more apex stuff

I am currently designing an authentication and authorization scheme for use with our Active Directory LDAP environment at work. It is a daunting task, considering that the apex.ldap functions don't work very well (or at all in some cases) with MS AD. The DBMS_LDAP routines however do work well; you just need to put in more elbow-grease to make things work.

I plan on posting my code here once I have finished, but I'd thought I'd list the requirements here, partly because it helps to make lists to sort through complex problems, and partly because I have nothing else to post here.

Security is an extremely hot topic at work, as I am sure it is at your place of business. We get audited all the time, and being defence contractors doesn't make it any easier. We have lots of rules around account activities, passwords, and group memberships. On top of that, when developing in the realm of the web app, we have further rules on cookies and sessions, among other things, that make life just that much harder for your average developer.

I am not going to go into minute detail, but the security model I am working with needs to fit into these parameters:

1. Access must be controlled by user id and group membership in AD
2. Application access must be multi-layered so that not all users have the same access (in such cases that it is required).
3. Once an application is deployed, security maintenance must be kept to a minimum to reduce total cost of ownership.

These seem simple enough, but when you flesh them out into code, things can get pretty hairy pretty quickly.

The model that I keep returning to in my mind is something like this:

1. Groups must be created in AD for each application and each access type, ie APP_Developers, or APP_Editors, or APP_Users.
2. Each APEX app must use the same authentication scheme..
3. At login, each app must validate the user against LDAP. Each app must maintain a table of the LDAP groups and the users in them for use in the authorization or sentry scheme.
4. This all has to happen automatically. (ugh).

Sadly, every time I start working on this problem, I think of another way to do it. It's hard being an obsessive/compulsive attention-deficit person. It means you obsess all the time over all sorts of different things, sometimes in parallel.

I do have the code for checking group membership (one group only) before logging into the app. So I know it can be done. Now I need to make it flexible, and incorporate more group checks.

I will post code shortly of what I've got, it's nothing you couldn't find elsewhere most likely, although I must admit I gave up looking a week or so ago.

Stay tuned...