Enabling SSO in formsweb.cfg Accessing the Forms Application Changes in Forms Built-ins

9-14 Forms Services Deployment Guide The application users password is not presented to the database; only the user name and the proxy users user name and password. Forms, with the help of OCI calls, issues the equivalent of: SQL connect midtier[appuser]midtierPWdatabaseTnsName For example, suppose your application always connects to the database using midtier. This midtier now informs the database that the actual user is appuser. Without using proxy users, the SQL command select USER from DUAL would return midtier, but, using proxy users, this query returns appuser. This essentially tells the database to trust that the user is authenticated elsewhere and to let the user connect without a password and to grant the connect role.

9.6.3 Enabling SSO in formsweb.cfg

Create a configuration section in formweb.cfg for single sign-on for example, ssoapp and set SSOProxyConnect to yes and ssoMode to true. The username and password that is used for the proxy connection is defined in the RAD entry in Oracle Internet Directory for the user that is logging on. If ssoProxyConnect=yes, the connect string equivalent issued by Forms is in effect: SQL connect RADUsername[appuserName]RADPassworddatabaseTnsName

9.6.4 Accessing the Forms Application

After enabling proxy user connections and single sign-on, perform the following steps to access the forms applications:

1.

Run the forms application with the URL http:host name:http portformsfrmservlet?config=ssoapp where ssoapp is the name of the configuration section with single sign-on ssoMode is enabled. 2. Use the single sign-on user name and password to log in in this example given in Section 9.6.2, Enabling Proxy User Connections , the single sign-on username is appuser and password is appuserPW. Note: ■ In the Step 3 of the above procedure, the database users are typically configured to have a subset of permissions granted to a schema. For example, appuser is granted CREATE permissions to the schema app_schema with the SQL command: SQL GRANT CREATE ON SCHEMA app_schema TO appuser Thus, the appuser is restricted to perform only a set of actions in proxy user mode. ■ When the database user for example, appuser is connected in proxy mode, user actions of the database users are audited rather than that of the proxy user. For more information on user action auditing, refer to the Oracle Database documentation at http:www.oracle.comtechnologydocumentationin dex.html . Using Forms Services with Oracle Single Sign-On 9-15

9.6.5 Changes in Forms Built-ins

The Built-in get_application_property now takes a new parameter called IS_ PROXY_CONNECTION a Boolean. When this parameter is supplied, the call returns true if the form is running in proxy user mode, false otherwise.

9.6.6 Reports Integration with Proxy Users