Extending Oracle Fusion Cloud Applications using Oracle APEX – Authorization

This blog is part of the blog series Extending Oracle Fusion Cloud Applications using Oracle APEX. In this blog post we will cover the steps to enable Authorization in Oracle APEX using Oracle Fusion Cloud Applications roles.

Oracle Fusion roles are available as OCI Groups and the same are passed to Oracle APEX via the groups specified in the Oracle APEX Authentication scheme.

Oracle APEX provides native declarative options to configure and enable Authorization. However, for the Oracle Fusion Extensions, we will leverage the Authorization details from Oracle Fusion roles and declaratively utilize them and enable Authorization in Oracle APEX. With this, Oracle Fusion would serve as the single source of Authorization details.

Prerequisites

1. Access to the Oracle APEX environment.
2. Complete the steps mentioned in the Extending Oracle Fusion Cloud Applications using Oracle APEX – Authentication blog.

High level steps

1. Login to the APEX environment.
2. Create a new Fusion Integrated APEX application or use the APEX application created in the Authentication blog.
3. Verify and update the Authentication Scheme.
4. Create the Authorization Scheme/s.
5. Utilize the Authorization scheme in Oracle APEX Page/Region/Field/Button.

Detailed steps

Verify and update the Authentication Scheme/s: Navigate to the Shared Components –> Authentication Scheme and perform the below steps:

1. Add groups to the Scope and Additional User Attributes.
2. Add the below PL/SQL code (e.g procedure get_user_groups).
3. Add the name of the procedure (e.g get_user_groups) to Post-Authentication Procedure Name.

-- Sample reference code
procedure get_user_groups 
as
    l_group_names apex_t_varchar2;
    l_json_clob clob;
begin   
    apex_json.initialize_clob_output;
    apex_json.write(p_values => apex_json.g_values);
    l_json_clob := apex_json.get_clob_output;
    apex_json.free_output;
    for i in 1 .. apex_json.get_count('groups') 
    loop
        apex_string.push (
            p_table => l_group_names,
            p_value => apex_json.get_varchar2 (
                           p_path => 'groups[%d].name',
                           p0     => i 
                       )
        );
    end loop;
    apex_authorization.enable_dynamic_groups (
        p_group_names => l_group_names
    );
end get_user_groups;

Create the Authorization Scheme/s: Navigate to the Shared Components –> Authorization Scheme and perform the below steps:

Important points to note:

Oracle APEX allows Authorization to be applied at multiple levels:

1. Page level
2. Region in a page.
3. Field in a page region.
4. Button in a page region.

We can apply only one Authorization scheme at any of the above levels. However, we can also have different Authorization schemes at different levels inside the same page, based on the security requirements for the page. Imagine a page with multiple regions, fields, buttons which are all controlled by the different Authorization schemes.

Page level Authorization scheme:

Region level Authorization scheme:

Page Item level (Text Field) Authorization scheme:

Page button level Authorization scheme:

Conclusion

With this configuration, we will be able to enable the required Authorization to the Oracle APEX Fusion Extension pages in a declarative way. Below are few take-aways:

1. Identify the business requirements expected to be addressed by the Oracle APEX Fusion Extension.
2. Identify logically related requirements and the number of Oracle APEX pages required to support it.
3. Identify the Authorization required for the Oracle APEX pages/regions/fields/buttons.
4. Create the required Authorization schemes.
5. Enable the Authorization on the pages and test the same.

References

Oracle APEX: Providing Security Through Authorization