Two-Factor Authentication - Expert Oracle and Java Security - page 192

sent. We will add these to your organization's Windows domain name that we set for SSO as items that
you need to edit in OracleJavaSecure.java before compiling. See Listing 9-17.
 Note Edit the code found in the file named Chapter9/orajavsec/OracleJavaSecure.java.
Listing 9-17. Set Company Specific Mail and Paging Addresses
private static String expectedDomain = "ORGDOMAIN";
private static String comDomain = "org.com";
private static String smtpHost = "smtp." + comDomain;
private static String baseURL =
" http://www.org.com/servlet/textpage.PageServlet?ACTION=2&PAGERID=";
private static String msgURL = "&MESSAGE=";
Compile Two-Factor Delivery Route Codes: Binary Math
We assemble a single code to represent the compilation of delivery routes selected for transmitting the
two-factor authentication code. For each route selected, we add a constant value (static final) to our
cumulative distribution code. At the end of processing, the single code represents all routes that were
used. Like bits in a byte (eight bits, each with a value double the previous, represent 256 unique values),
we use binary math to accumulate our distribution code. The initial constants are listed in Listing 9-18.
Listing 9-18. Delivery Route Constants
private static final int USE_PAGER = 1;
private static final int USE_SMS = 2;
private static final int USE_EMAIL = 4;
Table 9-1 lists how the sums represent all the different combination of delivery routes. Notice that
the maximum value is one less than double the largest value (7 is the max value, which is one less than
double 4, the largest constant).
If you haven't already guessed, the next constant would have the value of 8, then 16 and 32. We have
only sized the distrib_cd column in the t_two_fact_cd_cache table to hold 2 digits, so we are limited to
those six constant values. The maximum sum of those six constants is 63. The next, seventh constant
would be 64, but a max sum including that value would be 127, a three-digit value.
Exploring a Method to Distribute the Two-Factor Codes
When we defined the f_send_2_factor Oracle function earlier, we noted that it simply calls the
distribute2Factor() Java method: it is a pass-through Oracle function, as most Java stored procedures
are. The reasoning is a bit esoteric. You see, we are already executing on Oracle database, and in the
middle of running the p_check_hrview_access procedure when we call f_send_2_factor . Why not just
call the Java distribute2Factor() method from p_check_hrview_access ? That would be a nice capability,
but it is not available. We need to approach the Oracle JVM through a dedicated Java stored procedure
that is declared AS LANGUAGE JAVA . We cannot mix PL/SQL with a Java call in the same function or