USE HTTP Header Variable Authentication

Introduction
HTTP Header Variable Authentication in Oracle APEX enables applications to authenticate users based on values passed in HTTP headers. This method is commonly used in environments where authentication is handled externally by a web server or proxy, which then forwards user identity information via headers. Using this approach, APEX can trust the upstream system and seamlessly authenticate users without requiring separate login prompts.

How to Use HTTP Header Variable Authentication in Oracle APEX

1. Prepare Your Environment

   • Ensure your web server or reverse proxy is configured to authenticate users and send relevant identity information in HTTP headers, such as REMOTE_USER or a custom header.

2. Open Your APEX Application

   • Log in to Oracle APEX and open the target application.

3. Create or Configure Authentication Scheme

   • Go to Shared Components > Authentication Schemes.

   • Create a new scheme or edit an existing one.

   • Select HTTP Header Variable as the authentication type.

4. Configure HTTP Header Settings

   • Specify the name of the HTTP header that carries the authenticated username (e.g., REMOTE_USER).

   • Configure any additional validation or mapping if needed.

5. Set Application User Retrieval

   • Optionally, configure how the application retrieves additional user information or roles based on the header value.

6. Make the Scheme Current

   • Save the scheme and activate it by clicking Make Current.

7. Test the Authentication

   • Access the application through the web server that sets the HTTP header and verify that users are authenticated automatically based on the header values.

Authenticate users externally by using an HTTP header variable set by the web server.

Overview:
The HTTP Header Variable authentication method allows Oracle APEX to identify users based on a value stored in an HTTP header variable. This method is useful when integrating with centralized web authentication solutions such as Oracle Access Manager, which provides Single Sign-On (SSO). These external authentication systems validate user credentials and pass the authenticated username to APEX using an HTTP header variable (e.g., "REMOTE_USER", which is the default).

Setting Up HTTP Header Variable Authentication

To configure HTTP Header Variable authentication:

1. Access the Authentication Schemes Page:

• Open App Builder from the Workspace home page.

• Select an application.

• On the Application home page, go to Shared Components.

• Under Security, select Authentication Schemes.

2. Create a New Authentication Scheme:

• Click Create.

• Select Based on a pre-configured scheme from the gallery and click Next.

3. Configure Basic Authentication Settings:

• Name: Enter a reference name for the authentication scheme.

• Scheme Type: Select HTTP Header Variable.

4. Specify HTTP Header Variable Settings:

• HTTP Header Variable Name:

• Enter the name of the HTTP header variable containing the username.

• If left blank, REMOTE_USER will be used as the default.

• Action if Username is Empty:

• Choose the action when the HTTP header variable is empty: 

• Redirect to Built-In URL: Redirects to /apex/apex_authentication.callback, forcing authentication via the web server.

• Redirect to URL: Redirects to an external login page, which must then pass back the validated username.

• Display Error: Shows an error message without attempting a login.

• Verify Username:

• Defines how often APEX should verify the username in the HTTP header: 

• Each Request (most secure): Ensures the session username matches the header value on every request. If different, the session is invalidated.

• After Login: Only verifies the username once, after the initial login callback.

• Logout URL of SSO Server:

• (Optional) If using Oracle Access Manager or a similar SSO solution, enter the Single Sign-Out (SSO) logout URL.

• Example for Oracle Access Manager: 

/oamsso/logout.html?end_url=%POST_LOGOUT_URL%

%POST_LOGOUT_URL% will be replaced with an encoded URL for the APEX login page.

5. Save the Authentication Scheme:

• Click Create Authentication Scheme.

This setup enables secure external authentication using an HTTP header variable, ensuring seamless integration with enterprise SSO solutions like Oracle Access Manager.

Best Practices

• Use this method only when the HTTP header is reliably set by a trusted web server or proxy.

• Ensure secure communication (HTTPS) to protect header information.

• Validate the header content to prevent spoofing or unauthorized access.

• Combine with authorization schemes in APEX to control user privileges.

• Document and audit your configuration regularly.

Oracle APEX Documentation
For more information, refer to:
https://docs.oracle.com/en/database/oracle/apex/23.2/aeapp/http-header-authentication.html

Conclusion
HTTP Header Variable Authentication in Oracle APEX offers a seamless way to integrate external authentication systems with your applications. By trusting HTTP headers set by secure upstream systems, you can provide a smooth login experience without compromising security. Following best practices ensures that this method remains safe and effective in your APEX environment.