customPart 3: The Custom Gate — Building a Custom Authentication Scheme

Cover Image

Welcome back, Gatekeeper.

We’ve learned to use the security guards provided by APEX and our company’s Active Directory. But what happens when the security rules are truly unique?

• You need to check a user’s subscription status in a custom table before they can log in.
• You want to implement rock-solid Two-Factor Authentication (2FA).
• You’re migrating a legacy system with its own user table and password rules.

For these situations, you can’t just hire a guard — you have to be the architect.

It’s time to master the most powerful and flexible option in our toolkit: the Custom Authentication Scheme.

The Blueprint: The Custom User Table

Our custom gate needs a list of authorized users. It starts with a dedicated table in our database:

CREATE TABLE app_users (
    user_id          NUMBER GENERATED BY DEFAULT ON NULL AS IDENTITY,
    username         VARCHAR2(100) NOT NULL UNIQUE,
    password_hash    VARCHAR2(255) NOT NULL, -- CRITICAL: Never store plain text passwords!
    user_role        VARCHAR2(20)  DEFAULT 'USER',
    is_active        VARCHAR2(1)   DEFAULT 'Y',
    tfa_code         VARCHAR2(6),   …