SSO with Apex 4.1.1.00.23

Question

Hello Apex community,
i want to implement a SSO solution between an apex and non-apex application. This solution worked with Apex 4.0 but seems not to work with current 4.1.1.00.23.
I've set up a test case on hosted environment.
Dev User:
Workspace: authtest
User: authtest
Pass: authtest
End User:
User: test
Pass: test1
Things i've done:
(1) Created a custom authentication scheme (marked as current) "auth_scheme" with following authentication function:
create or replace FUNCTION auth_function(
      p_username IN VARCHAR2,
      p_password IN VARCHAR2)
    RETURN BOOLEAN
  AS
    v_is_authenticated BOOLEAN := false;
  BEGIN
      IF lower(p_username)= 'test' OR APEX_UTIL.IS_LOGIN_PASSWORD_VALID(p_username => p_username,
                                                                        p_password => p_password)
    THEN
      v_is_authenticated := true;
    ELSE
      v_is_authenticated := false;
    END IF;
    RETURN v_is_authenticated;
  END auth_function;(2) Created an "On Load - Before Header" process with sequence 5 on page 101:
DECLARE
  v_user                VARCHAR2(4000);
  v_pass                VARCHAR2(4000);
  v_fsp_after_login_url VARCHAR2(4000) := :FSP_AFTER_LOGIN_URL;
BEGIN
  SELECT SUBSTR(v_fsp_after_login_url, instr(v_fsp_after_login_url, 'P101_UNAME') + LENGTH('P101_UNAME') + 1)
  INTO v_user
  FROM dual;
  wwv_flow_custom_auth_std.login(
    P_UNAME       => v_user,
    P_PASSWORD    => v_pass,
    P_SESSION_ID  => v('APP_SESSION'),
    P_FLOW_PAGE   => :APP_ID||':1'
END;Process condition: request = AUTOLOGON:
(3) Created a hidden item "P101_UNAME" on page 101.
(4) Expected behaviour: user loads following URL:
http://apex.oracle.com/pls/apex/f?p=30964:1::AUTOLOGON:YES::P101_UNAME:testuser schould be logged in without typing in his credentials.
What happens: user faces login page. What I don't understand: setting process condition to "none", autologon works. But if you have a look into debug report, apex recognizes the request "AUTOLOGON" even if autologon doesn't work. On my dev environment with Apex 4.1.1.00.23 changing process condition doesn't help.
I can't figure out what I'm doing wrong. With the patchset 4.1.1 there were certain changes concerning FSP_AFTER_LOGIN_URL Re: Deep Link (FSP_AFTER_LOGIN_URL) Not Working in APEX 4.1 I would appreciate any hint.
Thank you very much for your answers.
Kind regards,
Anton
Edit: Any ideas? I would appreciate any hint.
Edit2: Any hints maybe? Explicitly setting the FSP_AFTER_LOGIN_URL in the Url doesn't help either...
Edited by: anton on 20.08.2012 01:26

Answer 1

Hi Anton,
that's why I added the IF statement around the code block, to guarantee that it only runs if the URL contains auto-login data (i.e. P101_UNAME). Setting FSP_AFTER_LOGIN_URL to null avoids a loop when the login fails. If we keep FSP_AFTER_LOGIN_URL, the wwv_flow_custom_auth_std.login procedure will redirect to page 101 and the before header process will run again, re-executing wwv_flow_custom_auth_std.login , etc.
It might be clearer to put the before header code into the authentication itself. The invalid session procedure is the right place for that, but it's use is very sparsely documented yet.
I created a 2nd copy of your original application (22274), where I removed the before header process and added this invalid session procedure:
procedure autologon_on_invalid_session
is
  v_user                VARCHAR2(4000);
  v_pass                VARCHAR2(4000);
  v_fsp_after_login_url VARCHAR2(4000) := :FSP_AFTER_LOGIN_URL;
  v_user_pos            pls_integer    := instr(v_fsp_after_login_url, 'P101_UNAME:');
BEGIN
  if apex_application.g_flow_step_id != 101 and v_user_pos > 0 then
    v_user := substr(v_fsp_after_login_url, v_user_pos+11);
    wwv_flow_custom_auth_std.login(
        P_UNAME       => v_user,
        P_PASSWORD    => v_pass,
        P_SESSION_ID  => v('APP_SESSION'),
        P_FLOW_PAGE   => :APP_ID||':1' );
    apex_application.stop_apex_engine;
  end if;
END;If the current page is not 101 (the login page) and the URL (which was copied into the deep link item) contains the autologin credentials, call login. The finall call to apex_application.stop_apex_engine stops Apex from continuing it's default invalid session handling, which is to redirect to the login page.
Regards,
Christian