl();
   package oracle.sample.dbprxy.adfbc;
   import oracle.jbo.server.DBTransactionImpl2;
   import oracle.jdbc.internal.OracleConnection;
   public class PrxyTransactionImpl extends DBTransactionImpl2 {
      public PrxyTransactionImpl() {
         super();
       * The DBTransactionImpl2 does not expose the connection in a public
       * method. This class is a wrapper to expose the connection to the
       * BC app, so it can be accessed in the ApplicationModuleImpl class
       * @return OracleConnection - SQL Connection
      public OracleConnection getPrxyConnection() {
         return (OracleConnection) this.getJdbcConnection();
   }In the configuration of your Application Module, you have to set the property "TransactionFactory" (normally the last one in the list) to oracle.sample.dbprxy.adfbc.PrxyDatabaseTransactionFactory. This way, the DBTransaction() of your AM will have a getPrxyConnection() method and you will have the connection at your disposal. You won't need the createPreparedStatement in your code anymore.
To close the connection, this is the code behind my "logout button" on the backing bean. Application Module Pooling and Connection Pooling will take care of the rest for you!
   ExternalContext ectx = FacesContext.getCurrentInstance().getExternalContext();
   HttpSession session = (HttpSession)ectx.getSession(false);
   session.invalidate();Another thing: be sure to set the internalconnection property to a different JDBC Datasource (or file based) than the one you are using to connect to the database (the default value). Otherwise connection pooling will be confused and there will be too much pending database connections.
This works for me, all sessions are closed in time and logging out seems secure. I do not have my complete, adjusted code here at my disposal, but next week, when I'm back at work, I'll have a look to see if there is anything I forgot to mention. So this should get you started, but I'll keep you posted!
A huge thank you to Frank again for helping me (/us) out with this problem!! And sorry I forgot to post the answer here sooner. I was too busy with testing it. :-)
Regards,
Chris