HOW TO Understand Preconfigured Authentication Schemes in Oracle APEX

Introduction
Oracle APEX provides several preconfigured authentication schemes that allow developers to quickly implement secure login functionality in their applications. These built-in options cover a wide range of common authentication needs, including internal development, enterprise environments, and public access. Understanding how these schemes work—and how to choose the right one—is essential for ensuring your app is protected and tailored to your users.

How to Understand and Use Preconfigured Authentication Schemes in Oracle APEX

1. Accessing Authentication Schemes

   • Open your application in APEX

   • Go to Shared Components

   • Click on Authentication Schemes under the Security section

   • The current active scheme is marked with (Current)

2. Overview of Preconfigured Schemes

   • APEX Accounts
     Uses user accounts defined in the APEX workspace. Best for development and testing environments.

   • Database Accounts
     Authenticates users using their Oracle database credentials. Rarely used in web applications.

   • LDAP Directory
     Connects to your corporate directory (e.g., Active Directory). Ideal for internal enterprise use.

   • Social Sign-In
     Allows users to authenticate using services like Google, Facebook, or Microsoft via OAuth 2.0.

   • Oracle Single Sign-On (SSO)
     Integrates with Oracle Identity Cloud Service or Oracle Access Manager for seamless authentication.

   • Open Door Credentials
     No login required. Used for public-facing applications that don’t need authentication.

3. How to Enable a Preconfigured Scheme

   • In the Authentication Schemes page, click Create

   • Choose From Preconfigured Scheme

   • Select the appropriate option (e.g., LDAP Directory, Social Sign-In)

   • Fill in the required details, such as server information or OAuth credentials

   • Click Create and Make Current to activate it

4. Managing Authentication Settings
   Each scheme can be customized with post-login behavior, session timeout controls, logout redirects, and more. Review and test these settings to align them with your app's security policy.

Oracle APEX provides several preconfigured authentication schemes that developers can use to control access to applications. These built-in authentication methods simplify user identity verification without requiring extensive custom development.

Types of Preconfigured Authentication Schemes

1. Oracle APEX Accounts
   This method uses Oracle APEX’s built-in user repository for authentication. Developers can create and manage user accounts directly within APEX, making it ideal for applications that don’t require external authentication services.

2. Database Accounts
   Authentication is performed using database schema credentials. Users log in with their database usernames and passwords, ensuring security at the database level.

3. LDAP Directory
   Authentication is delegated to an LDAP (Lightweight Directory Access Protocol) server. Users log in with their LDAP credentials, enabling integration with enterprise directory services.

4. Social Sign-In
   Supports authentication using social identity providers like Google, Facebook, Microsoft, or any provider that supports OpenID Connect or OAuth2. This allows users to log in with their existing social media or enterprise accounts.

5. SAML Sign-In
   Allows authentication through Security Assertion Markup Language (SAML). This method is commonly used for integrating with corporate identity providers, enabling Single Sign-On (SSO) across multiple applications.

6. Oracle Application Server Single Sign-On (SSO)
   Authentication is managed by an Oracle Single Sign-On (SSO) server, allowing seamless login across multiple Oracle applications.

7. HTTP Header Variable
   Authentication is performed by checking the username stored in an HTTP header variable set by a web server. This is useful in environments where authentication is handled externally, such as reverse proxies or enterprise authentication gateways.

8. No Authentication (Public Access)
   This scheme disables authentication, allowing anyone to access the application without logging in. This is typically used for public applications where authentication is unnecessary.

9. Open Door Credentials
   Allows users to access the application using a built-in login page that captures a username without requiring a password. This is useful for simple access control scenarios.

10. Builder Extension Sign-In
    Used for APEX Builder extensions, allowing users to access extension apps without signing in again if they are already logged into APEX.

Configuring a Preconfigured Authentication Scheme

To configure an authentication scheme:

• Navigate to App Builder > Shared Components > Authentication Schemes

• Select an existing scheme or create a new one from the authentication scheme gallery

• Configure the settings based on the chosen authentication method

• Click Make Current to activate the authentication scheme for the application

Oracle APEX allows developers to switch between authentication schemes as needed, ensuring flexibility and security for different application requirements.

Best Practices

• Use APEX Accounts for internal development only

• For production apps, use LDAP, SSO, or Social Sign-In depending on your user base

• Avoid using Open Door unless the application is intended to be completely public

• Clearly document which scheme is used and keep credentials or configurations up to date

• Always test authentication flow before releasing the app

Oracle APEX Documentation
Official guide on preconfigured authentication schemes:
https://docs.oracle.com/en/database/oracle/apex/23.2/aeapp/preconfigured-authentication-schemes.html

Conclusion
Oracle APEX’s preconfigured authentication schemes make it easy to secure your application with minimal setup. From development tools to enterprise-grade solutions, these schemes are designed to handle a variety of use cases. By understanding how each scheme works and following best practices, you can ensure a safe and smooth login experience for your users while maintaining strong control over application access.