Setting Session item from outside of APEX

Question

Hi All,
First a little background: I've been learning APEX for a couple of days now. I'm evaluating it to see if it's suitable for the application we need to make, otherwise it'll be done in PHP.
The application needs to act as a web service client: as requirement number 1, we need to interface with a 3rd party IDP server to get a SAML2 assertion. This assertion will later need to be injected into the SOAP header of web service call, but I'm not worrying about this bit for now.
I've gotten half way there. I've created a new page with a process at runs before the header. This can handle creating our authn request (which is a bit of xml) and forward the browser onto the IPD server for authentication (with anthn request set as a GET parameter that has been deflated and base64 encoded). Whoo!
Once the IDP server has finished authenticating the user, a http post (with the SAML assertion we need) is done back to the application.
Now as I understand it, I can't get the IDP to post back to an APEX page directly, as we need to access the HTTP Post data. So, I plan on writing a PL/SQL procedure (which I've added to the FLOWS ok list to be called via the PL/SQL gateway).
So inside this procedure, I'm not in APEX, but I'll want to keep track of the SAML Assertion (which will just be a CLOB for arguments sake) such that I can use in APEX for when I make my SOAP call. If it was down to me, I'd have a table with session_id and the assertion, and just query that from APEX.
BUT this 3rd party that we have to work with is the government, and they've given us rules. We aren't allow to store these assertions, they can only exist in the scope of a users session (no storing in files, databases, anything that could be permanently stored on the hard drive), virtual memory is ok though.
So, after all that useless info, onto my question: Can I set an apex application item from this pl/sql procedure? If so, how would one do it? Now I understand that in the background, an item is probably written to a table, but I'm going to gloss over that for now (in the hope that the people certifying the app do the same).
Thanks for all the help,
Tim

Answer 1

Tim,
I am working a similar issue, but slightly different. I am trying to determine if we are trying to answer the same question.
Here is what I understand about your initial posting...
You are authenticating a user.. that must make a call to some "place".. then wait for that place to respond with an OK message, without storing the value. There is enough lag in this process that you want the response from "the place" that you want the response from "the place" to change the session value in the Web based UI. Is this correct?
Issue: Even if you did have this process setting the session value, the client web browser would not respond unless it was in some type of checking loop.
If you are in a checking loop, you would have the ability to call the "service" in some sort of checking mode from APEX.
If this is a smooth process (no major lag), you could manage it within a custom authentication scheme. Is this the area you are working in?
I understand your need to set from an outside connection. But if you are using the outside database connection method, you are isolated to a different session... I would believe (I do not work for Oracle) for security reasons.
--Tim St. Hilaire