如何在APEX中将单点登录的邮箱设为APP_USER并解决配置报错？

Let's break down how to get your APP_USER set to the Microsoft SSO email address and fix those pesky PL/SQL syntax errors you're seeing.

First: Understand the Root of the Syntax Errors #

Your errors are coming from invalid PL/SQL syntax in the Post-Authenticate field of your authentication scheme:

• For the first error (Encountered the symbol "BEGIN" when expecting one of the following: ;): You likely had malformed code (e.g., extra characters before BEGIN, or a missing semicolon in a previous line). Also, writing end post_authenticate is wrong—END should only be followed by a semicolon (END;).
• For the second error (Encountered the symbol "."): This usually happens if you're calling a procedure without properly wrapping it in a PL/SQL block, or if there's a typo in the procedure name (like misspelling apex_custom_auth).

Step 1: Get the Correct Microsoft SSO Email Value #

When using Microsoft SSO (OAuth2) in APEX, the user's email is passed from the identity provider via a claim (usually email or upn). You can retrieve this authenticated user's email using the built-in function APEX_AUTHENTICATION.GET_LAST_PROCESSED_USERNAME()—this returns the exact value sent by Microsoft during authentication.

Note: Make sure your OAuth2 authentication scheme is configured to map the correct claim to the username field. Check the "User Attributes" section of your scheme and set the Username Source to the appropriate claim (e.g., email).

Step 2: Correct Post-Authenticate PL/SQL Code #

Choose one of these approaches based on your setup:

Option 1: Use Your Custom w14_auth_pkh.post_authenticate Procedure #

If you need to run custom logic (like syncing the user to a local table), use this properly formatted PL/SQL block:

BEGIN
  w14_auth_pkh.post_authenticate(
    p_username => APEX_AUTHENTICATION.GET_LAST_PROCESSED_USERNAME()
  );
END;

Important: Inside your post_authenticate procedure, make sure you're calling APEX_CUSTOM_AUTH.SET_USER(p_user => p_username) to actually update the APP_USER value to the email address.

Option 2: Directly Set APP_USER with apex_custom_auth.set_user #

If you don't need custom logic, skip the procedure and set APP_USER directly with this block:

BEGIN
  APEX_CUSTOM_AUTH.SET_USER(
    p_user => APEX_AUTHENTICATION.GET_LAST_PROCESSED_USERNAME()
  );
END;

You can also use a single line (no block) if you prefer:

APEX_CUSTOM_AUTH.SET_USER(p_user => APEX_AUTHENTICATION.GET_LAST_PROCESSED_USERNAME());

Step 3: Verify the Fix #

To confirm APP_USER is now set to the Microsoft email, add a PL/SQL dynamic content region to any page in your app with this code:

BEGIN
  HTP.P('Current APP_USER: ' || :APP_USER);
END;

After logging in via SSO, this region should display the user's Microsoft email instead of APEX_PUBLIC_USER.

Key Notes #

• Don't use :APP_USER as the input value in the Post-Authenticate code—at that point, :APP_USER is still APEX_PUBLIC_USER (the default unauthenticated user). Always use APEX_AUTHENTICATION.GET_LAST_PROCESSED_USERNAME() to get the freshly authenticated user's email.
• Double-check your authentication scheme's "Post-Authentication" field—make sure there are no extra spaces, typos, or unclosed blocks in the code.

内容的提问来源于stack exchange，提问作者andyroberts1234