Apps 11i login and logout flow

I have tried to bisect the login flow of Apps 11i here.

First step is URL: http://www.justanexample.com:8080

Once you type or use your browser favorites button to navigate to this URL,

1. The request goes from your browser,

2. The name www.justanexample.com is resolved to an IP, first by referring to c:\windows\system32\drivers\etc\hosts file on your Windows PC, and then by querying the DNS server.

3. Once the IP address is obtained, the request travels over TCP/IP protocol on network and connects to port 8080 on which Apache Server is running.

4. Apache server then displays the Oracle Applications Rapid Install Portal page ($COMMON_TOP/portal/$CONTEXT_NAME/index.html) which has links for Rapid Install Setup home, Apps Logon links(aplogon.html), 11i online help, and machine admin scripts on the left sidebar(appdet.html).

5. When you click on Apps Logon links, it shows links for Oracle E-Business Home Page and OAM on the right pane.

6. Once you click on the Oracle E-Business Home Page link, the request is forwarded by Apache to Jserv. Jserv sends it to Appslogin servlet

7. AppsLogin servlet

The AppsLogin servlet supercedes older Release 11i login mechanisms and certain product-specific login pages. The AppsLogin servlet detects the login mode by reading the "Applications SSO Type" profile option for the current Oracle E-Business Suite Release 11i instance and transparently redirects to the appropriate login page.

• Scenario 1: AppsLogin running on a Release 11i instance configured for Self-Service Web Applications (SSWA) will authenticate the user via the AppsLocalLogin.jsp page, and then redirect to the configured home page specified in the Self Service Personal Home Page mode profile option.
• Scenario 2: AppsLogin running on a Release 11i instance configured for Single Sign-On will redirect to the Single Sign-On 10g login page for user authentication, and then redirect to the configured home page specified in the Self Service Personal Home Page mode profile option.

• Scenario 3: AppsLogin running on a Release 11i instance configured for Single Sign-On and Portal will redirect to Single Sign-On 10g login page for user authentication, and then redirect to the default Portal home page.

/oa_servlets/Appslogin servlet
Gets WebAppsCOntext
Sets requestURL = APPSHOMEPAGE unless passed as a parameter.
Sets cancelUrl = oracle.apps.fnd.sso.SSOManager.getLoginUrl(); unless passed as a parameter.
This finds profile option APPS_SERVLET_AGENT (Apps Servlet Agent) and returns error if it cannot get this profile option.
Sets variable "url" using oracle.apps.fnd.sso.SSOManager.getLoginRedirectUrl
sets Mode using Utils.getSSOMode()
which gets profile option APPS_SSO (Applications SSO Type) SSWA is set by default if not profile option.
Depending on mode, sets url = LOCAL_LOGIN | SSO_LOGIN_REDIRECT | PORTAL
if SSWA = SSOUtil.getLocalLoginUrl()
This gets profile option APPS_LOCAL_LOGIN_URL (Applications Local Login URL) (AppsLocalLogin.jsp for example) and prepends '/OA_HTML/'
if PORTAL = SSOUtil.getPortalUrl()
This gets profile option APPS_PORTAL (Applications Portal) This is full URL normally pointing to /pls/XXX_portal30/portal30.home
Then calls "constructUrl" to determine the URL to return, which builds URL consisting of url, requestURL, cancelURL, errCode, langCode, errText and home_url parameters
If "url" is null, then returns FND-9930 error code, otherwise will redirect to the constructed URL
At this point, we have got as far as rendering the Username/PAssword entry screen... /OA_HTML/AppsLocalLogin.jsp or portal30.home

/OA_HTML/AppsLocalLogin.jsp
Gets Profile options FND_BRANDING_SIZE (FND: Branding Size) and ICX_LANGUAGE (ICX: Language)
Sets up some message text (Message.class) Uses Package FND_MESSAGE.GET_MESSAGE_INTERNAL ()
Once we click "Login" button we follow through as below:-


fndvald.jsp
Utils.getConnection() - this throws FND-9902 if cannot get DB connection.
SessionMgr.createAppsSession which itself calls wctx.getSessionManager().validateLogin followed by createSession if username.password validated OK.
There is some STATEMENT level diagnostics messages from here (for oracle.apps.fnd.sso.SessionMgr)
Gets Cookie name from dbc file ICX_COOKIE_NAME or otherwise calls package FND_SESSION_MANAGEMENT.getsessioncookiename
Creates SSO Cookie for new user session
If requestURL = APPSHOMEPAGE it calls SSOUtil.getHomePage otherwise just passes requestURL through...
This calls computeURL, which looks for profile option APPLICATIONS_HOME_PAGE (Self Service Personal Home Page mode)
Runs getEnvStore90.getEnv(ICX_PV_SESSION_MODE) which I dont understand... but seems to be 115P | 115J ?
If APPLICATIONS_HOME_PAGE = "PHP" or "PHP_FWK" then will set URL = PLSQL_AGENT/OracleNavigate.Responsibility
else (for example "FWK") will set URL = "/OA_HTML/OA.jsp?OAFunc=OAHOMEPAGE&dbc=" + AppsAgent.getDBC()


OA.jsp
oracle.apps.fnd.framework.webui.OAPageBean.class
oracle.apps.fnd.framework.webui.OAJSPHelper
Uses OAJSPHelper to set character encoding for the session, mainly by getting ICX_CLIENT_IANA_ENCODING (ICX: Client IANA Encoding) profile option
Then sets redirectURL = pageBean.preparePage
Sets flag for Portlet or not
Sets functionName from the parameters in the URL (OAHOMEPAGE for example, if URL param is ?OAFunc=OAHOMEPAGE)
Sets redirectURL = preparePage() method... this calls "redirectURL = validateUser()" but I think this should return null if I have logged in (this seems to be to do with bookmarkable URLs)
sets funcURL = createRFURL()
This does some session validation, then calls OAPageContextImpl.createRFURL
Which calls FunctionSecurity.getFunction and Function.getFunction...
This bit runs SQL to find FunctionID "select function_id from fnd_form_functions where function_name = :1"
Then "select function_name, context_dependence, maintenance_mode_support, parameters, type, web_agent_name, web_host_name, web_html_call, web_icon, form_id from fnd_form_functions where function_id = :1"
For OAHOMEPAGE the following will be set
web_html_call = "OA.jsp?page=/oracle/apps/fnd/framework/navigate/webui/HomePG&homePage=Y&OAPB=FWK_HOMEPAGE_BRAND"
type = "JSP"
isOAFCall is set to TRUE (as the URL has OA.jsp in the URL)
funcCall = web_html_call
hasTransactionId = FALSE
so adds "&transactionid=xxx" to the funccall then returns this as the new url
This new URL is returned to OA.jsp as the redirectURL, so we call OA.jsp with some different parameters.....

By now, we should have URL something like:
OA.jsp?page=/oracle/apps/fnd/framework/navigate/webui/HomePG&homePage=Y&OAPB=FWK_HOMEPAGE_BRAND&transactionid=xxxxxxx
Back into "redirectURL = pageBean.preparePage()"
regionCode = OAPageContextImpl.getUrlParameter(request, "page") (page=/oracle/apps/fnd/framework/navigate/webui/HomePG)
//Get the application module java class from AK.
OAApplicationModule staticAppMod = OAJSPApplicationRegistry.getStaticAKApplicationModule(mRequest);
This creates AM called "oracle.apps.fnd.framework.server.OAApplicationModule" with DB connection.
Creates MDS context, seems to have handles to MDS repository.
Gets page region, using WebBeanTypeData, from MDS repository.
Gets transaction_ID
Get profile option "FND_FORCE_PAGE_REFRESH"
Get profile option "FND_CUSTOM_OA_DEFINTION"



portal30 HOME procedure
Does a owa_util.redirect_url to wwpob_page_util.get_page_url (wrapped PLSQL)



Check versions
Java
(adident Header $OA_JAVA/)
oracle/apps/fnd/sso/AppsLogin.class
oracle/apps/fnd/sso/SSOManager.class
oracle/apps/fnd/sso/Utils.class
oracle/apps/fnd/sso/SSOUtil.class
oracle/apps/fnd/common/Message.class
oracle/apps/fnd/sso/SessionMgr.class
oracle/apps/fnd/common/WebAppsContext.class
oracle/apps/fnd/framework/webui/OAPageBean.class
oracle/apps/fnd/framework/webui/OAJSPHelper.class
oracle/apps/fnd/framework/webui/OAWebBeanConstants.class
oracle/apps/fnd/framework/webui/OAPageContextImpl.class
oracle/apps/fnd/framework/OAFwkConstants.class
oracle/apps/fnd/functionSecurity/Function.class

oracle/apps/fnd/framework/mds/OAMDSContextUtils.class


JSP
(adident Header $OA_HTML/)
AppsLocalLogin.jsp
fndvald.jsp
OA.jsp


Logout flow

Logging out from Apps 11i

Logging out starts with the logout link on the framework page. This comes from the function "ICX_LOGOUT" call from the global menu ICX_GLOBAL_MENU
/OA_HTML/OALogout.jsp

This calls SSOManager.java which sets the logoutURL = "/oa_servlets/oracle.apps.fnd.sso.AppsLogout" then OALogout.jsp redirects to this URL
AppsLogout.java

Calls "oracle.apps.fnd.sso.SSOManager.getLogoutRedirectUrl" to determine URL which it then redirects to SSOManager.java

getLogoutRedirectUrl checks the ICX_SESSIONS.MODE_CODE of the session (whether SSWA or PORTAL) 115P = SSWA
This determines whether to use
LOCAL_LOGOUT (AppsLocalLogout.jsp)
or
SSO_LOGOUT_REDIRECT (oracle.apps.fnd.sso.FNDSSOLogoutRedirect)
AppsLocalLogout.jsp

If no "returnURL" is passed in and APPS_SSO_POSTLOGOUT_HOME_URL is not set, then it calls SSOUtil.getLocalLoginUrl (However see bug Bug 6175894 below)
SSOUtil.java

getLocalLoginUrl picks up the profile option APPS_LOCAL_LOGIN_URL (AppsLocalLogin.jsp) and redirects
PHP Logout Flow

1. "GET /OA_HTML/OALogout.jsp?menu=Y HTTP/1.1" 302 271
2. "GET /oa_servlets/oracle.apps.fnd.sso.AppsLogout HTTP/1.1" 302 296
3. "GET /OA_HTML/AppsLocalLogout.jsp?returnUrl=/OA_HTML/AppsLocalLogin.jsp?cancelUrl=/OA_HTML/AppsLocalLogin.jsp HTTP/1.1" 302 331
4. "GET /OA_HTML/AppsLocalLogin.jsp?cancelUrl=/OA_HTML/AppsLocalLogin.jsp&langCode=US&username=SYSADMIN HTTP/1.1" 200 8443

SSO Logout Flow

1. "GET /OA_HTML/OALogout.jsp?menu=Y HTTP/1.1" 302 267
2. "GET /oa_servlets/oracle.apps.fnd.sso.AppsLogout HTTP/1.1" 302 345
3. "GET /oa_servlets/oracle.apps.fnd.sso.FNDSSOLogoutRedirect?returnUrl=http%3A%2F%2FmyHost.uk.oracle.com%3A80%2Fo a_servlets%2Foracle.apps.fnd.sso.AppsLogin%3FlangCode%3DUS HTTP/1.1" 302 385
4. "GET /OA_HTML/SSOAppsLogout.jsp HTTP/1.1" 200 209
5. "GET /oa_servlets/oracle.apps.fnd.sso.AppsLogin?langCode=US HTTP/1.1" 302 444
6. "GET /oa_servlets/oracle.apps.fnd.sso.FNDSSOLoginRedirect?requestUrl=APPSHOMEPAGE&cancelUrl=http%3A%2F%2FmyHost.uk.oracle.com%3A80%2Foa_servlets%2Foracle.apps.fnd.sso.AppsLogin&langCode=US&s=93DE6C66677A82FC0DB9AEC95EDD0A5AF37A949D37 HTTP/1.1" 302 684

Related Profile options

* Applications Login Server Logout (APPS_LS_LOGOUT) Default = null
* Applications Portal Logout (APPS_PORTAL_LOGOUT) Default = null
* Applications SSO Post Logout URL (APPS_SSO_POSTLOGOUT_HOME_URL) Default = null
* Applications Local Login URL (APPS_LOCAL_LOGIN_URL) Default at Site level = AppsLocalLogin.jsp)