Introduction

In the previous blog, we set up Social Sign-In Authentication for your APEX application. Now, everyone in your Oracle Identity Access Management can access your application. But what if you only want a select group of users to have access? No worries - there are a few ways to do this.

The real question is: Where would you like to keep the list of approved users? Since you're already using a Cloud-based Identity Solution like OCI IAM, let's make the most of it and assume you'll manage your users there.

Prerequisites

Before we dive in, please make sure you have completed the following prerequisites listed below. This will enable you to move through this guide seamlessly.

OCI Tenancy ✅
Provisioning an Autonomous Database ✅
Accessing an APEX Instance ✅
Implementing Social Sign-In for your APEX App ✅

Let´s start by denying access to everyone

To ensure no one can access the application, simply go to your OCI IAM and adjust the settings for the application.

Sign in to your OCI tenancy and click on the navigation menu.
Go to Identity & Security, then select Domains.
Choose the default domain and search for the Integrated Applications link in the left navigation menu.
Find your desired application, like My APEX Application, and click on it.
Next, click Edit Application to open the sliding menu.
Finally, under Authentication and Authorization, click the Enforce grants as authorization box.

Save your changes and start a new APEX session. The app will ask you to sign in again, but this time, logging in won't work.

And there you have it! You've successfully blocked access for everyone.

Allow access for Single Users or Groups

To allow a single User or a Group to access your application, you need to assign the application to the user/group. To do this, go back to your OCI Console and navigate to the Users or Groups in your domain. On the left-side menu, you'll find the Integrated Applications link—give it a click. Now, you can assign an app by clicking the Assign Applications button. Search for the application you want to grant access to, click on assign and close the dialog.

Start a new APEX session and you will notice that you have access to your APEX app again.

We've successfully added an extra layer of security to our application. Now, let's move on to define the content of our APEX app using authorization schemes.

Manage User rights in APEX using Oracle IAM Groups

In this chapter, we want to manage user permissions for our APEX application by using authorization schemes in APEX. To accomplish this, we require additional information after authentication, such as the user's group. To do this, return to the APEX App Builder and modify the authentication scheme you created for Social Sign-In within your app. Add the attribute groups to the scope and also add the attribute groups in the additional user attributes.

In the Source section, we're now going to create a PL/SQL procedure that will run after the authentication process.

procedure get_user_groups 
as
    l_group_names apex_t_varchar2;
begin
    for i in 1 .. apex_json.get_count('groups') 
    loop
        apex_string.push (
            p_table => l_group_names,
            p_value => apex_json.get_varchar2 (
                           p_path => 'groups[%d].name',
                           p0     => i 
                       )
        );
    end loop;

    apex_authorization.enable_dynamic_groups (
        p_group_names => l_group_names
    );

end get_user_groups;

This PL/SQL procedure loops through the group array and adds them to the APEX dynamic groups.

In the Login Processing section, enter get_user_groups as the Post-Authentication Procedure Name.

Click Apply Changes.

We're almost done, just one more step to go. This will allow the APEX Authorization Scheme Is in Role or Group to work with the Dynamic Groups that OCI fills in for us.

So, let's go back to Shared Components and click on Security Attributes. Once you're there, look for the Authorization section and change the Source for Role of Group Schemes to Custom Code.

That's it 😉

Create an Authorization Scheme

Now let's create a new Authorization Scheme to manage what different groups can see and do. In this guide, we'll make a simple scheme just for Administrators. Go back to the Shared Components, click on Authorization Schemes and create a new one right there. Choose From Scratch and click Next. Give it a name like IS_ADMIN, select the Scheme Type as Is in Role or Group and the Type Custom. Lastly, enter the group name, which in this case is Administrators.

Finally, click Create Authorization Scheme.

Note: Administrators is the Group name in the OCI Identity Access Management.

Add specific Content for the Authorization Scheme

Let's have a look if everything is working smoothly by adding some specific content that only an Admin can access. Navigate to Page 1 in your Application and add a Static Content Region to the Page Body. You can give it a title like Info and enter the following HTML Code:

<H1>Hey, I´m an Admin</H1>

Scroll down to Security and choose the IS_ADMIN Authorization Scheme. This way, only the Administrators group can view this region. Click save and run and verify if everything's working as expected. If all is good, it should look something like this.

To ensure everything is 100% working perfectly, log out and then sign in with a different user who isn't part of the Admin group. If all is well, the region we created earlier won't be visible to them.

With this method, you can effortlessly set up as many roles as you want and link them to any APEX component. All you need to do is make an Authorization Scheme that connects to the matching IAM group 👍

Conclusion

In conclusion, implementing User Access Control in APEX with Oracle Identity and Access Management enhances the security of your application by allowing you to manage user permissions and roles effectively. By following the steps outlined in this guide, you can restrict access to specific Users or Groups, create Authorization Schemes, and tailor content based on User Roles, ensuring a secure and personalized user experience.

In the upcoming blog posts, we will demonstrate how to set up Multi-Factor Authentication and passwordless solutions. Stay tuned 😎

Implementing User Access Control in APEX with Oracle Identity and Access Management

Secure Access Made Easy: A Step-by-Step Guide Part 2

Table of contents