Sounds like you will have a high-traffic web app, which lands itself as a
good candidate for using a high-end application server.  For some guidance
in choosing the right one, go to http://www.theserverside.com.

For JDBC drivers, it is a toss-up between Oracle's OCI and thin drivers and
most people opt for the type 4 thin driver for its ease of use (no need to
fool around with installing OCI libraries, which may be daunting for some
folks but obviously is not an issue in your case).  If you choose to use
WebLogic as your app server, it offers a type 2 driver for Oracle which
works well with the app server, but I have not seen any comparison with
Oracle's offerings.

When you move to a multi-tier architecture from a client-server one (like
Oracle Forms), you should no longer rely on the database to do the
authentication, because it defeats connection pooling and you lose
scalability.  You have to do this in the middle-tier, i.e., let the app
server do the authentication and authorization for you.  WebLogic allows you
to set up an external security realm using a LDAP server, such as Netscape
Directory Server, so you should definitely look into that.  From what I hear
Oracle's iAS is not yet a mature product and I would put it towards the
bottom of the list of app servers you evaluate.  I understand many people
want to stay with one software vendor for a packaged solution, and there are
many devoted fans of Oracle.  But at this moment Oracle in the middle tier
doesn't seem to be an optimal choice.

Just my 2 cents.

Eric Ma