Oracle REST Data Services: Determining the Authenticated User

29/09/2017

Introduction

Oracle REST Data Services (ORDS) has a number of implicit parameters which may be bound into Resource Module Handlers. One of which is :current_user which provides the identity of the user authenticated for the current request. If a user has not been authenticated then value of :current_user will be null.

Example

We can bind the value of :current_user into the context of a query as shown below:

begin
  ords.define_service(
    p_module_name => 'current.user.example',
    p_base_path => '/greetings/',
    p_pattern => 'example',
    p_source_type => ords.source_type_collection_item,
    p_source => 'select ''Hello '' || :current_user "greeting" from dual'
  );
  commit;
end;

This example will produce output like the following:

{
 "greeting": "Hello ",
 "links": [
  {"rel": "collection", "href": "https://oow17.dbtools.local:8443/ords/tickets/greetings/"}
 ]
}

Note how the value of the greeting property is just Hello , the value of the :current_user implicit parameter is null because no user has been authenticated, since this resource is currently public.

Let’s make the resource protected, by defining a privilege to protect it:

declare
 l_priv_roles owa.vc_arr;
 l_priv_patterns owa.vc_arr;
begin
  l_priv_patterns(1) := '/greetings/*';

  ords.define_privilege(
      p_privilege_name     => 'protected.greetings',
      p_roles              => l_priv_roles,
      p_patterns           => l_priv_patterns
  );
  commit;
end;

We declare two arrays to hold the role name and privilege patterns respectively.
We want any authenticated user to be able to access the protected resource so we leave the roles array (l_priv_roles) empty. An empty role set implies any authenticated user can access a privilege.
We want any resource under /greetings/ to be protected so we add a single pattern: /greetings/* to the privilege patterns array.

Let’s try accessing the protected resource again:

https://server:port/ords/<schema>/greetings/example

This time we access the resource we see a 401 Unauthorized status and a prompt to sign in. If we sign in the resource we see will look like the following:

{
 "greeting": "Hello Colm",
 "links": [
  { "rel": "collection", "href": "https://oow17.dbtools.local:8443/ords/tickets/greetings/"}
 ]
}

This time there is an authenticated user - Colm in this case - and this value is bound to the :current_user implicit parameter, producing the greeting: Hello Colm.

Variously Noted

Oracle REST Data Services: Determining the Authenticated User

Introduction

Example