Question

I’m developing a java web application which uses Oracle. Web app uses Glassfish AS and connects to Oracle through a configured connection pool.

The customer requirements for performing user authentication is to try to create oracle session under user login/password provided, and if that succeeds, user is successfully logged on.

The first idea comes into my mind is write a function that takes login/password, perform hashing and compare hash with stored one. But I’m afraid, if I do that, I have some pitfalls like hash algorithm can change anytime, oracle account can be locked so I have to perform additional checks and so on.

Could anyone advice me reliable way to check oracle user authentification except of creating session to Oracle?

Answer 1

I’ve solved the problem by parsing glassfish domain configuration file $GLASSFISH_ROOT/domains/domain1/domain.xml with the following code:

 private String getGlassfishConfigParameterJdbcUrl() {
    String instanceRoot = System.getProperty("com.sun.aas.instanceRootURI");
    URI configUri = null;
    try {
        configUri = new URI(instanceRoot);

        File configFile = new File(configUri.getPath(), "config" + File.separator + "domain.xml");
        XmlNode node = XmlNode.fromFile(configFile);
        return node.getNode("domain/resources/jdbc-connection-pool[@name=\"GLASSFISH_DB_POOL_NAME\"]/property[@name=\"URL\"]").getAttribute("value");
    } catch (URISyntaxException e) {
        throw new RuntimeException(e);
    }
}

XmlNode is my utility class for xml parsing.