4 Getting Started

Step 1: Setting Up the Workspace Administrators

Before you can log in to any of the APEX workspaces, set up the login details for the administrator of each workspace.

Prerequisites

  1. Access to the OCI Console.
  2. The Retail Home URL for each environment you want to set up (for example, PROD and STG).
  3. Access to Retail Home.
  4. Ability to create users in OCI IAM.

Steps

  1. Log in to the OCI Console.

  2. In OCI IAM, create a default OCI IAM workspace administrator account for each subscribed cloud service. Use the primary schema names in Table 1-1.

    1. Default OCI IAM workspace administrator accounts are bootstrap accounts. They are intended to provide temporary initial access, not ongoing administration.

    2. The customer manages the OCI IAM bootstrap account passwords and lifecycle.

    3. You do not need to synchronize this user with APEX. The usernames only need to match.

    4. For example, create an OCI IAM bootstrap account named MFCS_RDS_CUSTOM. You can then log in to the APEX MFCS workspace using that user ID.

    5. These logins work in all your environments. For example, MFCS_RDS_CUSTOM grants access to the MFCS workspace in both STAGE and PRODUCTION.

    6. OCI IAM bootstrap accounts are secure by default, but are intended only to provide the initial access needed to establish each workspace administrator.

  3. Log in to the OCI IAM bootstrap account in the OCI Console. If you are currently logged in as another user, you must log out first.

    1. Verify that you can reach the workspace launch page for the environment: in the Re­tail Home Application Navigator, select RDS APEX/ORDS. RDS APEX/ORDS is included in the Application Navigator by default.

    2. The OCI IAM bootstrap account can reach only one workspace.

  4. Create at least two active workspace administrators for the workspace, as described in APEX User Management. One workspace administrator should be you.

    1. After you create the workspace administrators, log out of the APEX UI.
    2. Log in as each new workspace administrator and verify that each can access the workspace.
    3. Delete the OCI IAM bootstrap account.
  5. Repeat steps 2 through 5 for each cloud service to which you subscribe.
  1. Using your workspace administrator account, set up workspace developer accounts as described in APEX User Management.

Recovery Note:

Maintain at least two active workspace administrators and ensure they are well-known to the customer’s administrative team. If all workspace ad­ministrators become unavailable, delete (generally unnecessary; the account should have been deleted after initial setup) and recreate the default OCI IAM workspace administrator account (the OCI IAM bootstrap account), such as MFCS_RDS_CUSTOM, to reestablish workspace administrator access. Resetting the password will not help if the reset email is sent to an unavailable administrator.

Step 2: Setup RDS Database Operations Console Access

Prerequisites

  1. Access to the OCI Console.
  2. The Retail Home URL for each environment you want to set up (for example, PROD and STG).
  3. Access to Retail Home.
  4. Ability to assign users to groups in OCI IAM.

Steps

  1. Log in to the OCI Console.

  2. Assign each workspace administrator who needs access to pre-production environments to the RDS_MANAGEMENT_ADMINISTRATOR_PREPROD group.

    1. Verify that you can reach the RDS DB Ops Console for the pre-production environ­ment: in the Retail Home Application Navigator, select RDS DB Ops Console. The console is available in the Application Navigator by default.

    2. Assign developers to the appropriate RDS_MANAGEMENT pre-production groups for the required access level. See the Retail Data Store Security Guide for details.

  3. Assign each workspace administrator who needs access to production environments to the RDS_MANAGEMENT_ADMINISTRATOR group.

    1. Verify that you can reach the RDS DB Ops Console for the production environment: in the Retail Home Application Navigator, select RDS DB Ops Console.

    2. Assign developers to the appropriate RDS_MANAGEMENT production groups for the required access level. See the Retail Data Store Security Guide for details.

APEX User Management

For this guide, there are two types of APEX users: end users and development users. End users access applications built with APEX but do not develop or manage those applications. Development users create and manage the APEX applications used by end users. Development users can have the Developer or Workspace Administrator role.

From the Oracle APEX UI, developers can quickly create web applications, including custom database objects, reports, forms, and RESTful services through a low-code interface.

Best Practice:

Create at least two active, named workspace administrators for each workspace, and delete the OCI IAM bootstrap account after they verify access. Do not use the OCI IAM bootstrap account for ongoing administration. Because its matching user ID can access multiple environments, it can grant cross-environment access incidentally rather than through an intentional access decision.

This section focuses on managing development users. The Workspace Administrator manages end-user authentication and can choose any supported authentication model for the APEX applications developed. For supported models, see the APEX App Builder User’s Guide, section 21.4, Establishing User Identity Through Authentication.

Development-user authentication is provided through integration with OCI IAM. The APEX workspaces provisioned for RDS use HTTP Header Variable authentication. For details, see the APEX App Builder User’s Guide, section 21.4.2.4, HTTP Header Variable.

In most cases, teams need additional development users to develop APEX applications and REST endpoints. A Workspace Administrator can create Developer and Workspace Administrator users through the APEX UI. Create each additional user in APEX and create a matching username in OCI IAM. As with OCI IAM bootstrap accounts, passwords for these accounts are managed in OCI IAM.

Creating Development Users

Use this procedure to create either a workspace administrator or a developer. Before creating the user in APEX, create a matching user account in OCI IAM.

  1. Log in to APEX with a workspace administrator account. During initial setup, use the OCI IAM bootstrap account.

  2. On the APEX start page, open the Administration menu in the upper-right corner and select Manage Users and Groups.

    Figure 4-1 Open Administration and select Manage Users and Groups


    Open Administration and select Manage Users and Groups

  3. In the User Management screen, select Create User.

  4. In the Create User form, enter the Username and Email that match the OCI IAM user account you want to add.

  5. Under Account Privileges, select the appropriate role:

    • Select Workspace Administrator to create a workspace administrator. Workspace administrators manage the workspace and its development users.

    • Select Developer to create a developer. Developers create and manage APEX applications and REST endpoints.

    • If neither option is selected, the user cannot create anything in APEX, but might be able to access existing applications.

    Figure 4-2 Account Privileges section of the APEX Create User Form


    Account Privileges section of the APEX Create User form

  6. For Password, enter any value. APEX does not use this password when OCI IAM manages authentication.

  7. Set Require Change of Password on First Use to No, because APEX does not manage authentication.

  8. Under Group Assignments, add one or more privileges as appropriate for the user’s role. Select Create User at the top of the screen to add the user to APEX.

Figure 2: Account Privileges section of the APEX Create User form.

For details on other user management activities in APEX, refer to the APEX Administration Guidechapter “Understanding Workspace Administration”.