ORDS Authentication and Authorization

Security is not an add-on for APIs. The workshop shows the mechanisms ORDS provides, how to connect external identity providers and how to keep permissions consistent all the way into the database.

Audience

Developers, architects and security officers for ORDS-based APIs.

Modules

The modules are building blocks. You choose and weight them, and we agree on the agenda together beforehand.

• Fundamentals: authentication and authorization, threat model for database APIs
• ORDS privileges and roles: protecting endpoints, assigning roles
• OAuth2 in ORDS: client credentials, authorization code, token lifetime
• JWT and external identity providers: Entra ID, Keycloak, OCI IAM identity domains
• Authorization in the database: evaluating claims, setting context, VPD and Real Application Security
• APEX and ORDS together: sessions, single sign-on, shared role models
• Hardening: CORS, TLS, rate limiting via gateways, logging and audit

REST-Lib

Every ORDS workshop includes my REST-Lib: a PL/SQL library that standardizes recurring tasks such as response formats, error handling and parameter validation. It is handed over to your team together with the materials.

Outcome

A security concept for your APIs and a reference implementation with your identity provider.

Preview

For a first look: the talks on this topic give you an overview, and the talk pages include the slides.

• Advanced API Development with ORDS SOUG Day Zurich 2025