Add an Oracle EBS application

 

Oracle eBusiness Suite can be integrated with Access Gateway in one of two ways, typically referred to as Classic and Rapid.

  • With Classic, Oracle EBS Oracle Access Gate and either Oracle Internet Directory (OID) or Oracle User Directory (OUD) are required.
  • With Rapid, Oracle EBS requires a set of EBS credentials and an EBS DCS file.

General architecture and process flow

EBS Rapid flow EBS Classic Flow

EBS Rapid process flow

  1. User login
  2. Send EBS user identity
  3. Verify EBS user
    (Which generate EBS Session)
  4. Redirect to EBS w/ EBS Session Cookie

EBS Classic process flow

  1. User login
  2. Send EBS user identity
  3. Look up GUID using EBS user identity
  4. Send GUID (header) to Access Gate
    (Which generates an EBS cookie)
  5. Redirect to EBS w/ EBS Session Cookie

Tip

Tip

This application is part of a class of applications which exchange user information using header variables. For more information about the Access Gateway generic header application please see Add a generic header application.

Access Gatewayalso provides a sample header application. Please see Add a sample header application for more information.

Before You Begin

General

Classic

  • Oracle E-Business Suite(EBS), configured with Oracle Access Gate and Oracle Internet Directory (OID) or Oracle User Directory (OUD).

Rapid

  • Oracle E-Business Suite(EBS) configured and available.
  • DBC File created by the Oracle EBS owner and is available to the Access Gateway administrator.
    For reference the section Configure the EBS environment for Rapid SSO and create DBC file contains instructions for configuring Oracle E-Business Suite for Rapid SSO.
    Info

    Important

    Rapid EBS SSO uses domain cookies to communicate between Access Gateway and the EBS server. The domain used by the protected service and the externally facing instance of the gateway must share the same domain.


  • If configuring Oracle E-Business Suite, sysadmin credentials for logging in to the EBS console and making required configuration changes.
  • EBS Service Account Credentials (Username or email and associated password)
  • EBS_USER mapped to an Okta tenant user

Topics

  1. Configure the EBS environment for Rapid SSO and create DBC file
  2. Create application
  3. Configure EBS Rapid Application
  4. or

  5. Configure EBS Classic application
  6. Test

Configure the EBS environment for Rapid SSO and create DBC file

Roles and Requirements - You will need the follows roles to comple

Note

Note

The Configure EBS environment section only applies to integrations using Rapid SSO. If you are integrating using Access Gate and Classic SSO you can skip this section.

Create required user and assign roles

  1. Browse to the Oracle E-Business Suite console and sign in as sysadmin.
    For example: http://ebs.example.com:8000/OA_HTML/AppsLogin
  2. From the Oracle E-Business Suite Home page, scroll down the Navigator panel and expand User Management.
  3. Click Users. The User Maintenance page will appear.
  4. Select User Account from the Register drop-down menu, and then click Go.
    The Create User account page will display.
  5. Enter the following details to create the OAGSSOUSER user, and then click Submit.
    FieldValue
    User NameOAGSSOUSER
    PasswordAn appropriate password
    DescriptionOAG User account for SSO
    Password ExpirationNone
  6. Select the Roles tab and click Assign Roles.
    The Update User page will display.
  7. Click Assign Roles.
  8. In the Search field enter UMX|APPS_SCHEMA_CONNECT and click Go.
    This role grants the user the right to communicate with the EBS database.
  9. Enter an appropriate Justification such as Required for OAG SSO and click Apply.

Enable EBS for Single Sign-On

  1. From the Windows or the appropriate OS specific menu, start the Java Control Panel and the select the Security Tab.
  2. Add your Oracle E-Business Suite host to the exception list.
  3. Return to the to the to Oracle E-Business Suite console.
  4. In Navigation pane scroll to System Administrator and expand System Administrator > Profile > System.
    A Java applet will launch.
  5. If a security warning is displayed, click I accept the risk and then Run.
  6. Select System Administrator > Profile > System and Search for the Application Authenticate Agent profile.
  7. Update the Site to the EBS route that Access will use to authenticate the user.
    This field MUST contain the fully qualified domain name of the application which will be protected with Access Gateway.
    For example:  https://ebssso.example.com.
  8. Click Save.
  9. Select System Administrator > Profile > System and Search for the Applications SSO Type.
  10. Change Applications SSO type from SSWA to SSWA/W SSO and click Save.
  11. Select System Administrator > Profile > System and Search for the Applications SSO Login.
  12. Examine Applications SSO Login Types ensure its set to BOTH and click Save.
  13. Select System Administrator > Profile > System and Search for the %Session Cookie%.
  14. Change Oracle Application Session Cookie ... to DOMAIN and click Save.
  15. Exit the Java applet.
  16. Exit the console.
  17. Reboot Oracle E-Business Suite. Note this can take 15 to 30 minutes.
Note

Note

Access Gateway uses the E-Business Suite API to communicate with the E-Business Suite database. Confirm with your E-Business Suite administrator what port this communication uses and ensure it is open between Access Gateway and the back end E-Business Suite database. Typically this is port 1521, but other ports are possible.

Register Okta Access Gateway With Oracle E-Business Suite

  1. On your Oracle E-Business Suite server, locate and uncompress the ebs.war web application.
    Note

    Note

    The ebs.war can also be downloaded from the Oracle Identity Cloud Service console.

  2. Extract the fndext.M.m.r.jar file, which is located in the WEB-INF/lib folder inside the ebs.war file.

  3. Open a command prompt and change directory to the location where the zip was unpacked.
  4. Copy the fndext-M.m.rev.jar file to the E-Business Suite host using a command similar to:
    scp fndext-2.0.8.jar oracle@<EBS_IP>:/home/oracle
  5. Secure shell into the EBS host using a command similar to:
    ssh oracle@<EBS_IP>
  6. Configure the environment for E-Business Suite using a command similar to:
    . /u01/install/APPS/EBSapps.env run
  7. Prepare the EBSSDK directory using a command similar to:
    cd $HOME; mkdir EBSSDK; mv fndext-2.0.8.jar; cd EBSSDK
  8. Configure desktop app security using a command similar to:
    java oracle.apps.fnd.security.AdminDesktop apps/apps CREATE NODE_NAME=<your ebs domain name> DBC=/u01/install/APPS/fs1/inst/apps/EBSDB_apps/appl/fnd/12.0.0/secure/EBSDB.dbc
    Replacing <your ebs domain name> with the address of your EBS domain.
  9. Confirm a DBC file was created using a command similar to:
    cat EBSDB.dbc
    Note: you will need the contents of this file when creating the Access Gateway Rapid EBS app.

Test

  1. Confirm local authentication by accessing http://ebs.example.com:8000/OA_HTML/AppsLocalLogin.jsp
  2. Secure shell into the host runing the EBS database using a command similar to:
    ssh oracle@<EBS_IP>
  3. Navigate to the directory containing listener.ora.
  4. Examine listener.ora for:
    tcp.validnode_checking = NO
    tcp.invited_nodes = ( apps.example.com )
  5. Restart the listener.

Create application

  1. Navigate to your Access Gateway Instance.

    Info

    Note

    Access Gateway creates a default self-signed certificate. For non-production deployments, this will be appropriate. Proceed past any security exceptions raised by your browser. For production deployments, a valid certificate can be installed and these exceptions will not be needed.

  2. In the Access Gateway Admin UI, sign in as an administrator.

  3. Click the Applications tab.

    Select applications tab

  4. Click +Add to add a new application.

    Click Add.

     

  5. Select one of Oracle EBS R12.1,Oracle EBSR12.2 or Oracle EBS SSO Agent from the left column menu, and click Create.

    Info

    Note

    Please see the Supported technologiessection in Supported technologies support matrix for supported applications and software versions.

The steps that follow vary based on whether you are creating a Classic or Rapid EBS application.

Configure EBS Rapid Application

The following steps describe how to configure an EBS Rapid Application.

  1. In the Essential pane enter:

    Field Value
    Label The name of the application, as show in your Okta Tenant.
    Public Domain The externally facing URL of the EBS application.
    For example: https://ebs-external.example.com
    Note
    This must be the same value used in the Enable EBS for Single Sign-On section, step 7.
    Protected Web Resource The URL and port combination of the Oracle EBS Implementation being protected.
    For example: http://ebsinternal.com:8000/
    Note: Always end the protected resource URL with a forward slash (/).
    Post Login URL

    URL of the EBS server:
    https://ebs.example.com:8000/OA_HTML/OA.js?OAGFunc=OAHOMEPAGE
    Note: This must be the hostname and port of the back end EBS server and NOT the external name used in Public Domain.

    Group The group containing users who can access the EBS instance.
  2. Click Next.
    The Application Configuration pane displays.

  3. In the Application configuration pane enter:

    Field Value
    EBS Service Account The EBS Username, from the configuration section.
    In this example, OAGSSOUSER.
    EBS Service Account Password Password associated with EBS Service Account.
    EBS User Identified Either USER_NAME or EMAIL_ADDRESS.
    DBC File Contents DBC file contents, as provided by the Oracle EBS Administrator or the value from section Register Okta Access Gateway With Oracle E-Business Suite.

    Click Not validated when complete.

    If all values are entered correctly the Not Validated button will change to green/Validated.

  4. Click Next
  5. In the Attributes tab, using the (+)Add attribute(plus) icon. icon, create the following attributes.

    For detailed information on the attribute options, see Application attributes .

    Data Source Field Type Name
    IDP User profile field representing EBS user name.
    Can be data static and a fixed value for testing. Note EBS only supports user name values in upper case.
    Header EBS_USER
    static Auth Context Header REMOTE_IP
    static Auth Context Header SESSION_ID
    1. Click the (+) Add attribute(plus) icon. icon
    2. From the Data Source drop down select IDP or static.

    3. From the Field drop down select one of the required fields.

    4. From the Type drop down select the appropriate target type, either Header.

    5. In the Name field enter the associated name for the cookie value expected by Oracle EBS.

    6. Click Okay when the attribute is complete.

    7. Repeat to create the all required attributes.

  6. Click Done when complete.

 

Configure EBS Classic application

The following steps describe how to create an EBS Classic Application.

  1. In the Essentials pane enter:

    Field Value
    Label The name of the application, as shown in your Okta Tenant.
    Public Domain The externally facing URL of the EBS application.
    For example: https://ebs-external.<gateway.info>
    Protected Web Resource

    The URL and port combination of the Oracle EBS Implementation being protected.
    For example: http://ebs122.oracle.com:8000/

    Note: Always end the protected resource URL with a forward slash (/).

    Post Login URL Browseable route-through location to pick up the required EBS cookie from Okta Access Gateway and pass along to the Oracle EBS implementation.
    For example https://https://ebs-external.<gateway.info>/accessgate/dossologin
    Group The group containing users who can access the EBS instance.
  2. Click Next.
    The Application Configuration pane displays.

  3. In the Application Configuration pane enter:

    Field Value
    Access Gate URL The EBS URL, matching the protected resource in the prior step using port 6801
    For example: http://ebs122.oracle.com:6801

    OID Datasource Enabled.
    OID Host Fully qualified host name of the OID Host.
    For example: oidhost.oracle.com
    OID Port Port for the OID Host, typically 3060.
    User Search Attribute CN
    Matching Attribute EBSUSER,

    Click Next when complete. The Attributes pane will display.

  4. In the Attributes tab, using the Add attribute(plus) icon. icon, create the following two attributes:

    For detailed information on the attribute options, see Application attributes .

    Data Source Field Type Name
    IDP cn Header USER_NAME
    oid orclguid Header USER_ORCLGUID
    1. Click the (+) icon
    2. From the Data Source drop down select oid.
    3. From the Field drop down select one of the required fields.
    4. From the Type drop down select the appropriate target type, either Header.
    5. In the Name field enter the associated name for the cookie value expected by Oracle EBS.
    6. Click Okay when the attribute is complete.
    7. Repeat to create the two required attributes.
    8. Click Done when complete.

An EBS application is then created within Access Gateway and your Okta tenant.

Test

  1. Select IDP Initiated from the drop down menu associated with the application.
    Test the application

    Info

    Note

    Your Okta tenant administrator may need to assign the application to you.

    In addition, if you do not already have an active session for Okta open in your browser, you may be prompted to log in to your Okta account and provide credentials.

  2. Verify that you are logged into Oracle EBS correctly.

 

See Also