Oracle Access Manager Authentication Model

In this post, I will talk about the top down authentication flow that starts from a URL and goes all the way down to an authentication plug in which handles the authentication and authorization logic.

1. To start with when a user enter a URL and requests for a resource.
2. Web gate intercept and looks for that URL  in the application domain. 
3. Remember that application domain is tightly coupled to the Web gate.
4. Web gate matches all the URL or resources to say and matches with closest resource defined.
5. Next it looks for authentication scheme that is defined to protect that resource.
6. Authentication scheme in turn invokes Authentication module that is defined. 
7. It is here that you can define identification, Authentication, success, failure or any other steps or work flow that you want.
8. Authentication module finally invokes Authentication plug in that points to a java code that performs the Auth or any other logic that you want to perform. 
9. You can pass in input parameters and get back the response.
10. Auth Module can point to multiple Auth plug in at various steps that it defines.
11. Auth Scheme defines things like form based, cert based or any other kind of Auth and what forms and Context that it will present. It also defines OAM server details as that is the one where Auth session is checked and kept for further requests.