I asked David Knox, our Chief Engineer in the Oracle Information Assurance Center to look at this and he says:

1) Correct, the session_user is the database schema that you mapped your enterpise user to. Enterprie Users can be seen in the 'external_name' value of the USERENV i.e., sys_context('userenv','external_name') This gives you the distinguished name of the user. Base your VPD policies on this value.
You can easily write a function to format the name into something easier (such as the common name attribute) if you so choose.

CREATE OR REPLACE function application_username (p_external_name in varchar2 default SYS_CONTEXT('USERENV','EXTERNAL_NAME')) return varchar2
as
BEGIN
return upper(substr(p_external_name,4,instr(p_external_name,',')-4));
end;
/

Connected to:
Oracle9i Enterprise Edition Release 9.2.0.1.0 - Production
With the Partitioning, OLAP and Oracle Data Mining options
JServer Release 9.2.0.1.0 - Production

SQL> select sys_context('userenv','external_name') from dual;

SYS_CONTEXT('USERENV','EXTERNAL_NAME')
--------------------------------------------------------------

cn=Knox,ou=CONTRACTOR,ou=PKI,ou=DoD,o=U.S. Government, c=US

1 row selected.

SQL> select application_username from dual;

APPLICATION_USERNAME
--------------------------------------------------------------

KNOX

1 row selected.

SQL>



2) Not sure what you application is supposed to do. First for clarification,
Enterprise Security Manager (ESM) provides the capability to map enterprise roles (stored in OiD) to global roles (stored in the DB's). ESM also assigns enterprise roles to enterprise users. The users get their privileges from the database global roles based on how those roles are mapped to the
enterprise roles assigned for them. So, ESM is an administration tool, and its functionality should probably not be incorporated into your application (Not knowing what your application is trying to do, I can only assume it is not for provisioning new users or assigning authorizations to them.) Your application will just use privileges assigned to the global roles. Please let me know if I
misunderstood what your application is supposed to do.