Compile, Assemble and Deploy Important Note About Implementing the Plug-In

15-2 Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager

15.3 Option 1

Option 1 is the traditional implementation using a Jump Page to include the flash movie that is used for fingerprinting. In Option 1, the flash movie sends the users current flash cookie value to the server and the server responds with a new value in a single transaction.

15.3.1 Option 1 Flow

Figure 15–1 shows the flow of Option 1. Figure 15–1 Option 1 1. The user is presented with the user name page 2. The user submits the user name a. The application loads the user b. The application calls VCryptTracker.updateLog with the User and HTTP Cookie information 3. The user is taken to the jump page containing the embedded flash movie a. The flash movie makes an HTTP request triggering flash fingerprint handling i. The server retrieves the HTTP request parameter v and stores it in session ii. The server retrieves the HTTP request parameter client iii. The server retrieves the HTTP request parameter fp iv. Parse fp with VCryptServletUtil.getFlashFingerprint client, fp v. Calls VCryptTracker.updateLog with the User, HTTP Cookie, and Flash information vi. The new flash cookie returned in CookieSet from updateLog is returned to the flash movie in the HTTP response v= + cookieSet.getFlashCookie 4. The user is taken to password page after jump page wait period a. Run the Pre-Authentication Rules 5. The user submits the password Flash Fingerprinting 15-3 a. The application verifies the password b. Run Post-Authentication Rules c. Calls VCryptTracker.updateAuthStatus with authentication result

15.3.2 Option 1 Code Example

This section provides a code example for Option 1. public String flashFingerPrintHttpServletRequest request { HttpSession session = request.getSessiontrue; try { String digitalCookie = request.getParameterv; String fpStr = request.getParameterfp; String client = request.getParameterclient; String flashFingerprint = VCryptServletUtil.getFlashFingerPrintclient, fpStr; session.setAttributev, digitalCookie; session.setAttributefp, flashFingerprint; VCryptAuthUser clientUser = VCryptAuthUser session.getAttributeclientUser; if clientUser == null { User not found in session return ; } String loginId = clientUser.getLoginId; String customerId = clientUser.getCustomerId; String groupId = clientUser.getCustomerGroupId; int clientType = UserDefEnum.getElementValueIBharosaConstants.ENUM_ CLIENT_TYPE_ID, FLASH_CLIENT_ENUM; cookieSet = updateLogrequest, loginId, customerId, groupId, clientType, authResult; session.setAttrubutecookieSet; return cookieSet.getFlashCookie; } catch Exception e { Handle fingerprinting error } return ; } flashFingerPrint

15.4 Option 2

Option 2 is a newer, more streamlined user experience that eliminates the Jump Page from the user experience. To do this, the flash movie is included in both the user name page and the password page.

15.4.1 Option 2 Flow

Figure 15–2 shows the flow of Option 2. 15-4 Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager Figure 15–2 Option 2 1. The user is presented with the user name page with the embedded flash movie a. The flash movie makes an HTTP request triggering the flash fingerprint handling i. The server retrieves the HTTP request parameter v and stores it in session ii. The server retrieves HTTP request parameter client iii. The server retrieves HTTP request parameter fp iv. Parse fp with VCryptServletUtil.getFlashFingerprintclient, fp and store result in user session. v. The value of v received is returned to the flash movie in the HTTP response v= + cookieSet.getFlashCookie 2. The user submits the user name a. The application loads the user b. Run Pre-Authentication Rules c. Calls VCryptTracker.updateLog with the User, HTTP Cookie and Flash value 3. The user is taken to the password page with the embedded flash movie a. The flash movie makes an HTTP request triggering the flash fingerprint handling i. The server already has the value from the previous flash request ii. The new value generated by UpdateLog call is returned to flash movie 4. The user submits the password a. The application verifies the password b. Run the Post-Authentication Rules c. Calls VCryptTracker.updateAuthStatus with the authentication result

15.4.2 Option 2 Code Example

This section provides a code example for Option 2.