2.4 Managing Instance Settings

2.4.1.1 Disabling PL/SQL Program Unit Editing

By default, developers can change and compile PL/SQL source code when browsing database procedures, packages, and functions in Object Browser. As an Instance administrator, you can control PL/SQL program unit editing for an entire instance by making a selection from Allow PL/SQL Program Unit Editing.

To disable PL/SQL program unit editing:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Feature Configuration.

4. Locate the Application Development section.

5. For Allow PL/SQL Program Unit Editing, select No.

6. Click Apply Changes.

2.4.1.2 Disabling the Creation of Demonstration Objects in a New Workspace

When an Instance administrator creates a new workspace, Oracle Application Express automatically creates sample applications within the workspace.

To disable the creation of sample applications:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Feature Configuration.

4. Locate the Application Development section.

5. For Create demonstration objects in new workspaces, select No.

6. Click Apply Changes.

2.4.1.3 Disabling the Creation of Websheet Objects

When an Instance administrator creates a new workspace, Oracle Application Express automatically creates sample Websheet objects within the workspace.

To disable the creation of sample Websheet objects:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Feature Configuration.

4. Locate the Application Development section.

5. For Create Websheet objects in new workspaces, select No.

6. Click Apply Changes.

2.4.1.4 Enabling and Disabling SQL Access in Websheets

An Instance administrator can control the ability to use the SQL tag and the ability to create SQL reports in Application Express Websheets. When disabled, all Websheet applications in all workspaces in the instance are prevented from using the SQL tag or creating SQL reports.

To control SQL access in Websheets:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Feature Configuration.

4. Locate the Application Development section.

5. For Enable SQL and PL/SQL Access in Websheets, select Yes or No.

6. Click Apply Changes.

2.4.1.5 Configuring Packaged Application Installation Options

When installing a packaged application, Instance administrators can specify a number of installation options.

To configure packaged application installation options:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Feature Configuration.

4. Under Packaged Application Install Options, select Yes or No for these options:

   • Allow HTTP Header Variable authentication - Select Yes to enable HTTP Header Variable authentication when installing a packaged application. Otherwise, select No.

   • Allow LDAP Directory authentication - Select Yes to enable LDAP Directory authentication. Otherwise, select No.

   • Allow Oracle Application Server Single Sign-On authentication - Select Yes to enable Oracle Application Server Single Sign-On authentication. Otherwise, select No.

5. Click Apply Changes.

2.4.1.6 Configuring SQL Workshop

As an Instance administrator, you can use the attributes under SQL Workshop to configure basic SQL Workshop behavior.

To configure SQL Workshop:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Feature Configuration.

4. Under SQL Workshop, enter the attributes described in Table 2-1.

   Table 2-1 SQL Workshop Attributes

   Attribute	Description
   SQL Commands Maximum Inactivity in minutes	Identify the maximum amount of time a transactional command in the SQL Command Processor waits before timing out.
   SQL Scripts Maximum Script Output Size in bytes	Identify the maximum amount of output a single SQL script can generate. SQL scripts are run from the SQL Workshop.
   SQL Scripts Maximum Workspace Output Size in bytes	Identify the maximum amount of space all scripts within a workspace may consume. SQL script results are the output generated when running SQL scripts from the Script Editor or from the SQL Scripts home page.
   SQL Scripts Maximum Script Size in bytes	Identify the maximum size of a SQL script used within the SQL Workshop.
   Enable Transactional SQL Commands	Select Yes to enable transactional SQL commands for the entire Oracle Application Express instance. Enabling this feature permits SQL Command Processor users to issue multiple SQL commands within the same physical database transaction. When you select Yes, an Autocommit check box appears on the SQL Command Processor page. By default, this option is set to No.

   
   

5. Click Apply Changes.

2.4.1.7 Enabling Database Monitoring

Setting Enable Database Monitoring to Yes enables monitoring within SQL Workshop. Before you can access the Database Monitoring page, an Instance administrator must enable database monitoring.

To enable database monitoring:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Feature Configuration.

4. Scroll down to Monitoring.

5. For Enable Database Monitoring, select Yes.

6. Click Apply Changes.

2.4.1.8 Enabling Application Activity Logging

Application Activity Logging controls how application activity is logged for all applications on this instance.

To configuring application activity logging:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Feature Configuration.

4. Scroll down to Monitoring.

5. For Application Activity Logging, select one of the following:

   • Use Application Settings (default) - Use the Logging attribute of each application to determine if activity is logged.

   • Never - Disable activity logging for all applications in the instance.

   • Always - Enable activity logging for all applications in the instance.

6. Click Apply Changes.

2.4.1.9 Enabling Application Tracing

Instance administrators can control whether developers or users can generate database trace files simply by specifying &p_trace=YES on the URL when displaying a page. The ability to generate a trace file is already controlled if the application has Debug enabled.

To control application tracing at the instance-level:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Feature Configuration.

4. Scroll down to Monitoring.

5. From Enable Application Tracing, select:

   • Yes - Any application which has Debug enabled can also generate a server-side database trace file for a page using &p_trace=YES on the URL. To learn more, see "Enabling SQL Tracing and Using TKPROF" in Oracle Application Express Application Builder User's Guide.

   • No - Tracing cannot be enabled for any application on the instance. If someone attempts to run an application with &p_trace=YES in the URL, the page renders but the request to generate the SQL trace file is silently ignored.

6. Click Apply Changes.

2.4.1.10 Enabling Service Requests

Controls the ability for workspace administrators to make service requests from Workspace Administration. Service Requests include the ability to request a new schema, request storage, or request termination of their workspace.

To enable service requests:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Feature Configuration.

4. Scroll down to Workspace Administration.

5. For Enable Service Requests, select Yes.

6. Click Apply Changes.

2.4.2.1 Turning Off Cookies Used to Populate the Login Form

Instance administrators can control if a convenience cookie is sent to a user's computer whenever a developer or administrator logs in to a workspace from the Application Express Login page.

If Set Workspace Cookie option is set to Yes, Oracle Application Express sends a persistent cookie that:

• combines the last used workspace name and user name

• has a lifetime of six months

• is read to populate the Application Express Workspace Login form (but not the Oracle Application Express Administration Services Login form)

To turn off cookies used to populate the login form:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Locate the Security section.

5. For Set Workspace Cookie, select No.

6. Click Apply Changes.

2.4.2.2 Disabling Access to Oracle Application Express Administration Services

Instance administrators can restrict user access to Oracle Application Express Administration Services and prevent a user from logging in to Oracle Application Express Administration Services. Disabling administrator login in production environments prevents unauthorized users from logging in to Application Express Administration Services and possibly compromising user login credentials.

To disable user access to Oracle Application Express Administration Services:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Locate the Security section.

5. For Disable Administrator Login, select Yes.

6. Click Apply Changes.

Setting this value and logging out prevents anyone from logging in to Oracle Application Express Administration Services.

2.4.2.3 Disabling Workspace Login Access

Developers and Workspace administrators log in to the Oracle Application Express development environment to access the Application Builder, SQL Workshop, Team Development and Administration.

To restrict access to these applications, select Yes from Disable Workspace Login. This option effectively sets a Runtime-Only environment while still allowing Instance administrators to log in to Instance Administration. Selecting Yes in production environments prevents developers from changing applications or data.

To disable user access to the Internal workspace:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Locate the Security section.

5. From Disable Workspace Login, select Yes.

   Selecting Yes prevents users from logging in to the Internal workspace.

6. Click Apply Changes.

2.4.2.4 Controlling Public File Upload

Use the Allow Public File Upload attribute to control whether unauthenticated users can upload files in applications that provide file upload controls.

To control file upload:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Locate the Security section.

5. From Allow Public File Upload, select one of the following:

   • Yes - Enables unauthenticated users to upload files in applications in the Internal workspace.

   • No - Prevents unauthenticated users from uploading files in applications in the Internal workspace.

6. Click Apply Changes.

2.4.2.5 Restricting User Access by IP Address

Instance administrators can restrict user access to an Oracle Application Express instance by creating a runtime setting named RESTRICT_IP_RANGE.

To restrict user access by IP address:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Locate the Security section.

5. For Disable Administrator Login, select No.

6. In Restrict Access by IP Address, enter a comma-delimited list of IP addresses. Use an asterisk (*) to specify a wildcard.

   You can enter IP addresses from one to four levels. For example:

   141, 141.* ...
   192.128.23.1 ...
   

   Note:

   When using wildcards, do not include additional numeric values after wildcard characters. For example, 138.*.41.2.

7. Click Apply Changes.

2.4.2.6 Configuring a Proxy Server for an Instance

You can configure an entire Oracle Application Express instance to use a proxy for all outbound HTTP traffic. Setting a proxy at the instance-level supersedes any proxies defined at the application-level or in web service references. If a proxy is specified, regions of type URL, Web services, and report printing will use the proxy.

To configure a proxy for an Oracle Application Express instance:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Locate the Security section.

5. In Instance Proxy, enter the address of the proxy to be used for the entire instance.

6. Click Apply Changes.

2.4.2.7 Requiring HTTPS

Secure Socktets Layer (SSL) is a protocol for managing the security of data transmitted on the Internet. For web applications, SSL is implemented by using the HTTPS protocol. Oracle recommends running Oracle Application Express applications using SSL (HTTPS protocol) to prevent any sensitive data from being sent over an unencrypted (cleartext) communication channel.

You can configure both your Oracle Application Express instance and all related applications to require HTTPS by configuring the Require HTTPS and Require Outbound HTTPS attributes.

Topics:

• Requiring HTTPS for an Instance

• Requiring HTTPS for Outbound Traffic

• Reversing Require HTTPS

• Reversing Require Outbound HTTPS

2.4.2.8 Controlling RESTful Access

Use the Allow RESTful Access attribute to control whether developers can expose report regions as RESTful services.

To enable RESTful Access:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Locate the RESTful Access section.

5. From Allow RESTful Access, select one of the following:

   • Yes - Enables developers to expose report regions as RESTful services.

   • No - Prevents developers from exposing report regions as RESTful services.

6. Click Apply Changes.

2.4.2.9 Configuring Session Timeout

Use the attributes under Session Timeout to reduce exposure to abandoned computers with an open web browser at the application level.

To manage session settings for an Oracle Application Express instance:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Under Session Timeout For Application Express, specify the following attributes:

   • Maximum Session Length in Seconds - Enter a positive integer to control how many seconds an application session is allowed to exist. This setting is superseded by the application-level setting. Leave the value null in order to revert to the default value of 8 hours (28800 seconds). Enter 0 to have the session exist indefinitely. This session duration may be superseded by the operation of the job that runs every hour which deletes sessions older than 12 hours.

   • Maximum Session Idle Time in Seconds - Enter a positive integer to control how many seconds a session may remain idle for Oracle Application Express applications. This setting is superseded by the application-level setting. Leave the value null in order to revert to the default value of 1 hour (3600 seconds). Set to 0 to prevent session idle time checks from being performed.

5. Click Apply Changes.

2.4.2.10 Excluding Domains from Regions of Type URL and Web Services

It is possible to restrict regions of type URL and Web services for the entire Oracle Application Express instance. The Instance administrator defines excluded domains and regions of type URL. If a web reference or region of type URL contains an excluded domain, an error displays informing the user that it is restricted.

To exclude a domain from regions of type URL and Web services:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. In Domain Must Not Contain, enter a colon-delimited list of excluded domains, for example:

   mycompany.com:yourcompany.com:abccompany.com
   

5. Click Apply Changes.

2.4.2.11 Configuring Login Controls

Instance administrators can configure how Oracle Application Express handles failed login attempts.

To configure general login controls:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Scroll down to General Login Control.

5. Under General Login Control:

   1. Delay after failed login attempts in Seconds - Enter a positive integer value for the delay in seconds between login attempts. Enter 0 to disable the countdown and enable immediate access. If the delay is greater than 0, Oracle Application Express always displays the countdown, even on the first login failure.

   2. Method for computing the delay - Select a method for computing the delay for failed logins. The computation methods are based on recent data in the Login Access Log. See item help for further details.

   3. Inbound Proxy Servers - Enter a comma-separated list of IP addresses for well known proxy servers, through which requests come in. Oracle Application Express uses this list to compute the actual client address from the HTTP Headers X-Forwarded-For and REMOTE_ADDR.

6. Click Apply Changes.

2.4.2.12 Enabling Login Controls for All Workspaces

By default, no login controls are enabled across an Oracle Application Express instance. Instance administrators can enable login controls for all accounts in all workspaces across an entire development instance. Account login controls include:

• Require user account expiration and locking

• Set up a maximum number of failed login attempts

• Set the lifetime of a password before prompted for a new one

If the Instance administrator does not enable login controls for an entire instance then each Workspace administrator can enable controls on a workspace-by-workspace basis. See "Enabling Account Login Controls for a Workspace".

Note that Account Login control applies to end-user accounts created using the Application Express end-user account management interface.

To enable login controls for all workspaces:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Scroll down to Workspace Login control.

5. Under Workspace Login Control:

   1. Require User Account Expiration and Locking - Select Yes to enable Application Express user account expiration and locking features across all workspaces in an instance. This selection prevents the same feature from being disabled at the workspace-level.

      Select No to relinquish control to each Workspace administrator.

   2. Maximum Login Failures Allowed - Enter a integer for the maximum number of consecutive unsuccessful authentication attempts allowed before a developer or administrator account is locked. If you do not specify a value in this field, the default value is 4.

      This setting applies to administrator and developer accounts. It does not apply to end user accounts.

      The value you enter is used as the default for the workspace-level Maximum Login Failures Allowed preference if the Workspace administrator does not specify a value. That preference is used for end-user accounts within the respective workspace.

   3. Account Password Lifetime (days) - Enter a number for the maximum number of days a developer or administrator account password may be used before the account expires. If you do not specify a value in this field, a default value is 45 days.

      This setting applies to accounts used to access the Application Express administration and development environment only. It does not apply to end user accounts.

      The value you enter is used as the default workspace-level End User Account Lifetime preference, if the Workspace administrator specifies no value. That preference is used for end-user accounts within the respective workspace.

6. Click Apply Changes.

2.4.2.13 About Strong Password Policies

Instance administrators can enable password policies for:

• All users across all workspaces (that is, Workspace administrators, developers, and end users).

  Instance administrators can set up restrictions for all users, including password characters, lengths, words, and differences in consecutive passwords.

• Users logging in to Oracle Application Express Administration Services.

  Turning on the strong password requirement for Oracle Application Express adds another layer of security to prevent hackers from determining an administrator's password. When this option is selected, passwords must meet these requirements:

  • consist of at least six characters

  • contain at least one lowercase alphabetic character, one uppercase alphabetic character, one numeric digit, and one punctuation character

  • cannot include the username

  • cannot include the word Internal

  • cannot contain any words shown in the Must Not Contain Workspace Name field in this section

2.4.2.14 Configuring Password Policies

To configure password policies:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. To set up a password policy for Workspace administrators, developers, and end users, scroll down to Workspace Password Policy and specify the attributes described in Table 2-2.

   Table 2-2 Workspace Password Policy Attributes

   Attribute	Description
   Minimum Password Length	Enter a number to set a minimum character length for passwords for workspace administrator, developer, and end user accounts.
   Minimum Password Differences	Enter a positive integer or 0. When users change their password, the new password must differ from the old password by this number of characters. The old and new passwords are compared, character-by-character, for differences such that each difference in any position common to the old and new passwords counts toward the required minimum difference. This setting applies to accounts for workspace administrators, developers, and end users.
   Must Contain At Least One Alphabetic Character	Select Yes to require that workspace administrator, developer, and end user account passwords contain at least one alphabetic character as specified in the Alphabetic Characters field.
   Must Contain At Least One Numeric Character	Select Yes to require that workspace administrator, developer, and end user account passwords contain at least one Arabic numeric character (for example, 0,1,2,3,4,5,6,7,8,9).
   Must Contain At Least One Punctuation Character	Select Yes to require that workspace administrator, developer, and end user account passwords contain at least one punctuation character as specified in the Punctuation Characters field.
   Must Contain At Least One Upper Case Character	Select Yes to require that workspace administrator, developer, and end user account passwords contain at least one uppercase alphabetic character.
   Must Contain At Least One Lower Case Character	Select Yes to require that workspace administrator, developer, and end user account passwords contain at least one lowercase alphabetic character.
   Must Not Contain Username	Select Yes to prevent workspace administrator, developer, and end user account passwords from containing the username.
   Must Not Contain Workspace Name.	Select Yes to prevent workspace administrator, developer, and end user account passwords from containing the workspace name, regardless of case.
   Must Not Contain	Enter words, separated by colons, that workspace administrator, developer, and end user account passwords must not contain. These words may not appear in the password in any combination of uppercase or lowercase. This feature improves security by preventing the creation of simple, easy-to-guess passwords based on words like hello, guest, welcome, and so on.
   Alphabetic Characters	Enter new or edit the existing alphabetic characters. This is the set of characters used in password validations involving alphabetic characters.
   Punctuation Characters	Enter new or edit existing punctuation characters. This is the set of characters used in password validations involving punctuation characters.

   
   

   Next, set up a password policy for Application Express service administrators.

5. Scroll down to the Service Administrator Password Policy and specify one of the following:

   1. Use policy specified in Workspace Password Policy - Applies the password rules specified in Workspace Password Policy to service administrator passwords.

   2. Use default strong password policy - Applies the default strong password policy to service administrator passwords. To learn more, see item Help.

6. Click Apply Changes.

2.4.2.15 Restricting Access to Oracle Application Express by Database Access Descriptor (DAD)

mod_plsql and the embedded PL/SQL gateway support a directive which enables you to name a PL/SQL function which is called for each HTTP request. You can use this functionality to restrict the procedures that can be called through the embedded PL/SQL gateway or mod_plsql. The function returns TRUE if the named procedure in the current request is allowed and FALSE if it is not allowed. You can use this function to enforce access restrictions for Oracle Application Express on a per-database access descriptor (DAD) basis.

Oracle Application Express ships with a request validation function named wwv_flow_epg_include_modules.authorize. This function specifies access restrictions appropriate for the standard DAD configured for Oracle Application Express.

During installation, the installer also creates a PL/SQL function in the Oracle Application Express product schema (APEX_040200). You can change and recompile this function to restrict access. The source code for this function is not wrapped and can be found in the Oracle Application Express product core directory in the file named wwv_flow_epg_include_local.sql. The source code is as follows

CREATE OR REPLACE FUNCTION
wwv_flow_epg_include_mod_local(
    PROCEDURE_NAME IN VARCHAR2)
RETURN BOOLEAN
IS  
BEGIN  
    RETURN FALSE; -- remove this statement when  
you add procedure names to the "IN" list
    IF UPPER(procedure_name) IN (
          '') THEN  
        RETURN TRUE;  
    ELSE  
        RETURN FALSE;  
    END IF;  
END wwv_flow_epg_include_mod_local;
/

To add names of procedures that should be allowed:

1. Remove or comment out the RETURN FALSE statement that immediately follows the BEGIN statement:

   ...
   BEGIN  
       RETURN FALSE; -- remove this statement when 
   you add procedure names to the "IN" list
   ...
   

2. Add names to the clause representing procedure names that should be allowed to be invoked in HTTP requests. For example to allow procedures PROC1 and PROC2 the IN list you would write IN ('PROC1', 'PROC2').

After changing the source code of this function, alter the Oracle Application Express product schema (APEX_040200) and compile the function in that schema.

To alter the product schema, APEX_040200

1. Log in to SQL Command Line (SQL*Plus) as SYS.

2. Alter the product schema (APEX_040200) by entering the following command:

   ALTER SESSION SET CURRENT_SCHEMA APEX_040200; 
   

3. Compile the function wwv_flow_epg_include_local.sql.

The wwv_flow_epg_include_mod_local function is called by Oracle Application Express's request validation function which itself is called by the embedded PL/SQL gateway or mod_plsql. The Oracle Application Express function first evaluates the request and based on the procedure name, approves it, rejects it, or passes it to the local function, wwv_flow_epg_include_mod_local, which can evaluate the request using its own rules.

When you create new Database Access Descriptors for use with Oracle Application Express, the request validation function directive should be specified. Specifically, the function wwv_flow_epg_include_modules.authorize should be named in the directive PlsqlRequestValidationFunction in the Database Access Descriptor entry in dads.conf.

If you have no additional restrictions beyond those implemented in the wwv_flow_epg_include_modules.authorize function, there is no need to take any action with respect to the source code for the wwv_flow_epg_include_mod_local function.

The PL/SQL Request Validation Function directive is only available in Oracle Application Server 10g and Oracle HTTP Server 11g or later, as well as the embedded PL/SQL gateway in Oracle Database 11g or later. This directive is not available in Oracle HTTP Server Release 9.0.3.

2.4.2.16 Defining Authorized URLs

In previous releases of Oracle Application Express, developers can use a URL as an argument in Oracle Application Express procedures that redirect to the defined URL. Examples include APEX_UTIL.COUNT_CLICK (p_url parameter) and WWV_FLOW_CUSTOM_AUTH_STD.LOGOUT (p_next_url parameter).

Instance administrators can define a list of authorized URLs. When a URL is provided as an argument to these procedures, it is verified internally against this list.

To manage the Authorized URLs list:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Security.

4. Click the Authorized URLs tab.

5. To add a new URL:

   1. Click Create.

   2. Authorized URL - Enter an authorized URL that can be used as the parameter value to certain Application Express procedures.

      The entire authorized URL value is compared with the URL parameter value in Oracle Application Express procedures. If there is an exact match up to and including the entire length of the Authorized URL value, then the URL parameter value is permitted.

   3. Description - Enter a description of the URL.

   4. Click Apply Changes.

6. To edit an existing URL:

   1. Click the Edit icon adjacent to the URL.

   2. Edit the Authorized URL and Description fields.

   3. Click Apply Changes.

7. To delete an existing URL:

   1. Click the Edit icon adjacent to the URL.

   2. Click Delete.

2.4.3.1 Enabling Self Service Workspace Provisioning

Use the Self Service section of the Instance Setting page to determine how the process of provisioning (or creating) a workspace works for your Oracle Application Express development instance.

In Manual provision mode, an Instance administrator creates new workspaces and notifies the Workspace administrator of the login information. In Request or Email Verification provision modes, users request workspaces directly in a self-service fashion. In this scenario, users use a link on the login page to access a request form. After the workspace request has been granted, users are automatically emailed the appropriate login information.

To specify a provisioning mode:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Instance Settings.

4. Locate the Self Service region.

5. Make a selection from Provisioning Status:

   • Manual - An Instance administrator manually creates new workspaces and notifies the Workspace administrator of the login information.

   • Request - Users request workspaces directly in a self-service fashion. Selecting this option displays a link on the Login page enabling users to request a workspace. When a user requests a workspace, each request is submitted to a queue for approval. When the request is approved, the user is sent an email containing login credentials (the workspace name, Username, and password).

   • Request with Email Verification - Works similar to Request except each user receives an initial email containing a verification link. Clicking this link validates the user's email address and then the request is processed. Then another email is sent to the user containing login credentials (that is, the workspace name, Username, and password).

6. For Require Verification Code, select Yes or No to specify whether a verification code is displayed and required for someone to request a new workspace.

7. If you select Request with Email Verification:

   • Require Verification Code - Determines if a verification code displays and is required during the request process. Select Yes or No.

8. For Notification Email Address, enter the email address to receive notification email messages for new workspace requests and change workspace requests. If not specified, no workspace request notification email messages is sent.

9. Click Apply Changes.

2.4.3.2 Disabling Email Provisioning

Use Email Provisioning to disable workspace provisioning when provisioning with Email Verification. Use the Message field to display a message to the user that explains why email provisioning is disabled.

To disable email provisioning:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Instance Settings.

4. From Email Provisioning, select Disabled.

   Selecting Disabled completely disables workspace provisioning when provisioning with Email Verification.

5. In Message, enter a message that explains why email provisioning is disabled.

6. Click Apply Changes.

2.4.3.3 Configuring Storage

Instance administrators can configure the following storage options: require a new schema when requesting a workspace, auto extend tablespaces, or delete uploaded files are a specified number of days.

Topics:

• Requiring a New Schema

• Enabling Auto Extend Tablespaces

• Enabling Bigfile Tablespaces

• Enabling Encrypted Tablespaces

• Deleting Uploaded Files

2.4.3.4 Configuring Email

To enable Oracle Application Express to send mail, an Instance administrator must configure email settings.

Additionally, if you are running Oracle Application Express with Oracle Database 11g or later, you must enable outbound mail. Starting with Oracle Database 11g Release 1 (11.1), the ability to interact with network services is disabled by default. For more information, see "Enabling Network Services in Oracle Database 12c" for your configuration scenario in Oracle Application Express Installation Guide.

Topics:

• Configuring Email in a Full Development Environment

• Configuring Email in a Runtime Environment

• Determining Email Settings in a Runtime Environment

2.4.3.5 Configuring Wallet Information

Secure Sockets Layer (SSL) is an industry standard protocol that uses RSA public key cryptography with symmetric key cryptography to provide authentication, encryption, and data integrity. When SSL is enabled, https displays in the URL.

If you call a SSL-enabled URL (for example, by invoking a Web service), or create a region of type URL that is SSL-enabled, you must create a wallet. A wallet is a password-protected container that stores authentication and signing credentials (including private keys, certificates, and trusted certificates) needed by SSL.

Topics:

• Creating a Wallet

• Configuring a Wallet in a Full Development Environment

• Configuring a Wallet in a Runtime Environment

• Determining Wallet Settings in a Runtime Environment

2.4.3.6 Configuring Report Printing

Oracle Application Express provides several features so that end users can download and print reports in various formats, including PDF. To set up this functionality, different users must configure the following printing settings:

1. Site Level: Instance administrators must specify the level of functionality (Standard or Advanced) for an entire Oracle Application Express instance, as described in this section.

2. Application Level: Workspace administrators and developers can define Report Queries and Report Layouts. Report Queries and Report Layouts are stored under Shared Components and are not tied to a specific page.

3. Page/Region Level: Developers can edit the Report regions on specific pages to enable printing. This, in turn, enables end users to print regions as reports in various formats. See "Configuring Classic Report Region Print Attributes" in Oracle Application Express Application Builder User's Guide.

Topics:

• Configuring Report Printing in a Full Development Environment

• Configuring Report Printing Settings in a Runtime Environment

• Determining Report Printing Settings in a Runtime Environment

2.4.3.7 Configuring Online Help

Developers can access the Oracle Application Express online documentation library by clicking the Help link in the upper right corner of the Oracle Application Express development environment. Instance administrators can redirect this Help link by configuring the Help URL attribute.

To configure the location of Oracle Application Express Help link:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Instance Settings.

4. Scroll down to Help.

5. In Help URL, edit the URL. This URL displays when users click the Help link from within Oracle Application Express.

6. Click Apply Changes.

2.4.3.8 Configuring Workspace Size Options for Requests

Instance administrators can configure the workspace sizes available when users request:

• a new workspace and schema

• additional space for an existing workspace

To configure workspace size options:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Instance Settings.

4. Scroll down to New Workspace Request Size and Workspace Change Request Size. Specify the following:

   • Size in Megabytes - Edit the default numbers to change the size options.

   • Display - Select Yes for all the size options you want to appear in the select list for workspace size.

   • Default - Select the default value to appear in the storage field for workspace and change requests.

5. Click Apply Changes.

2.4.3.9 Managing Application ID Range

Instance administrators can control the range for IDs of new database or Websheet applications. If you separate ID ranges in large multi-instance installations, you can easily move workspaces between the instances and keep their application IDs. To enable ID ranges, you must specify at least an ID Minimum.

To configure the application ID ranges:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Instance Settings.

4. Scroll down to Application ID Range and specify the following:

   • ID Minimum - Enter the lower range for database and Websheet application IDs.

   • ID Maximum - Enter the maximum range for database and Websheet application IDs.

5. Click Apply Changes.

2.4.4.1 Defining an Agreement

When users run the New Service Signup Wizard, Instance administrators can require they accept an agreement before the wizards submits the service request.

To include and define an agreement:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Manage New Service Signup Wizard.

4. For Enable Agreement:

   • Yes - Includes the agreement you define when users run the New Signup Service Wizard.

   • No - Excludes the agreement you define when users run the New Signup Service Wizard.

5. In Agreement Text, enter the text of the agreement

6. Click Apply Changes.

2.4.4.2 Defining a Signup Survey

Instance administrators can also include survey questions users must complete when running the New Service Signup Wizard.

To include and define a survey:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Manage New Service Signup Wizard.

4. Scroll down to Survey Questions.

5. For Enable Survey:

   • Yes - Includes the survey questions you define when users run the New Signup Service Wizard.

   • No - Excludes the survey questions you define when users run the New Signup Service Wizard.

6. Under Question, enter questions and answers.

   Enter all answers for each question in one field, delimited by a new line. Use the Pre Text and Post Text fields to include introductory and closing text.

7. Click Apply Changes.

2.4.5.1 Configuring Workspace Purge Settings

To configure workspace purge settings:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Instance Settings, click Workspace Purge Settings.

4. On the Workspace Purge Settings, configure the following:

   1. Enabled - Select Yes to enable the workspace purge process. Select No to disable the workspace purge process.

   2. Language - Select the language of the text of emails sent to workspace administrators of inactive workspaces. Note that only one language can be selected for each instance.

   3. Purge Administration Email Address - Enter the email address (or From address) from which emails are sent to workspace administrators.

   4. Send Summary Email To - Enter a list of email addresses separated by commas. Recipients will receive a daily email summary of the purge process.

   5. Days Until Purge - Enter the number of days before a workspace is physically purged. For example, entering 10 means a workspace will be purged 10 days after it is added to the inactive list.

   6. Reminder Days in Advance - Enter the number of days before the purge date to send a reminder email to workspace administrators. Reminder email criteria includes:

      • The workspace is on the inactive list

      • There has been no activity in the workspace

      • The workspace administrator has not chosen to follow the link in the email to prevent the workspace from being purged

   7. Days Inactive - Enter the number of days of inactivity before a workspace is classified as inactive. Inactivity includes not logging into the workspace and the no runtime activity of any application in the workspace.

   8. Grace Period (Days) - Enter the number of days for the grace period. The grace period starts after workspace administrators click the link in the email to not have their workspace purged. If there is no activity during the grace period, the workspace is added back to the list of inactive workspaces.

   9. Maximum Execution Time (Hours) - Enter the number limiting the number of hours that the purge process may execute per run of the workspace purge job.

   10. Maximum Number of Workspaces - Enter the maximum number of workspaces to be purged per run of the workspace purge job.

   11. Maximum Number of Emails - Enter the maximum number of reminder emails and workspace inactive emails to be send per run of the workspace purge job.

5. Click Apply Changes.

2.4.6.1 Viewing Packaged Database Applications

To view a summary of packaged database applications:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Shared Components, click Packaged Database Applications.

   The Packaged Database Applications page appears.

   Tip:

   The Packaged Database Applications page displays as an interactive report. You can customize the appearance of the page using the Search bar at the top of the page. See "Customizing Interactive Reports" in Oracle Application Express Application Builder User's Guide.

2.4.6.2 Viewing Packaged Websheet Applications

To view a summary of packaged Websheet applications:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Shared Components, click Packaged Websheet Applications.

   The Packaged Websheet Applications page appears.

   The report displays total elapsed time to install each packaged applications. Note that the packaged application log is kept only up to 60 days. Any log older than 60 days is deleted.

   Tip:

   The Packaged Websheet Applications page displays as an interactive report. You can customize the appearance of the page using the Search bar at the top of the page. See "Customizing Interactive Reports" in Oracle Application Express Application Builder User's Guide.

2.4.8.1 Adding a Public Theme to the Theme Repository

To add a theme to the Theme repository:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Shared Components, click Public Themes.

   The Public Themes page appears.

4. Select Create.

5. For Workspace, select a workspace and click Next.

6. For Application, select an application and click Next.

7. For Theme, select a theme and click Next.

8. For Name, specify the following:

   1. Theme Number - Enter a number that uniquely identifies a theme within a workspace.

   2. Theme Name - Enter a name for the workspace theme.

   3. Description - Enter a description.

   4. Click Next.

9. Click Create Public Theme.

2.4.8.2 Deleting a Public Theme

To delete a public theme:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Shared Components, click Public Themes.

   The Public Themes page appears.

4. Select the theme to be deleted.

5. Click Delete.

2.4.8.3 Modifying a Public Theme

You cannot edit a public theme directly. To modify a public theme, you must create a new application using the theme, modify it, and then manually add it to the theme repository.

To modify a public theme:

1. Create an application using the theme you want to modify. See "Creating a Database Application" in Oracle Application Express Application Builder User's Guide.

2. Modify the theme. See "Editing a Theme" in Oracle Application Express Application Builder User's Guide.

3. Delete the existing public theme. See "Deleting a Template Application".

4. Add the modified theme to the theme repository. See "Adding an Application to the Template Applications Repository".

2.4.8.4 About Exporting a Public Theme

You export a theme in the same way you export any related application files. Exporting a public theme involves the following steps:

1. Create an application using the theme you want to modify. See "Creating a Database Application" in Oracle Application Express Application Builder User's Guide.

2. Export the application. See "Exporting an Application" in Oracle Application Express Application Builder User's Guide.

3. Import the exported file into the target Oracle Application Express instance. See "Importing an Application, Page or Component Export" in Oracle Application Express Application Builder User's Guide.

4. Install the exported file from the Export Repository. See "Installing Export Files" in Oracle Application Express Application Builder User's Guide.

2.4.9.1 Adding an Application to the Template Applications Repository

To add an application to the template application repository:

1. Export the application. See "Exporting an Application" in Oracle Application Express Application Builder User's Guide.

2. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

3. Click Manage Instance.

4. Under Manage Shared Components, click Template Applications.

   The Template Applications page appears.

5. Select Load Template Application.

6. For Specify File:

   1. Import File - Click Choose File and select an application export file.

   2. File Type - Select the type of application export file to import, Database Application Export or Websheet Application Export.

   3. File Character Set - Select the character set encoding of the application export file to be imported.

   4. Click Next.

7. For Application Details:

   1. Template Application - Specify an integer value that identifies the application.

      The application ID must be unique within your Oracle Application Express instance. Application IDs in the range of 3000 to 9000 are reserved for internal use by Application Express.

   2. Name - Enter a name to identify the application to developers.

   3. Alias - Enter an alternate alphanumeric application identifier. You can use this identifier in place of the application ID.

   4. Click Next.

      A confirmation page appears.

8. Click Create.

2.4.9.2 Deleting a Template Application

To delete a public application template:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Shared Components, click Template Applications.

   The Template Applications page appears.

4. Select the template application to be deleted.

   The Edit Properties page appears.

5. Click Delete.

   The Confirm Delete page appears.

6. Click Ok.

2.4.9.3 Editing a Template Application

You cannot directly edit the pages of a template application. To modify the pages of a template application, you must create a new application using the template application, modify it, export it, and then manually add it to the template application repository. You can edit the properties of a template application.

Topics:

• Modifying the Pages of a Template Application

• Editing Template Application Properties

2.4.10.1 Viewing Session Details Before Purging

Before purging sessions, Instance administrators can use the Recent Sessions page to first view a listing of recent sessions and then drill down on session details.

To view a listing of recent sessions:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Meta Data, click Session State.

   The Session State page appears.

4. Click Recent Sessions, with drill down to session details.

5. On the Recent Sessions page, you can:

   • Click a session number to view additional details.

   • Click Purge Sessions to delete the displayed sessions.

2.4.10.2 Purging Sessions by Age

Using the Purge Session page, Instance administrators can purge sessions by age.

To purge sessions by age:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Meta Data, click Session State.

   The Session State page appears.

4. Click Purge Sessions, by age.

5. On the Purge Sessions page, specify:

   • The maximum number of sessions to be purged

   • The age of sessions to be purged

6. To view a report of session statistics, click Count Sessions.

7. To purge the selected sessions, click Purge Sessions.

2.4.10.3 Viewing Session Statistics Before Purging

On the Session State Statistics page, Instance administrators can view statistics about current sessions before purging.

To view session state statistics:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Meta Data, click Session State.

   The Session State page appears.

4. Select Session State Statistics.

5. Click Purge Sessions to delete the current sessions.

2.4.14.1 Deleting SQL Workshop Logs

The SQL Workshop logs maintain a history of recent commands and scripts run in the SQL Commands.

To delete log files entries:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Logs and Files, click SQL Workshop Logs.

4. Click one of the following:

   • Script File executions log entries

   • SQL Command Processor history entries

5. On the Clean up Logs page:

   • To delete entries by age, specify the age of the entries to be deleted and click Delete Entries.

   • To delete all entries, click Truncate Log.

2.4.14.2 Deleting Page View Activity Log Entries

Page view activity logs track user activity for an application. Developers enable logging within their application using the Logging attribute on the Edit Application Definition page.

The Application Express engine uses two logs to track user activity. At any given time, one log is designated as current. For each rendered page view, the Application Express engine inserts one row into the log file. A log switch occurs at the interval listed on the Page View Activity Logs page. At that point, the Application Express engine removes all entries in the noncurrent log and designates it as current.

To truncate the activity logs manually:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Logs and Files, click Page View Activity Logs, with option to truncate.

   The Page View Activity Logs page appears.

4. Click Truncate Logs.

5. Click either Truncate Log 1 or Truncate Log 2.

2.4.14.3 Deleting Developer Activity Log Entries

The Developer Activity Log tracks changes to applications within an individual workspace. Log entries older than one month are automatically deleted.

To delete Developer Activity Log entries:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Logs and Files, click Developer Activity Logs, with option to delete entries.

   The Developer Activity Log page appears.

4. On the Developer Activity Log page, click Manage.

5. Specify the age of the entries to be deleted and click Delete Entries.

2.4.14.4 Deleting Click Counting Log Entries

The External Clicks Log counts clicks from an Oracle Application Express application to an external site. You can implement this functionality using the APEX_UTIL.COUNT_CLICK procedure.

To delete click counting log entries:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Logs and Files, click External Click Counting Log, with option to truncate.

   The External Click Counting Log page appears.

4. On the External Click Counting Log page, click Manage.

5. Specify the age of the entries to be deleted and click Delete Entries.

2.4.14.5 Deleting the Login Access Log

This table records authentication events by developers and administrators accessing the Oracle Application Express environment and by end users of Oracle Application Express applications that use the built-in login APIs available to developers. Log entries are aged out of the log tables and purged periodically.

To truncate the Login Access log:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Logs and Files, click Login Access Log.

   The Login Access Log page appears.

4. Click Manage.

5. On the Manage Login Access Log page, click Delete Entries.

2.4.14.6 Managing Log Intervals

Use the Manage Log Interval page to set the minimum number of days to retrain log information for log files.

To manage the log interval:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Manage Logs and Files, click Manage Log Interval.

   The Manage Log Interval page appears.

4. For each log type, enter the duration of the interval in days.

   The maximum value that can be specified is 180 days, with a default value of 14 days. Keeping log information for longer periods can degrade runtime performance.

5. Click Apply Changes.

2.4.16.1 Defining a Login Message

A login message displays on the Oracle Application Express login page. Instance administrators can create a login message using the Login Message section of the Messages page.

To create a login message:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Messages, click Define Login Message.

4. In Message, enter a message. The message can contain any text and can optionally include HTML formatting.

5. Click Apply Changes.

To disable a login message:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Messages, click Define Login Message.

4. For Login Message, select No Message.

5. Click Apply Changes.

2.4.16.2 Defining a System Message

System messages display on the Workspace home page, Application Builder home page, Application home page, SQL Workshop home page, and the Oracle Application Express Utilities page.

Instance administrators can create a system message using the System Message section of the Messages page.

2.4.16.3 Creating a Site-Specific Tasks List

The Site-Specific Tasks list is a list of links that appears on the Workspace home page or login page. If links are defined, a Site-Specific Tasks region appears. If no Site-Specific Tasks are defined, the region does not display. This feature enables Instance administrators to customize the Workspace home page for an entire development instance. Typical uses for the Site-Specific Tasks list include links to training, discussion forums, and user feedback applications.

Topics:

• Adding a New Task

• Editing an Existing Task

• Deleting a Task

2.4.17.1 Managing a New Service Signup Wizard

As an instance administrator, you can require users accept an agreement before the New Service Signup Wizard submits a request. You can also include a survey when users run the New Service Signup Wizard.

To manage a New Service Signup Wizard:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Self Service Sign Up, click Manage New Service Signup Wizard.

   The Sign Up Survey page appears.

4. Under Agreement, make these selections:

   • Enable Agreement - Select Yes to display agreement displayed during the New Service Signup Wizard. Otherwise, select No.

   • Agreement Text - Enter the agreement text.

5. Under Survey Questions, make these selections.

   • Enable Survey - Select Yes to display survey questions during the New Service Signup Wizard. Otherwise, select No.

   • Questions - Enter the question text.

   • Answers - Enter all answers for each question in the same field, delimited by a new line. Each question can have any number of answers.

   • Pre Text - Enter text that displays before the survey questions.

   • Post Text - Enter text that displays after the survey questions.

6. Click Apply Changes.

2.4.17.2 Running a New Service Signup Wizard

To run a newNew Service Signup Wizard:

1. Log in to Oracle Application Express Administration Services. See "Logging In To Oracle Application Express Administration Services".

2. Click Manage Instance.

3. Under Self Service Sign Up, click Run New Service Signup Wizard.

   The first page of the Self Service Sign Up Wizard appears.