APEX

create or replace FUNCTION                     "UM_SHIBBOLETH_PAGE_SENTRY" 
(p_apex_user in VARCHAR2 default 'APEX_PUBLIC_USER')
return BOOLEAN
is
-----------------------------------------------------------------------------------------------------
-- ABM 052307 - Created. This is a trivial modification of the NTLM authentication function and others
--              as posted to otn.oracle.com (search Apex forums for NTLM authentication)
-- See also sspadafo code at: 
--              787774
-- 
-- Discussion: Function is to be called as a page sentry function in APEX. 
--             Page sentry functions fire before each page of an application. If they fail
--             the authentication scheme usually refers the user to a "public" error page 
--             that is not protected by a page sentry.
--             This page sentry is not designed to control authorization. It only checks to 
--             see if there is a credential held in the local Apache environment. Authorization
--             must be done in the Apache layer or lower down in the Apex environment.
--             To use this page sentry function, the local HTMLDB/APEX environment must have
--             access to the local CGI environment variable HTTP_SAM_ACCOUNT_NAME. 
--             The University of Missouri's shibboleth implementation is capable of 
--             populating this environment variable when properly configured.
--             THIS FUNCTION DOES NOT SUBSTITUTE FOR APEX DEVELOPER AUTHENTICATION.
--             IT ONLY WORKS WHEN RUNNING THE APPLICATION AS AN APPLICATION. 
--             FOR BEST RESULTS WHEN DEVELOPING AN APPLICATION, MAKE SURE YOUR APEX AUTHENTICATION
--             USERID IS THE SAME AS YOUR SHIBBOLETH AUTHENTICATION USERID.
--  
-- Input: p_apex_user - page sentries seem to take a single input var. In this case
--                      we only care that we are being called by apex and that the 
--                      apex username matches the PARSE as schema name. For APEX the default is
--                      APEX_PUBLIC_USER.
--
-- Output: returns boolean. True if user is authenticated, false if not.
-- 
-- Usage: To use this function...
-- 1) Open your applications shared components. Click Authentication Schemes.
-- 2) Click Create..Then select From Scratch..Next>
-- 3) Name and describe your authentication scheme. Next>
-- 4) Put this function name in the "Page Sentry Function.." text box. 
--    return UM_SHIBBOLETH_PAGE_SENTRY;
--    Click Next>
-- 5) Click Next> for session verification function
-- 6) Chose URL radio box for "When the page sentry function..." Type in a URL
--    that is not protected by a page sentry. Next>
-- 7) Leave pre-authentication process blank. Next>
-- 8) Credentials verification method: "Do not verify credentials". Next>
--    Note: this function assumes the credentials are already good. This is not authorization.
-- 9) Post authentication Process. Leave blank. Next>
-- 10) Cookie setting. Leave blank. Next>
-- 11) Logout URL. Not very useful as this layer cannot affect the base credentials for the
--     external authentication method. Set to something like:
--     wwv_flow_custom_auth_std.logout?p_this_flow=&APP_ID.&p_next_flow_page_sess=&APP_ID.:1
--     to take the user back to the intro page.
-----------------------------------------------------------------------------------------------------
l_current_sid NUMBER;

usr VARCHAR2(100);

-- We will be using the local environment variable HTTP_SAM_ACCOUNT_NAME, 
-- use another var like HTTP_URN as required in your Apache environment.
l_authenticated_username VARCHAR2(256) := UPPER(owa_util.get_cgi_env('HTTP_SAM_ACCOUNT_NAME'));


BEGIN
    -- Remove for debugging
    -- insert into debug_log(msg) values ('started UM_SHIBBOLETH_PAGE_SENTRY');
    -- commit;
    
    -- Check to ensure that we are running as the correct database user
    -- This keeps the function from being called outside APEX. Notice that p_apex_user 
    -- is defined as the default input parameter.
    IF USER <> UPPER(p_apex_user) THEN 
       -- remove for debugging
       -- insert into debug_log(msg) values ('Not running as APEX_PUBLIC_USER');
       -- commit; 
       RETURN FALSE; 
    END IF;

    -- if the l_authenticated_username is null then the local username environment variable
    -- hasn't been set, which means that someone has somehow gotten around our shibboleth
    -- protected environment. This condition should NEVER occur unless something is very wrong
    -- with the local Apache/Shibboleth environment. If that has happened, fail.
    IF l_authenticated_username IS NULL THEN
       -- insert into debug_log(msg) values ('l_authenticated user is null');
       -- commit;
       RETURN FALSE; 
    END IF;     
	
    -- Now we must check session state to make sure our APEX session info matches
    -- info in the shibboleth environment.
    -- Get the current apex session id from cookies	
    l_current_sid := wwv_flow_custom_auth_std.get_session_id_from_cookie;
    IF wwv_flow_custom_auth_std.is_session_valid THEN
       -- remove for debugging
       -- insert into debug_log(msg) values ('wwv_flow_custom_auth_std.is_session_valid = true');
       -- commit;
    
        
        apex_application.g_instance := l_current_sid;
        
        -- if our external authentication username matches the username recorded 
        -- in our apex session environment, then we know we are back again from a 
        -- previous page visit. Simply re-assert our apex session user name.
        -- If you don't do this right, you'll get a new session every time the user hits
        -- an apex page, that's not good.
        IF l_authenticated_username = wwv_flow_custom_auth_std.get_username THEN
            wwv_flow_custom_auth.define_user_session(
                p_user=>l_authenticated_username,
                p_session_id=>l_current_sid);      
            RETURN TRUE;
        ELSE -- username mismatch. Unset the session cookie and redirect back here to take other branch
            wwv_flow_custom_auth_std.logout(
                p_this_flow=>v('FLOW_ID'),
                p_next_flow_page_sess=>v('FLOW_ID')||':'||NVL(v('FLOW_PAGE_ID'),0)||':'||l_current_sid);
            apex_application.g_unrecoverable_error := TRUE; -- tell apex engine to quit            
            RETURN FALSE;
        END IF;
        
    ELSE -- application session cookie not valid; we need a new apex session
    
        -- create a new apex session with our external username
        wwv_flow_custom_auth.define_user_session(
            p_user=>l_authenticated_username, 
            p_session_id=>wwv_flow_custom_auth.get_next_session_id);
        apex_application.g_unrecoverable_error := TRUE; -- tell apex engine to quit
        
        -- if we came in with a GET request then save the requested URL so we can call it
        -- again after the authentication routines finish
        IF owa_util.get_cgi_env('REQUEST_METHOD') = 'GET'  THEN
            wwv_flow_custom_auth.remember_deep_link(p_url => 'f?'|| wwv_flow_utilities.url_decode2(owa_util.get_cgi_env('QUERY_STRING')));
        ELSE
           -- the request was not GET so parse the application link info differently
           wwv_flow_custom_auth.remember_deep_link(p_url=>'f?p='||
                TO_CHAR(apex_application.g_flow_id)||':'||
                TO_CHAR(NVL(apex_application.g_flow_step_id,0))||':'||
                TO_CHAR(apex_application.g_instance));
        END IF;
        
        -- register session in apex sessions table,set cookie,redirect back
        wwv_flow_custom_auth_std.post_login( 
            p_uname     => l_authenticated_username,
			p_session_id =>nv('APP_SESSION'),
            p_flow_page => apex_application.g_flow_id||':'||NVL(apex_application.g_flow_step_id,0)); 
        RETURN FALSE;        
    END IF;    
END UM_SHIBBOLETH_PAGE_SENTRY;