Application Authorization - Expert Oracle and Java Security - page 251

connect through the application user associated with the secure application role. If they have access to
the data, do we really want to be bothered with controlling how they get there? I don't think so.
If two applications see different data, then they should have different application IDs and different
application users and roles.
Call to Get Application Connections
The first time we call getAppConnections() from a specific application there will be no list of connection
strings stored in Oracle database for us to retrieve. That is almost an ancillary concern, because we will
be turned back earlier in the process when a two-factor code is generated and sent to us.
So, even the second time we call getAppConnections() , we will get a null in return from Oracle, and
we will set our list of connection strings to a new, empty HashMap . This will be the case until we have
called putAppConnections() for this application. However, we can use the application in this state by
pushing connection strings into the list for our own, local use as shown in Listing 10-50.
Listing 10-50. Test Call to getAppConnections() and Put Connections in Local List
getAppConnections();
// Go no further until we have a two-factor Auth Code
if( twoFactorAuth == null || twoFactorAuth.equals( "" ) ) return;
System.out.println( "connsHash.size = " + connsHash.size() );
putAppConnString( "Orcl", "hr",
"password", "localhost", String.valueOf( 1521 ) );
putAppConnString( "Orcl", "appusr",
"password", "localhost", String.valueOf( 1521 ) );
Send List of Connection Strings to Oracle Database for Storage
Storing our list of connection strings in Oracle database is a task we will only need to do periodically, as
we change our application passwords. We will do it here in Listing 10-51 to save the initial set of
connection strings (from Listing 10-50) with a call to putAppConnections() .
Listing 10-51. Send Connection String List to Oracle
putAppConnections();
Get a Unique Connection for Use in This Application
If we did not call getAppConnections() previously, it will be called automatically when we call
getAppAuthConn() (see Listing 10-52). This would be our instruction to application developers who want
to use our security structures—just call getAppAuthConn() . Note that by getting this application-specific
connection, we will no longer be able to use the original appver connection to do putAppConnections() .
Listing 10-52. Get and Use a Specific Oracle Connection for This Application
getAppAuthConn( "orcl", "appusr" );
mStmt = conn.createStatement();
rSet = mStmt.executeQuery( "SELECT SYSDATE FROM DUAL" );
if ( rSet.next() )