{"id":2876,"date":"2012-01-12T12:20:16","date_gmt":"2012-01-12T16:20:16","guid":{"rendered":"http:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/"},"modified":"2012-01-12T12:20:16","modified_gmt":"2012-01-12T16:20:16","slug":"oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/","title":{"rendered":"Oracle Apex 4.1 integration with Oracle Access Manager (OAM) 11g for Single Sign-On (SSO)"},"content":{"rendered":"

This post covers integration<\/strong> of Apex 4.1 <\/strong>with Oracle Access Manager<\/strong> 11g for Single Sign-On. For previous version of Apex integration with Oracle Single Sign-On click here<\/a><\/p>\n

Apex 4.1\u00a0integration with OAM 11g is well explained in Guide on OTN\u00a0here<\/a>\u00a0This post covers key points from this document.<\/p>\n

.<\/p>\n

About OAM<\/u><\/strong><\/p>\n

1.<\/strong> There are currently\u00a0two Web Single Sign-On <\/strong>solution available from Oracle a) Oracle Application Server Single Sign-On<\/strong> (OSSO) b) Oracle Access Manager <\/strong>(OAM)<\/p>\n

2.<\/strong> Oracle Access Manager (OAM<\/strong>) is recommended Single Sign-On <\/strong>solution from Oracle and extensively covered in my book at Amazon<\/a><\/p>\n

3.<\/strong> For Oracle Access Manager , there are two version<\/strong> 10g and 11g with architectural differences mentioned here<\/a><\/p>\n

4.<\/strong> OAM 11g\u00a0runs on WebLogic Server<\/strong> under managed server and\u00a0runtime access server listens on OAM-Proxy Port<\/strong> (5575 default port). To know more on WebLogic Domain and Server click here<\/a><\/p>\n

5.<\/strong> WebGates<\/strong> installed on WebServer (like OHS, Apache, IIS..) connects to OAM -Proxy<\/strong> port to evaluate Policies defined to access application like \/apex. More on Agents in OAM here<\/a><\/p>\n

6.<\/strong> OAM 11g by default uses WebLogic’s embedded LDAP Server for user store. It is recommended to change identity store to enterprise LDAP Server like OID, AD or Sun Directory Server (now ODSEE). To change Identity Store in OAM 11.1.1.3 click here<\/a>\u00a0 and for OAM 11.1.1.5 click here<\/a><\/p>\n

\u00a0.<\/p>\n

About Apex<\/u><\/strong><\/p>\n

1.<\/strong> Apex is browser based<\/strong> development tool for developing Web 2.0 applications based on Oracle Database.<\/p>\n

2.<\/strong> Apex resides completely inside database<\/strong> and can be installed on database 10g R2 and higher<\/strong><\/p>\n

3.<\/strong> There are three web listeners available with Apex : a) Apex Listener<\/strong>, b) Oracle HTTP Server with mod_plsql<\/strong> , and c) Embedded PL\/SQL Gateway<\/strong> (EPG) available with 11g and higher databases.<\/p>\n

4.<\/strong> Apex uses authentication schemes<\/strong> to validate user credentials. Pre-configured authentication schemes provided with Apex are OSSO (old SSO method), LDAP Server, HTTP Header variable, Database Credentials etc..<\/p>\n

Note<\/strong>: You use Apex’s HTTP Header based authentication scheme to integrate Apex with OAM<\/font> .<\/p>\n

 <\/p>\n

How Apex – OAM integration works ?<\/u><\/strong><\/p>\n

1.<\/strong> When a Apex request is made, it is first sent to Web Server (Oracle HTTP Server – OHS in this case)<\/p>\n

2.<\/strong> Oracle HTTP Server (OHS)\u00a0with webgate<\/strong> will intercept request<\/p>\n

3.<\/strong> Given that user has not logged in yet, request is forwarded to OAM Server to find protection level of URL (aka resource)<\/p>\n

4.<\/strong> As resource accesses by user is protected in OAM, OAM Run time server presents authentication scheme configured for this resource<\/p>\n

5.<\/strong> User types username\/password when then are verified by OAM server against Identity store configured for OAM Server.<\/p>\n

6.<\/strong> On successful authentication cookie is presented to user (via OHS) and HTTP Header variable is set<\/p>\n

7.<\/strong> As user is now authenticated, request is sent via mod_plsql to Apex engine within Oracle Database.<\/p>\n

8.<\/strong> Apex engine then dynamically builds page and returns it back to user’s browser.<\/p>\n

\u00a0.<\/p>\n

Pre-Requisites<\/u><\/strong><\/p>\n

1.<\/strong> Ensure that Oracle Database and Apex 4.1.x\u00a0is already installed.<\/p>\n

2.<\/strong> Apply Apex patch 12955671 (check if Apex 4.1.1 is available now)<\/p>\n

3.<\/strong> Oracle Access Manager (OAM 11g) is installed and configured. (to check OAM Installation <> this post is for 11.1.1.3 where as latest version currently is 11.1.1.5 steps remains same)<\/p>\n

 <\/p>\n

Apex-OAM Configuration Tasks<\/u><\/strong><\/p>\n

1.<\/strong> Install Oracle HTTP Server<\/p>\n

2.<\/strong> Add dads.conf<\/strong> or with-in httpd.conf<\/strong> with entry like<\/p>\n

<Location \/apex>
\nSetHandler pls_handler
\nOrder deny,allow
\nAllow from all
\nPlsqlDocumentPath docs
\nPlsqlDocumentProcedure wwv_flow_file_manager.process_download
\nPlsqlDatabaseConnectString orcl ServiceNameFormat
\nPlsqlNLSLanguage AMERICAN_AMERICA.AL32UTF8
\nPlsqlAuthenticationMode Basic
\nPlsqlDocumentTablename wwv_flow_file_objects$
\nPlsqlDatabaseUsername APEX_PUBLIC_USER
\nPlsqlDatabasePassword *****
\nPlsqlDefaultPage apex
\nPlsqlRequestValidationFunction wwv_flow_epg_include_modules.authorize
\nPlsqlCGIEnvironmentList HTTP_OAM_REMOTE_USER
\nPlsqlCGIEnvironmentList HTTP_OAM_REMOTE_USER_GROUPS
\nPlsqlCGIEnvironmentList HTTP_OAM_REMOTE_USER_EMAIL
\n<\/Location><\/font>Alias \/i\/ \/path\/to\/APEX\/images\/<\/font><\/p>\n

3.<\/strong> Restart OHS Server<\/strong> and see if you can access \/apex<\/p>\n

4.<\/strong> Register WebGate Instance in OAM server (This can be done via RREG<\/a> or manually using OAM Console ) . Registering webgate instance using RREG or manually using console is also covered in my book here<\/a><\/p>\n

Note:<\/strong> Ensure that \/apex\/apex_authentication.callback<\/strong> <\/span>is protected <\/strong>resource and \/<\/strong> & \/…\/*<\/strong> are defined as public\/unprotceted <\/strong>resource<\/font><\/p>\n

5.<\/strong> Add responses <\/strong>to authorisation policy to return two header variables<\/strong> (OAM_REMOTE_USER_GROUPS & OAM_REMOTE_USER_EMAIL)<\/p>\n

Name: OAM_REMOTE_USER_GROUPS; Type: Header; Value: $user.groups
\nName: OAM_REMOTE_USER_EMAIL; Type: Header; Value: $user.attr.mail
\n<\/font><\/p>\n

6.<\/strong> Install OAM 11g WebGate on OHS Server<\/p>\n

7.<\/strong> Copy generate artefacts <\/strong>from step 4 webgate registration (on OAM Server) to OHS Server<\/p>\n

8.<\/strong> Restart OHS Server<\/p>\n

9.<\/strong> Define Authentication Scheme HTTP Header Variable<\/strong> in Apex application (Shared Components -> Administration -> Create) with Header variable as HTTP_OAM_REMOTE_USER<\/p>\n

10.<\/strong> Test Apex – OAM integration by accessing Apex Application.<\/p>\n","protected":false},"excerpt":{"rendered":"

This post covers integration of Apex 4.1 with Oracle Access Manager 11g for Single Sign-On. For previous version of Apex […]<\/p>\n","protected":false},"author":115,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[40],"tags":[],"class_list":["post-2876","post","type-post","status-publish","format-standard","hentry","category-sso"],"yoast_head":"\nOracle Apex 4.1 integration with Oracle Access Manager (OAM) 11g for Single Sign-On (SSO) -<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Oracle Apex 4.1 integration with Oracle Access Manager (OAM) 11g for Single Sign-On (SSO) -\" \/>\n<meta property=\"og:description\" content=\"This post covers integration of Apex 4.1 with Oracle Access Manager 11g for Single Sign-On. For previous version of Apex […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/\" \/>\n<meta property=\"article:published_time\" content=\"2012-01-12T16:20:16+00:00\" \/>\n<meta name=\"author\" content=\"Masroof Ahmad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Masroof Ahmad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/\",\"url\":\"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/\",\"name\":\"Oracle Apex 4.1 integration with Oracle Access Manager (OAM) 11g for Single Sign-On (SSO) -\",\"isPartOf\":{\"@id\":\"https:\/\/onlineappsdba.com\/#website\"},\"datePublished\":\"2012-01-12T16:20:16+00:00\",\"author\":{\"@id\":\"https:\/\/onlineappsdba.com\/#\/schema\/person\/909a876ed58d400faf82caf81d61bfdb\"},\"breadcrumb\":{\"@id\":\"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/onlineappsdba.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Oracle Apex 4.1 integration with Oracle Access Manager (OAM) 11g for Single Sign-On (SSO)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/onlineappsdba.com\/#website\",\"url\":\"https:\/\/onlineappsdba.com\/\",\"name\":\"\",\"description\":\"Oracle Implementation & Training Experts\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/onlineappsdba.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/onlineappsdba.com\/#\/schema\/person\/909a876ed58d400faf82caf81d61bfdb\",\"name\":\"Masroof Ahmad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/onlineappsdba.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/10f9db7bdbbd7f9ccfbe9b2d208e5978fc28315e9c704383e639a926ea0fce5f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/10f9db7bdbbd7f9ccfbe9b2d208e5978fc28315e9c704383e639a926ea0fce5f?s=96&d=mm&r=g\",\"caption\":\"Masroof Ahmad\"},\"url\":\"https:\/\/onlineappsdba.com\/index.php\/author\/masroof\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Oracle Apex 4.1 integration with Oracle Access Manager (OAM) 11g for Single Sign-On (SSO) -","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/","og_locale":"en_US","og_type":"article","og_title":"Oracle Apex 4.1 integration with Oracle Access Manager (OAM) 11g for Single Sign-On (SSO) -","og_description":"This post covers integration of Apex 4.1 with Oracle Access Manager 11g for Single Sign-On. For previous version of Apex […]","og_url":"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/","article_published_time":"2012-01-12T16:20:16+00:00","author":"Masroof Ahmad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Masroof Ahmad","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/","url":"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/","name":"Oracle Apex 4.1 integration with Oracle Access Manager (OAM) 11g for Single Sign-On (SSO) -","isPartOf":{"@id":"https:\/\/onlineappsdba.com\/#website"},"datePublished":"2012-01-12T16:20:16+00:00","author":{"@id":"https:\/\/onlineappsdba.com\/#\/schema\/person\/909a876ed58d400faf82caf81d61bfdb"},"breadcrumb":{"@id":"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/onlineappsdba.com\/index.php\/2012\/01\/12\/oracle-apex-41-integration-with-oracle-access-manager-oam-11g-for-single-sign-on-sso\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/onlineappsdba.com\/"},{"@type":"ListItem","position":2,"name":"Oracle Apex 4.1 integration with Oracle Access Manager (OAM) 11g for Single Sign-On (SSO)"}]},{"@type":"WebSite","@id":"https:\/\/onlineappsdba.com\/#website","url":"https:\/\/onlineappsdba.com\/","name":"","description":"Oracle Implementation & Training Experts","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/onlineappsdba.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/onlineappsdba.com\/#\/schema\/person\/909a876ed58d400faf82caf81d61bfdb","name":"Masroof Ahmad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/onlineappsdba.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/10f9db7bdbbd7f9ccfbe9b2d208e5978fc28315e9c704383e639a926ea0fce5f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/10f9db7bdbbd7f9ccfbe9b2d208e5978fc28315e9c704383e639a926ea0fce5f?s=96&d=mm&r=g","caption":"Masroof Ahmad"},"url":"https:\/\/onlineappsdba.com\/index.php\/author\/masroof\/"}]}},"_links":{"self":[{"href":"https:\/\/onlineappsdba.com\/index.php\/wp-json\/wp\/v2\/posts\/2876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/onlineappsdba.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/onlineappsdba.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/onlineappsdba.com\/index.php\/wp-json\/wp\/v2\/users\/115"}],"replies":[{"embeddable":true,"href":"https:\/\/onlineappsdba.com\/index.php\/wp-json\/wp\/v2\/comments?post=2876"}],"version-history":[{"count":0,"href":"https:\/\/onlineappsdba.com\/index.php\/wp-json\/wp\/v2\/posts\/2876\/revisions"}],"wp:attachment":[{"href":"https:\/\/onlineappsdba.com\/index.php\/wp-json\/wp\/v2\/media?parent=2876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/onlineappsdba.com\/index.php\/wp-json\/wp\/v2\/categories?post=2876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/onlineappsdba.com\/index.php\/wp-json\/wp\/v2\/tags?post=2876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}