Session Timeout for Oracle Single Sign-On

Idle Session Timeout is value (in minutes for Oracle Single Sign-On Server) after which user has to re-login, if they are inacte (No Activity / Idle) during that time. It is recommended to set Idle Session time out (Global Inactivity timeout) for security reasons. By default there is No Value set for Idle Session Timeout for Oracle Single Sign-On Server Server which means any application (like portal, discoverer, BI, forms & reports) using Oracle Single Sign-on for authentication will NOT logout user session because of Inactivity (This can be a Security Risk).

Default Session Time Out value for Oracle E-Business Suite 11i/R12 is 30 Minutes to know more about Idle Session timeout in Oracle Apps 11i, R12 check my previous post at Idle Session in Oracle Apps R12, 11i

Default Session Timeout for Apps 11i/R12 integrated with Single Sign-On Server
——————————————————————————–
For Oracle E-Business Suite (Apps 11i/R12) Customers integrated with Oracle Single Sign-On, default session time out for E-Business Suite/11i/R12 is 30 minutes where as no value for SSO which means If Apps User try to access apps after 30 minutes of Inactivity, user will get warning that session timeout and prompted to re-login. This will take user to new window and
user without actually typing user name password can re-login to Apps
.

The reason behind this security loop hole is that user logged out from Apps 11i/R12 after 30 minutes of inactivity but user cookie is still valid on SSO(as no idle session time out set on SSO Server) and user can re-login to apps without entering password as its authenticated by SSO server.

How to avoid this situation ?
Make Idle Session Timeout for Oracle SSO server in line with Apps 11i/R12

How to set Session Time out or Global Inactivity Timeout for Oracle Single Sign-On Server
—————————————————————————————–

1. Execute ssogito.sql from $ORACLE_HOME/sso/admin/plsql/sso (on SSO Tier) as orasso schema
2. There are few more steps on SSO server which you can find in link below


Oracle Documentation
———————————
Configuring the Global User Inactivity Timeout at Global Inactivity Timeout in Oracle SSO Server

You can subscribe to posts from this site in your mail box from right menu bar and contact me using Contact Us page on this site for feedback and things you like to see on this site.



Related Docs

357687.1 - How to Verify if mod_osso Global Inactivity Timeout (GITO) is Working
301894.1 - What is the difference between the SSO session duration timeout and the global inactivity timeout values
340708.1 - Global Inactivity TimeOut (GITO) does not work
561224.1 - Where In The Metadata Repository Database Is The GITO Cookie Name Stored?
445336.1 - SSO Global Inactivity Timeout Is Not Protecting the Customize Link
418385.1 - Interminent 500 Internal Server Error accessing Production with SSO GIT set on Test system

Installing oas10g 10.1.3.0.1 in RHEL 5

when you are trying to install oas10g 10.1.3.1.0 in RHEL 5 it will through error ,saying this is supporte only in rhel 3 and rhel 4.

To fix this problem .Follow the steps given below


export LD_ASSUME_KERNEL=2.4.1;

or LD_ASSUME_KERNEL in the bash progile

.run the bash profile then try to install again .

SOA10g DOWNLOAD LINK

https://edelivery.oracle.com/EPD/Download/get_form?egroup_aru_number=9132671

Silent install of Oracle SOA Suite 10g (10.1.3.3) on Red Hat Linux

Summary

These instructions describe how to silent install Oracle SOA Suite 10g (10.1.3.3) on Red Hat AS 4 x86. It includes:

Install Oracle Database 10g (10.2.0.1)

Install Ultra Search 10g (10.2.0.1)

Create database and listener

Install Oracle Application Server Metadata Repository Upgrade Assistant 10g (10.1.2.0.3)

Load Metadata Repository

Apply the Oracle Database 10g (10.2.0.3) Patchset

Install Oracle SOA Suite 10g (10.1.3.1)

Apply the Oracle SOA Suite 10g (10.1.3.3) Patchset

All commands in bold and italics require manually intervention. Otherwise, you can simply copy and paste the commands as is to completely install the product on a single node. All directories are OFA compliant.



Assumptions

The ORACLE_BASE is set to c:\oracle\product (i.e., all software is installed under c:\oracle\product).

Hostname is 'oradev.oracle.com'.

Service name is 'orcl'.

All passwords are defaulted to 'password'.



Prerequisites

The following software must be downloaded to a /u01/temp directory:

Software Filename Size
Oracle SOA Suite 10g (10.1.3.1.0) soa_windows_x86_101310_disk1.zip 598,032,965 bytes
Oracle SOA Suite 10g (10.1.3.3.0) Patchset p6148874_101330_MSwin2000.zip 521,158,080 bytes
Oracle Database 10g (10.2.0.1.0) 10201_database_win32.zip 655,025,354 bytes
Oracle Database 10g (10.2.0.3.0) Patchset p5337014_10203_WINNT.zip 893,831,865 bytes
Oracle Database 10g Companion CD (10.2.0.1.0) 10201_companion_win32.zip 653,693,751 bytes
Oracle Application Server Metadata Repository Upgrade Assistant 10g (10.1.2.0.3) as_windows_x86_mrca_101203.zip 411,701,483 bytes

Download the following zip file and extract it to c:\temp2.

Disable all firewalls prior to installation.

Ensure that the primary NIC is not DHCP, otherwise the Oracle BPEL Process Manager Configuration Assistant will peg the CPU at 100% infinitely.



Details

1. Install Oracle Database 10g (10.2.0.1):
rem #
rem # Install the Oracle Database 10g 10.2.0.1
rem #
cd c:\temp2
unzip 10201_database_win32.zip
database\setup -silent -responseFile c:\temp2\1_db_windows.rsp
rmdir database /s /q
net stop OracleOraDb10g_home1iSQL*Plus
sc config OracleOraDb10g_home1iSQL*Plus start= disabled



2. Install Ultra Search 10g (10.2.0.1):
#
# Install Ultra Search from the companion CD (required to create the Metadata Repository)
#
rem #
rem # Install Ultra Search 10g (10.2.0.1) from the companion CD (required to create the Metadata Repository)
rem #
unzip 10201_companion_win32.zip
companion\setup -silent -responseFile c:\temp2\2_companion_windows.rsp
rmdir companion /s /q
set ORACLE_SID=orcl
emctl stop dbconsole
lsnrctl stop
net stop OracleServiceORCL



3. Apply Oracle Database 10g (10.2.0.3) Patchset:
rem #
rem # Install Oracle Database 10g (10.2.0.2) patchset (required for SOA Suite 10g)
rem #
unzip p5337014_10203_WINNT.zip
cd Disk1
setup –silent –responseFile c:\temp2\3_dbpatchset_windows.rsp
cd ..
rmdir Disk1 /s /q
lsnrctl start
net start OracleServiceORCL

rem #
rem # Post-installation upgrade steps
rem #
set ORACLE_HOME=c:\oracle\product\10.2.0\db_1
set PATH=%ORACLE_HOME%\bin;%PATH%
set ORACLE_SID=orcl
sqlplus "sys/password as sysdba" @4_postpatchset_windows.sql
del README.html /f /q



4. Load Metadata Repository:
rem #
rem # Install the Metadata Repository software
rem #
unzip as_windows_x86_mrca_101203.zip
set ORACLE_HOME=
setup -silent -responseFile c:\temp2\5_mrca_windows.rsp
rmdir stage /s /q
rmdir install /s /q
rmdir AccessBridge /s /q
del autorun.inf /s /q
del setup.exe /s /q

rem #
rem # Load the Metadata Repository into the database
rem #
set ORACLE_HOME=c:\oracle\product\10.2.0\db_1
set ORACLE_SID=orcl
sqlplus "sys/password as sysdba" @6_premrca.sql
set ORACLE_HOME=c:\oracle\product\10.1.2\mrca_1
C:\oracle\product\10.1.2\mrca_1\runRepca.bat -SILENT -RESPONSEFILE c:\temp2\6_repca_windows.rsp



5. Install Oracle SOA Suite 10g (10.1.3.1):
rem #
rem # Create the SOA specific schemas (ORABPEL, ORAESB, ORAWSM) using IRCA
rem #
unzip soa_windows_x86_101310_disk1.zip
set ORACLE_HOME=c:\oracle\product\10.2.0\db_1
set LD_LIBRARY_PATH=%ORACLE_HOME%\lib;%LD_LIBRARY_PATH%
set ORACLE_SID=orcl
set PATH=%ORACLE_HOME%\bin:%PATH%
cd install\soa_schemas\irca
irca.bat all "localhost 1521 orcl" password -overwrite ORABPEL password ORAESB password ORAWSM password
cd ..\..\..

rem #
rem # Install SOA Suite 10g (10.1.3.1)
rem #
setup -silent -responseFile c:\temp2\7_soa_windows.rsp
(You are prompted to press ENTER when done.)
rmdir install /s /q
rmdir stage /s /q
rmdir doc /s /q
del setup.exe /s /q
del setup.exe /s /q /aR



6. Apply Oracle SOA Suite 10g (10.1.3.3) Patchset:
rem #
rem # Install SOA Suite 10g (10.1.3.3) patchset
rem #
set ORACLE_HOME=c:\oracle\product\10.1.3\soa_1
set PATH=%ORACLE_HOME%\bin;%ORACLE_HOME%\opmn\bin;%PATH%
opmnctl stopall
unzip p6148874_101330_MSwin2000.zip
cd Disk1
setup -silent -responseFile c:\temp2\8_soapatchset_windows.rsp
(You are prompted to press ENTER when done.)
cd ..
rmdir Disk1 /s /q

rem #
rem # Run Configuration Assistants that failed to start
rem #
c:\oracle\product\10.1.3\soa_1\config\deploy_bpel.bat password
c:\oracle\product\10.1.3\soa_1\config\deploy_esb.bat password
c:\oracle\product\10.1.3\soa_1\perl\5.8.3\bin\MSWin32-x86-multi-thread\perl.exe -I c:\oracle\product\10.1.3\soa_1\perl\5.8.3\lib;c:\oracle\product\10.1.3\soa_1\perl\5.8.3\lib\MSWin32-x86 c:\oracle\product\10.1.3\soa_1\config\deploy_owsm.pl password

c:\oracle\product\10.1.3\soa_1\opmn\bin\opmnctl shutdown
c:\oracle\product\10.1.3\soa_1\opmn\bin\opmnctl startall

rem #
rem # Create 'tnsnames.ora' file
rem #
echo ORCL = >> c:\oracle\product\10.1.3\soa_1\network\admin\tnsnames.ora
echo (DESCRIPTION = >> c:\oracle\product\10.1.3\soa_1\network\admin\tnsnames.ora
echo (ADDRESS_LIST = >> c:\oracle\product\10.1.3\soa_1\network\admin\tnsnames.ora
echo (ADDRESS = (PROTOCOL = TCP)(HOST = oradev.local.com)(PORT = 1521)) >> c:\oracle\product\10.1.3\soa_1\network\admin\tnsnames.ora
echo ) >> c:\oracle\product\10.1.3\soa_1\network\admin\tnsnames.ora
echo (CONNECT_DATA = >> c:\oracle\product\10.1.3\soa_1\network\admin\tnsnames.ora
echo (SERVICE_NAME = orcl) >> c:\oracle\product\10.1.3\soa_1\network\admin\tnsnames.ora
echo ) >> c:\oracle\product\10.1.3\soa_1\network\admin\tnsnames.ora
echo ) >> c:\oracle\product\10.1.3\soa_1\network\admin\tnsnames.ora

rem #
rem # Post-installation upgrade steps
rem #
echo exit >> c:\oracle\product\10.1.3\soa_1\bpel\system\database\scripts\upgrade_10131_10133_oracle.sql
rem # The next command is in a single line
sqlplus orabpel/password@orcl @c:\oracle\product\10.1.3\soa_1\bpel\system\database\scripts\upgrade_10131_10133_oracle.sql




Applicable Versions

Oracle SOA Suite 10g (10.1.3.3)
Oracle Database 10g (10.2.0.3)

WebLogic 10.3.5 Installation is Silent Mode

1. Go to the directory that contains the installation program.
2. Launch the installation program by entering the following commands:

Syntax:
chmod a+x file_name.bin
./file_name.bin -mode=silent -silent_xml=path_to_silent.xml
In this command, file_name.bin is the name of the installation file and path_to_silent.xml is the full path of the silent.xml file.

Below it the syntax to execute the Installer for installing web logic 10.3.5 in the silent mode:

chmod a+x wls1035_linux32.bin
./wls1035_linux32.bin –mode=silent -silent_xml=/weblogic1035_32bit/silent.xml -log=silent.log

Silent.xml





value="WebLogic Server/Core Application ServerWebLogic Server
/Administration ConsoleWebLogic Server/Configuration Wizard and Upgrade
FrameworkWebLogic Server/Web 2.0 HTTP Pub-Sub ServerWebLogic Server/WebLogic SCA
WebLogic Server/WebLogic
JDBC DriversWebLogic Server/Third Party JDBC DriversWebLogic Server
/WebLogic Server ClientsWebLogic Server/WebLogic Web Server Plugins
WebLogic Server/UDDI and Xquery SupportWebLogic Server/Server Examples"/>






cd /wls/Oracle/Middleware/utils/uninstall/
sh uninstall.sh -mode silent

chown

This command is used to change permission of the files..

Suppose you have directory by name obiee_binary and you have the installer files inside this directory and this directory is owned by root. .

Please enter the command below to change the permission of all the directories inside this folder as obiprd user and the group oinstall

chown -R obirpd:oinstall obiee_binary/*

Setting Up the Customized External Authentication Plug-in in OID 10g (10.1.4.0.1)

Setting Up the Customized External Authentication Plug-in in OID 10g (10.1.4.0.1)
You can store user security credentials in a repository other than Oracle Internet Directory—for example, a database or another LDAP directory—and use these credentials for user authentication to Oracle components. You do not need to store the credentials in Oracle Internet Directory and then worry about keeping them synchronized. Authenticating a user by way of credentials stored in an external repository is called external authentication.
This chapter contains these topics:
Native Authentication Contrasted with External Authentication
Example: Installing, Configuring, and Enabling the External Authentication Plug-in
Native Authentication Contrasted with External Authentication
Authentication that relies on security credentials stored in Oracle Internet Directory is called native authentication. When a user enters her security credentials, the directory server compares them with the credentials stored in Oracle Internet Directory. If the credentials match, then the directory server authenticates the user.
Authentication that relies on security credentials stored in a directory other than Oracle Internet Directory is called external authentication. When a user enters her security credentials, the directory server compares them with the credentials stored in the other directory. This is done by using:
A PL/SQL program that does the external authentication work
An external authentication plug-in that invokes this PL/SQL program
Example: Installing, Configuring, and Enabling the External Authentication Plug-in
This section contains these topics:
Sample PL/SQL Package oidexaup.sql
Debugging the External Authentication Plug-in
Contents of PL/SQL Package oidexaup.sql
Sample PL/SQL Package oidexaup.sql
This example uses the a PL/SQL program, oidexaup.sql, which is described in "Contents of PL/SQL Package oidexaup.sql". This package is used for installing the external authentication plug-in PL/SQL package. It contains:
Two plug-ins: namely, when_compare_replace and when_modify_replace
One utility function: namely, get_nickname
The integrated package is the plug-in package, OIDEXTAUTH. It can also serve as a template to modify according to the requirements of your deployment.
To install, configure, and enable the external authentication plug-in, follow these steps:
Implement your standalone external authentication PL/SQL program. For example, if you want to authenticate users by using user names and passwords, then you should have a PL/SQL program which takes these two parameters.
In our sample code, oidexaup.sql, auth_external is the program package name, and authenticate_user is the function that does the authentication. You need to make sure that this standalone program is working properly before you move on to next steps.
Integrate this standalone program into the plug-in modules.
Load the plug-in package into database. In this example, we enter:
4. sqlplus ods/odspwd @oidexaup.sql
5.
Register the plug-ins. Do this by creating and uploading an LDIF file that provides the directory server with the necessary information to invoke the plug-in.
This example uses a file named oidexauth.ldif, which contains the following:
8. dn: cn=whencompare,cn=plugin,cn=subconfigsubentry
9. objectclass:orclPluginConfig
10. objectclass:top
11. orclpluginname:oidextauth
12. orclplugintype:operational
13. orclplugintiming:when
14. orclpluginldapoperation:ldapcompare
15. orclpluginenable:1
16. orclpluginversion:1.0.1
17. orclPluginIsReplace:1
18. cn:whencompare
19. orclpluginsubscriberdnlist:dc=com;o=IMC,c=US
20. orclpluginattributelist:userpassword
21. orclpluginrequestgroup:$prgdn
22.
23. dn: cn=whenmodify,cn=plugin,cn=subconfigsubentry
24. objectclass:orclPluginConfig
25. objectclass:top
26. orclpluginname:oidextauth
27. orclplugintype:operational
28. orclplugintiming:when
29. orclpluginldapoperation:ldapmodify
30. orclpluginenable:1
31. orclpluginversion:1.0.1
32. orclPluginIsReplace:1
33. cn:whenmodify
34. orclpluginsubscriberdnlist:dc=com;o=IMC,c=US
35. orclpluginattributelist:userpassword
36. orclpluginrequestgroup:$prgdn
37.
In this file, we notify the directory server that, whenever there is an ldapcompare or ldapmodify request, there are two plug-ins to be invoked.
We use orclpluginsubscriberdnlist:dc=com;o=IMC,c=US so that plug-ins will ONLY be invoked if the target entry is under dc=com or o=IMC,c=US.
Replace $prgdn with the plug-in request group DN. This is an optional, recommended security feature. For integrating with Oracle Application Server Single Sign-On, this value is a required field. Only members of the group entered can invoke the plug-ins. You may enter multiple groups. Use a semicolon to separate entries.
The recommended defaults are: cn=OracleUserSecurityAdmins,cn=Groups,cn=OracleContext and cn=OracleDASAdminGroup,cn=Groups,cn=OracleContext,o=default_subscriber,dc=com. Note that the Oracle Application Server Single Sign-On server is a member of the first group. Also, be sure to replace o=default_subscriber with the correct value for your deployment environment.
To add this file to the directory, enter the following:
ldapadd -p portnum -h hostname -D cn=orcladmin -w orcladminpwd -v \
-f oidexauth.ldif

Now, everything should be ready. Use the ldapcompare command-line tool to verify that the plug-in and authentication program are working properly before you try to authenticate the user from Oracle Application Server Single Sign-On.
In our example, we also provide the plug-in code for externally modifying user password.
Debugging the External Authentication Plug-in
Turn on directory server plug-in to help you to examine the process and content of plug-ins.
To setup directory server plug-in debugging, execute the following command:
sqlplus ods/password @$ORACLE_HOME/ldap/admin/oidspdsu.sql

To enable directory server plug-in debugging, execute the following command:
sqlplus ods/password @$ORACLE_HOME/ldap/admin/oidspdon.sql

To disable directory server plug-in debugging, execute the following command:
sqlplus ods/password @$ORACLE_HOME/ldap/admin/oidspdof.sql

To show directory server plug-in debugging messages, execute the following command:
sqlplus ods/password @$ORACLE_HOME/ldap/admin/oidspdsh.sql

To delete directory server plug-in debugging messages, please execute the following command:
sqlplus ods/password @$ORACLE_HOME/ldap/admin/oidspdde.sql
Contents of PL/SQL Package oidexaup.sql
The script oidexaup.sql, as used in this example, contains the following:
CREATE OR REPLACE PACKAGE OIDEXTAUTH AS

PROCEDURE when_compare_replace (ldapplugincontext IN ODS.plugincontext,
result OUT INTEGER,
dn IN VARCHAR2,
attrname IN VARCHAR2,
attrval IN VARCHAR2,
rc OUT INTEGER,
errormsg OUT VARCHAR2
);

PROCEDURE when_modify_replace (ldapplugincontext IN ODS.plugincontext,
dn IN VARCHAR2,
mods IN ODS.modlist,
rc OUT INTEGER,
errormsg OUT VARCHAR2
);

FUNCTION get_nickname (dn IN VARCHAR2,
my_session IN DBMS_LDAP.session)
RETURN VARCHAR2;

END OIDEXTAUTH;
/

SHOW ERROR

CREATE OR REPLACE PACKAGE BODY OIDEXTAUTH AS

-- We use this function to convert the dn to nickname.
-- When OID server receives the ldapcompare request, it
-- only has the dn information. We need to use DBMS_LDAP_UTL
-- package to find out the nickname attribute value of
-- the entry.

FUNCTION get_nickname (dn IN VARCHAR2,
my_session IN DBMS_LDAP.session)
RETURN VARCHAR2
IS
my_pset_coll DBMS_LDAP_UTL.PROPERTY_SET_COLLECTION;
my_property_names DBMS_LDAP.STRING_COLLECTION;
my_property_values DBMS_LDAP.STRING_COLLECTION;

user_handle DBMS_LDAP_UTL.HANDLE;
user_id VARCHAR2(2000);
user_type PLS_INTEGER;
user_nickname VARCHAR2(256) DEFAULT NULL;

my_attrs DBMS_LDAP.STRING_COLLECTION;
retval PLS_INTEGER;

BEGIN
plg_debug( '=== Beginning of get_nickname() === ');
user_type := DBMS_LDAP_UTL.TYPE_DN;
user_id := dn;

retval := DBMS_LDAP_UTL.create_user_handle(user_handle, user_type, user_id);

plg_debug('create_user_handle() Returns ' To_char(retval));

retval := DBMS_LDAP_UTL.get_user_properties(my_session,
user_handle,
my_attrs,
DBMS_LDAP_UTL.NICKNAME_PROPERTY,
my_pset_coll);

plg_debug( 'get_user_properties() Returns ' To_char(retval));

IF my_pset_coll.COUNT > 0 THEN
FOR i IN my_pset_coll.first .. my_pset_coll.last LOOP
retval := DBMS_LDAP_UTL.get_property_names(my_pset_coll(i),
my_property_names);
IF my_property_names.COUNT > 0 THEN
FOR j IN my_property_names.first .. my_property_names.last LOOP
retval := DBMS_LDAP_UTL.get_property_values(my_pset_coll(i),
my_property_names(j),
my_property_values);
IF my_property_values.COUNT > 0 THEN
FOR k IN my_property_values.FIRST..my_property_values.LAST LOOP
user_nickname := my_property_values(k);
plg_debug( 'user nickname = ' user_nickname);
END LOOP;
END IF;
END LOOP;
END IF; -- IF my_property_names.count > 0
END LOOP;
END IF; -- If my_pset_coll.count > 0

plg_debug( 'got user_nickname: ' user_nickname);

-- Free my_properties
IF my_pset_coll.count > 0 then
DBMS_LDAP_UTL.free_propertyset_collection(my_pset_coll);
END IF;

DBMS_LDAP_UTL.free_handle(user_handle);

RETURN user_nickname;

EXCEPTION
WHEN OTHERS THEN
plg_debug('Exception in get_nickname. Error code is ' to_char(sqlcode));
plg_debug(' ' Sqlerrm);
RETURN NULL;
END;


PROCEDURE when_compare_replace (ldapplugincontext IN ODS.plugincontext,
result OUT INTEGER,
dn IN VARCHAR2,
attrname IN VARCHAR2,
attrval IN VARCHAR2,
rc OUT INTEGER,
errormsg OUT VARCHAR2
)
IS
retval pls_integer;
lresult BOOLEAN;

my_session DBMS_LDAP.session;
my_property_names DBMS_LDAP.STRING_COLLECTION;
my_property_values DBMS_LDAP.STRING_COLLECTION;
my_attrs DBMS_LDAP.STRING_COLLECTION;
my_pset_coll DBMS_LDAP_UTL.PROPERTY_SET_COLLECTION;
user_handle DBMS_LDAP_UTL.HANDLE;

user_id VARCHAR2(2000);
user_type PLS_INTEGER;
user_nickname VARCHAR2(60);
remote_dn VARCHAR2(256);

i PLS_INTEGER;
j PLS_INTEGER;
k PLS_INTEGER;

BEGIN
plg_debug( '=== Begin of WHEN-COMPARE-REPLACE plug-in');
plg_debug( 'DN = ' dn);
plg_debug( 'Attr = ' attrname);
--plg_debug( 'Attrval = ' attrval);

DBMS_LDAP.USE_EXCEPTION := FALSE;
errormsg := 'No error msg';
rc := 0;

-- converting dn to nickname
my_session := LDAP_PLUGIN.init(ldapplugincontext);
plg_debug( 'ldap_session =' RAWTOHEX(SUBSTR(my_session,1,8)));

retval := LDAP_PLUGIN.simple_bind_s(ldapplugincontext, my_session);
plg_debug( 'simple_bind_res =' TO_CHAR(retval));

user_nickname := get_nickname(dn, my_session);
plg_debug( 'user_nickname =' user_nickname);

-- unbind from the directory
retval := DBMS_LDAP.unbind_s(my_session);
plg_debug( 'unbind_res Returns ' To_char(retval));

IF (user_nickname IS NULL) THEN
result := 32;
errormsg := 'Can''t find the nickname';
plg_debug( 'Can''t find the nickname');
RETURN;
END IF;

plg_debug( '=== Now go to extauth ');

BEGIN
retval := auth_external.authenticate_user(user_nickname, attrval);
plg_debug( 'auth_external.authenticate_user() returns = ' 'True');
result := 6; -- compare result is TRUE
EXCEPTION
WHEN OTHERS THEN
result := 5; -- compare result is FALSE
plg_debug( 'auth_external.authenticate_user() returns = ' 'False');
RETURN;
END;

plg_debug( '=== End of WHEN-COMPARE-REPLACE plug-in');
EXCEPTION
WHEN OTHERS THEN
rc := 1;
errormsg := 'Exception: when_compare_replace plugin';
plg_debug( 'EXCEPTION: ' retval);
plg_debug('Exception in when_compare. Error code is ' to_char(sqlcode));
plg_debug(' ' Sqlerrm);
END;


PROCEDURE when_modify_replace (ldapplugincontext IN ODS.plugincontext,
dn IN VARCHAR2,
mods IN ODS.modlist,
rc OUT INTEGER,
errormsg OUT VARCHAR2
)
IS
retval pls_integer;
lresult BOOLEAN;

my_session DBMS_LDAP.SESSION;
my_property_names DBMS_LDAP.STRING_COLLECTION;
my_property_values DBMS_LDAP.STRING_COLLECTION;
my_attrs DBMS_LDAP.STRING_COLLECTION;
my_modval DBMS_LDAP.BERVAL_COLLECTION;
my_pset_coll DBMS_LDAP_UTL.PROPERTY_SET_COLLECTION;
user_handle DBMS_LDAP_UTL.HANDLE;

l_mod_array RAW(32);
user_id VARCHAR2(2000);
user_type PLS_INTEGER;
user_nickname VARCHAR2(2000);
old_passwd VARCHAR2(60) DEFAULT NULL;
new_passwd VARCHAR2(60) DEFAULT NULL;
remote_dn VARCHAR2(256);

i PLS_INTEGER;
j PLS_INTEGER;
k PLS_INTEGER;

BEGIN
plg_debug( '=== Begin of WHEN-MODIFY-REPLACE plug-in');
DBMS_LDAP.USE_EXCEPTION := FALSE;
user_type := DBMS_LDAP_UTL.TYPE_DN;
user_id := dn;

-- converting dn to nickname
my_session := LDAP_PLUGIN.init(ldapplugincontext);
plg_debug( 'ldap_session =' RAWTOHEX(SUBSTR(my_session,1,8)));

retval := LDAP_PLUGIN.simple_bind_s(ldapplugincontext, my_session);
plg_debug( 'simple_bind_res =' TO_CHAR(retval));

user_nickname := get_nickname(dn, my_session);
plg_debug( 'user_nickname =' user_nickname);

-- unbind from the directory
retval := DBMS_LDAP.unbind_s(my_session);

FOR l_counter1 IN 1..mods.COUNT LOOP
IF (mods(l_counter1).operation = 2) AND
(mods(l_counter1).type = 'userpassword') THEN

FOR l_counter2 IN 1..mods(l_counter1).vals.COUNT LOOP
new_passwd := mods(l_counter1).vals(l_counter2).val;
END LOOP;
END IF;

IF (mods(l_counter1).operation = 0) AND
(mods(l_counter1).type = 'userpassword') THEN

FOR l_counter2 IN 1..mods(l_counter1).vals.COUNT LOOP
new_passwd := mods(l_counter1).vals(l_counter2).val;
END LOOP;
END IF;

IF (mods(l_counter1).operation = 1) AND
(mods(l_counter1).type = 'userpassword') THEN

FOR l_counter2 IN 1..mods(l_counter1).vals.COUNT LOOP
old_passwd := mods(l_counter1).vals(l_counter2).val;
END LOOP;
END IF;
END LOOP;

IF new_passwd IS NOT NULL AND old_passwd IS NOT NULL THEN
BEGIN
auth_external.change_passwd(user_nickname, old_passwd, new_passwd);
EXCEPTION
WHEN OTHERS THEN
rc := 1;
plg_debug( 'auth_external.change_passwd() raised exception.');
errormsg := 'auth_external.change_passwd() raised exception.';
RETURN;
END;
ELSIF new_passwd IS NOT NULL AND old_passwd IS NULL THEN
BEGIN
auth_external.reset_passwd(user_nickname, new_passwd);
EXCEPTION
WHEN OTHERS THEN
plg_debug( 'auth_external.reset_passwd() raised exception.');
rc := 1;
errormsg := 'auth_external.reset_passwd() raised exception.';
RETURN;
END;
ELSE
rc := 1;
errormsg := 'PLG_Exception. Not enough info to change passwd.';
END IF;

plg_debug( 'external change password succeed');
rc := 0;
errormsg := 'No when_mod_replace plguin error msg';

retval := DBMS_LDAP.unbind_s(my_session);

plg_debug( 'End of WHEN-MODIFY-REPLACE');
--COMMIT;
EXCEPTION
WHEN others THEN
rc := 1;
errormsg := 'PLG_Exception: when_modify_replace plguin';
plg_debug('Exception in when_modify. Error code is ' to_char(sqlcode));
plg_debug(' ' Sqlerrm);
END;

END OIDEXTAUTH;
/
SHOW ERRORS
--list


EXIT;