Retrieve User's Password in Oracle Apex (v21.1)

Question

Since my 2 post about the LDAP Authentication (first post, second post), we created our own custom authentication scheme and function to connect to the application using our Active Directory credentials.

We can successfully log in the application. However, we have a second function which retrieves the group of the user in the AD. Here's the code when I'm trying to retrieve the group into a Text Field (P1_GROUP) :

ourschema.ldap_get_group_apex_from_user(
    p_username => v('APP_USER'),
    p_password => 'thepassword')

As you can see, this is working, because the password is in static text. This leads me to my main question :

How to retrieve the user's password in Oracle Apex, and what is the most secure way ?

I tried to set a Branch or a Process in the Log-In page while redirecting the user's the the home page, and Set Value of the :P9999_PASSWORD field to the home page text field P1_PWD.

So, I tried to adapt my code with the text field

ourschema.ldap_get_group_apex_from_user(
    p_username => v('APP_USER'),
    p_password => :P1_PWD)

Unfortunately, this doesn't seems secure because the password would be visible in the HTML code of the page (right click + inspect and there it is. Moreover, sometimes it gives me an error

Error computing item source value for page item P1_GROUP

It seems like the application cannot execute the function because the password is still not initialized.

Is there a way to retrieve :P9999_PASSWORD or to transfer it from the login page to a global variable/global page or a text field ? Or is there a function to retrieve the current user's password ?

Thank you again for your time, do not hesitate to ask for more details as this is a very specific case,

Thomas

user_23669 · Answer

I don't think your approach is correct. Ideally, even an administrator of your system should not be able to decrypt a user's passwords; they should be stored as hashes.

You're trying to look up the user's group memberships? You don't need the user's own credentials to do that. Use a dedicated account that has access to your Active Directory system and store that password encrypted in your database. Use that account to search for and look up the user's group memberships. That way, even if your system is compromised, only that account is exposed.

user_16453533 · Answer

Thank you all for your answers and your advices on my case, and for taking the time to help.

We found a solution that we think is reliable, here's what we did if that could help other people.

We created a global variable G_GROUP, which will receive the group of the user
On the login page, we created a process before the login process.
Set the Source of the Process to PL/SQL Code :

:G_GROUP := pdbadmin.ldap_get_group_apex_from_user( --our custom function to retrieve groups
    p_username => :P9999_USERNAME,
    p_password => :P9999_PASSWORD); -- the function get the username and password in the fields

If i want to display the group of the user in the main page, let's create a Text Field P1_GROUP which as for Source the PL/SQL Expression :G_GROUP

Our group is initialized, and the password is not shown in any field.

Let me know what you think about it, and if you guys think this could be improved.

Retrieve User's Password in Oracle Apex (v21.1)

2 Answers