Application Authorization - Expert Oracle and Java Security - page 248

raise a NO_DATA_FOUND exception, which we log here and report back to the application. In both these
error cases, we exit without returning a list of connection strings.
The getCryptConns() method is called from the f_get_crypt_conns Java stored procedure.
f_get_crypt_conns passes the application ID object through from p_get_app_conns (Listing 10-46) to
Java on Oracle database.
In getCryptConns() method, we will get the connsHash object that is associated with the application
ID object from the v_app_conn_registry view. Then we will encrypt each clear-text connection string in
the connsHash before delivering it to the client, via the p_get_app_conns procedure.
This is the third of three methods we discuss that evoke “unchecked” warnings from the Java
compiler. Here we cast the alleged connsHash object coming out of v_app_conn_registry , sight unseen, as
a HashMap<String, String> . We also presume the application ID object provided to us is an
implementation of RevLvlClassIntfc , on which we call the getRevLvl() method. Both of those actions
are questionable in the eyes of the compiler, but we know all the parties involved and are doing what we
truly want.
This method, getCryptConns() mirrors the functionality we've already discussed in
setDecryptConns() . We are going to skip the description of the inner workings, except that we will point
out the code used to encrypt each connection string in Listing 10-47. Recall that the connsHash stored in
Oracle Database is stored in clear-text form, as a HashMap<String, String> , clearConnsHash . We use the
session secret password key to encrypt the connection strings and place them in a new HashMap<String,
RAW> , cryptConnsHash . Oracle database returns the encrypted connection strings to the client
application.
Our Cipher is set to encrypt mode. Then we walk through all the keys in clearConnsHash using the
for each syntax.
Listing 10-47. Encrypt Each Connection String in the List
cipherDES.init( Cipher. ENCRYPT_MODE , sessionSecretDESKey, paramSpec );
for( String key : clearConnsHash.keySet() ) {
// Encrypt each one
cryptConnsHash.put ( key ,
new RAW (
cipherDES.doFinal(
( clearConnsHash.get( key ) ).getBytes()
)
)
);
}
The stacked method calls get the connection string from clearConnsHash that is associated with the
key we got in the for each loop. We pass that String to cipherDES for encryption using the secret
password key. We then create a new RAW from those encrypted bytes, and we put the RAW into
cryptConnsHash , keyed with the same key value. At the end of this method, we will return cryptConnsHash
from Oracle Database to the client application.
Test Application Authentication, Phase 1
As in the last chapter, here again we need to edit the code to provide our company-specific addresses for
two-factor authentication.