Use Oracle 10g Single-Sign-On with .NET applications

Today's enterprise-wide systems are becoming increasingly sophisticated with a variety of operating systems and software development platforms. This presents the constant challenge of integration, which requires creative ways of configuring products from multiple vendors to work in tandem. This article presents another useful tip in this quest for integration.

The Oracle 10g Application Server (10gAS) family of products provides a wide range of components for enterprise portals, content management, and application security. One useful component for Web applications is the Oracle Single Sign-On (SSO) authentication module, which is functionally similar to Netegrity SiteMinder from Computer Associates.

Oracle SSO is implemented using the:

• mod_osso Apache module
• SSO J2EE components
• SSO database repository
• SSO PL/SQL components

SSO uses Oracle Internet Directory (OID), which is an Oracle database based LDAP compliant directory server. The topic of integrating OID with Microsoft Active Directory in Oracle 9iAS was discussed in a previous article; as an extension, this integration has been tested and is also valid in 10gAS.

For the companies using Oracle 10gAS as well as .NET, this article presents a simple yet effective method for using Oracle SSO running on Linux, Windows, Solaris or any other supported platform for .NET applications running Microsoft Internet Information Server (IIS).

The diagram in Figure A illustrates the method. Web requests for .NET applications are channeled through Oracle 10gAS where Apache is configured to proxy requests to the .NET application and SSO is configured to protect the application's URL's.

Figure A

Method diagram

In this setup, mod_osso will make sure a valid user is logged in before the mod_proxy module proxies to the .NET applications. If nobody is logged in when accessing the protected page, SSO will redirect the browser to a login page, authenticate the user, and then redirect back to the page initially requested. This setup will guarantee that somebody is logged in using SSO before the user is allowed to reach the .NET application. This method means application users need to be set up in OID beforehand because SSO uses OID to validate user credentials.

The first step is to set up the mod_proxy of Apache in Oracle 10gAS to channel requests to .NET applications on IIS. Using the Oracle 10gAS Enterprise Manager (EM) console or by directly editing $ORACLE_HOME/Apache/Apache/conf/httpd.conf, add the following entries:

ProxyPass /dotnetapp/ http://iishost:port/dotnetapp/

ProxyPass /dotnetapp http://iishost:port/dotnetapp/


ProxyPassReverse /dotnetapp/ http://iishost:port/dotnetapp/

ProxyPassReverse /dotnetapp http://iishost:port/dotnetapp/

In the above example as well as in the rest of the article, please, replace dotnetapp, iishost:port, and 10gashost:port as it applies to your situation.

The second step is to set up Oracle SSO to protect the application's URL. Using EM console or by directly editing $ORACLE_HOME/Apache/Apache/conf/mod_osso.conf, add the following lines just before the </IfModule>:

    <Location /dotnetapp>
        require valid-user
        AuthType Basic
    </Location>
    <Location /dotnetapp*>
        require valid-user
        AuthType Basic
    </Location>

Please note that if you directly edit httpd.conf or mod_osso.conf without using the EM console, you must apply the changes to the DCM repository using:

$ORACLE_HOME/bin/emctl stop iasconsole

$ORACLE_HOME/dcm/bin/dcmctl updateConfig -ct ohs -v -d 

$ORACLE_HOME/bin/emctl start iasconsole

It is important to restart Apache after the configuration. The easiest way, again, is to use EM console. Alternatively, use:

$ORACLE_HOME/opmn/bin/opmnctl restartproc ias-component=HTTP_Server

The .NET application will be accessible through 10gAS using the following URL:

http://10gashost:port/dotnetapp/

In the application, use HTTP header Osso-User-Dn to identify the current application user, e.g.:

Dim UserDn = Request.Headers.Item("Osso-User-Dn")

The User DN format used in SSO/OID should be:

cn=userid,cn=users,dc=yourdomain,dc=com

If the application detects that the Osso-User-Dn header is not set, then the browser is attempting to access the application directly and not through 10gAS. In such a situation, as a good usability practice, we suggest that the application redirect the browser to the correct URL, which will take care of the SSO authentication for the .NET application.

To let users log out of SSO directly from the .NET application, use the following link:

http://10gashost:port/osso_logout?p_done_url=http://10gashost:port/

The p_done_url specifies the URL to redirect to after the logout.

Users will access the.NET application using:

http://10gashost:port/dotnetapp/