By Sergo
Grigalashvili and Sanjeev Malik

Today’s enterprise-wide systems are becoming increasingly
sophisticated with a variety of operating systems and software development
platforms. This presents the constant challenge of integration, which requires
creative ways of configuring products from multiple vendors to work in tandem.
This article presents another useful tip in this quest for integration.

The Oracle
10g Application Server (10gAS) family of products provides a wide range of
components for enterprise portals, content management, and application
security. One useful component for Web applications is the Oracle Single
Sign-On (SSO) authentication module, which is functionally similar to Netegrity
SiteMinder from Computer Associates.

Oracle SSO

Oracle SSO is implemented using the:

  • mod_osso Apache module
  • SSO
    J2EE components
  • SSO
    database repository
  • SSO
    PL/SQL components

SSO uses Oracle Internet Directory (OID), which is an Oracle
database based LDAP compliant directory server. The topic of integrating OID
with Microsoft Active Directory in Oracle 9iAS was discussed in a previous
article; as an extension, this integration has been tested and is also
valid in 10gAS.

For the companies using Oracle 10gAS as well as .NET, this
article presents a simple yet effective method for using Oracle SSO running on
Linux, Windows, Solaris or any other supported platform for .NET applications
running Microsoft Internet Information Server (IIS).

The method

The diagram in Figure
A illustrates the method. Web requests for .NET applications are channeled
through Oracle 10gAS where Apache is configured to proxy requests to the .NET
application and SSO is configured to protect the application’s URL’s.

Figure A
Method diagram

In this setup, mod_osso
will make sure a valid user is logged in before the mod_proxy module proxies to the .NET applications. If nobody is
logged in when accessing the protected page, SSO will redirect the browser to a
login page, authenticate the user, and then redirect back to the page initially
requested. This setup will guarantee that somebody is logged in using SSO
before the user is allowed to reach the .NET application. This method means
application users need to be set up in OID beforehand because SSO uses OID to
validate user credentials.

Proxy setup

The first step is to set up the mod_proxy of Apache in Oracle 10gAS to channel requests to .NET
applications on IIS. Using the Oracle 10gAS Enterprise Manager (EM) console or
by directly editing $ORACLE_HOME/Apache/Apache/conf/httpd.conf, add the following
entries:

ProxyPass /dotnetapp/ http://iishost:port/dotnetapp/

ProxyPass /dotnetapp http://iishost:port/dotnetapp/

ProxyPassReverse /dotnetapp/ http://iishost:port/dotnetapp/

ProxyPassReverse /dotnetapp http://iishost:port/dotnetapp/

In the above example as well as in the rest of the article,
please, replace dotnetapp, iishost:port, and 10gashost:port as it applies to your situation.

SSO setup

The second step is to set up Oracle SSO to protect the
application’s URL. Using EM console or by directly editing $ORACLE_HOME/Apache/Apache/conf/mod_osso.conf,
add the following lines just before the </IfModule>:

    <Location /dotnetapp>
        require valid-user
        AuthType Basic
    </Location>
    <Location /dotnetapp*>
        require valid-user
        AuthType Basic
    </Location>

Please note that if you directly edit httpd.conf or mod_osso.conf
without using the EM console, you must apply the changes to the DCM repository
using:

$ORACLE_HOME/bin/emctl stop iasconsole
$ORACLE_HOME/dcm/bin/dcmctl updateConfig -ct ohs -v -d 
$ORACLE_HOME/bin/emctl start iasconsole

It is important to restart Apache after the configuration.
The easiest way, again, is to use EM console. Alternatively, use:

$ORACLE_HOME/opmn/bin/opmnctl restartproc ias-component=HTTP_Server

.NET application

The .NET application will be accessible through 10gAS using
the following URL:

http://10gashost:port/dotnetapp/

In the application, use HTTP header Osso-User-Dn to identify the current application user, e.g.:

Dim UserDn = Request.Headers.Item("Osso-User-Dn")

The User DN format used in SSO/OID should be:

cn=userid,cn=users,dc=yourdomain,dc=com

If the application detects that the Osso-User-Dn header is not set, then the browser is attempting to
access the application directly and not through 10gAS. In such a situation, as
a good usability practice, we suggest that the application redirect the browser
to the correct URL, which will take care of the SSO authentication for the .NET
application.

To let users log out of SSO directly from the .NET
application, use the following link:

http://10gashost:port/osso_logout?p_done_url=http://10gashost:port/

The p_done_url
specifies the URL to redirect to after the logout.

Users will access the.NET application using:

http://10gashost:port/dotnetapp/