Add an Oracle EBS application

Before you begin

Ensure that:

• Access Gateway is installed and configured for use.
  See Manage Access Gateway deployment.
• Access Gateway has been configured to use your Okta tenant as IDP.
  See Configure your Okta tenant as an Identity Provider for more information about configuring your Okta tenant as an IDP.
  
• You have administrator rights on your Okta tenant and can assign applications to users and create groups.
• The external app version is supported. OracleE-Business suite supported versions include:
• v12.1
• v12.2

For Classic process flow, ensure that:

• Oracle E-Business Suite(EBS) is configured with Oracle Access Gate and Oracle Internet Directory (OID) or Oracle User Directory (OUD).

For Rapid process flow, ensure that:

• Oracle E-Business Suite(EBS) is configured and available.
• DBC File has been created by the Oracle EBS owner and is available to the Access Gateway administrator.
  See Configure the EBS environment for Rapid SSO and create DBC file for instructions on how to configure Oracle E-Business Suite for Rapid SSO.
  
  

  Important

  Rapid EBS SSO uses domain cookies to communicate between Access Gateway and the EBS server. The domain used by the protected service and the externally facing instance of the gateway must share the same domain.

  
  
• If you configure Oracle E-Business Suite, sysadmin credentials for signing in to the EBS console and making required configuration changes.
• EBS Service Account Credentials (Username or email and associated password).
• EBS_USER is mapped to an Okta tenant user.

Topics

1. Configure the EBS environment for Rapid SSO and create DBC file
2. Create the application
3. Configure the EBS Rapid application

or

4. Configure the EBS Classic application
5. Test

Configure the EBS environment for Rapid SSO and create DBC file

Roles and Requirements - You will need the following roles to complete

Note

The Configure EBS environment section only applies to integrations using Rapid SSO. If you are integrating using Access Gate and Classic SSO you can skip this section.

Create required user and assign roles

1. Browse to the Oracle E-Business Suite console and sign in as sysadmin.
   For example: http://ebs.example.com:8000/OA_HTML/AppsLogin
2. From the Oracle E-Business Suite Home page, scroll down the Navigator panel and expand User Management.
3. Click Users. The User Maintenance page appears.
4. From the Register drop-down box, select User Accountand then click Go.
   The Create User account page opens.
5. Enter the following details to create the OAGSSOUSER user, and then click Submit.
   

   Field	Value
   User Name	OAGSSOUSER
   Password	An appropriate password
   Description	OAG User account for SSO
   Password Expiration	None

6. Select the Roles tab and click Assign Roles.
   The Update User page appears.
7. Click Assign Roles.
8. In the Search field enter UMX|APPS_SCHEMA_CONNECT and click Go.
   This role grants the user the right to communicate with the EBS database.
9. Enter an appropriate Justification such as Required for OAG SSO and click Apply.

Enable EBS for Single Sign-On

1. From the Windows or the appropriate OS specific menu, start the Java Control Panel and the select the Security tab.
2. Add your Oracle E-Business Suite host to the exception list.
3. Return to the to the to Oracle E-Business Suite console.
4. In Navigation pane, scroll to System Administrator and expand System Administrator > Profile > System.
   A Java applet launches.
5. If a security warning is displayed, click I accept the risk and then Run.
6. Select System Administrator > Profile > System and search for the Application Authenticate Agent profile.
7. Update the Site to the EBS route that Access will use to authenticate the user.
   This field must contain the fully qualified domain name of the application protected with Access Gateway.
   For example:  https://ebssso.example.com.
8. Click Save.
9. Select System Administrator > Profile > System and Search for the Applications SSO Type.
10. Change Applications SSO type from SSWA to SSWA/W SSO and click Save.
11. Select System Administrator > Profile > System and search for the Applications SSO Login.
12. Examine Applications SSO Login Types ensure its set to BOTH and click Save.
13. Select System Administrator > Profile > System and search for the %Session Cookie%.
14. Change Oracle Application Session Cookie ... to DOMAIN and click Save.
15. Exit the Java applet.
16. Exit the console.
17. Reboot Oracle E-Business Suite. This can take 15 to 30 minutes.

Note

Access Gateway uses the E-Business Suite API to communicate with the E-Business Suite database. Confirm with your E-Business Suite administrator what port this communication uses and ensure it is open between Access Gateway and the back end E-Business Suite database. Typically this is port 1521, but other ports are possible.

Register Okta Access Gateway With Oracle E-Business Suite

1. On your Oracle E-Business Suite server, locate and uncompress the ebs.war web application.
   
   

   Note

   You can dowload the ebs.war from the Oracle Identity Cloud Service console.

2. Extract the fndext.M.m.r.jar file located in the WEB-INF/lib folder inside the ebs.war file.

3. Open a command prompt and change directory to the location where the zip was unpacked.
4. Copy the fndext-M.m.rev.jar file to the E-Business Suite host using a command similar to:
   scp fndext-2.0.8.jar oracle@<EBS_IP>:/home/oracle
5. Secure shell into the EBS host using a command similar to:
   ssh oracle@<EBS_IP>
6. Configure the environment for E-Business Suite using a command similar to:
   . /u01/install/APPS/EBSapps.env run
7. Prepare the EBSSDK directory using a command similar to:
   cd $HOME; mkdir EBSSDK; mv fndext-2.0.8.jar; cd EBSSDK
8. Configure desktop app security using a command similar to:
   java oracle.apps.fnd.security.AdminDesktop apps/apps CREATE NODE_NAME=<your ebs domain name> DBC=/u01/install/APPS/fs1/inst/apps/EBSDB_apps/appl/fnd/12.0.0/secure/EBSDB.dbc
   Replacing <your ebs domain name> with the address of your EBS domain.
9. Confirm a DBC file was created using a command similar to:
   cat EBSDB.dbc
   Note: You will need the contents of this file when creating the Access Gateway Rapid EBS app.

Test

1. Confirm local authentication by accessing http://ebs.example.com:8000/OA_HTML/AppsLocalLogin.jsp
2. Secure shell into the host running the EBS database using a command similar to:
   ssh oracle@<EBS_IP>
3. Navigate to the directory containing listener.ora.
4. Examine listener.ora for:
   tcp.validnode_checking = NO
   tcp.invited_nodes = ( apps.example.com )
5. Restart the listener.

Create the application

1. Sign in to the Access Gateway Admin UI console.

2. Click the Applications tab.

3. Click +Add to add a new application.

4. Select one of Oracle EBS R12.1,Oracle EBSR12.2 or Oracle EBS SSO Agent from the left column menu, and click Create.
   

The steps that follow vary based on whether you are creating a Classic or Rapid EBS application.

Configure the EBS Rapid application

The following steps describe how to configure an EBS Rapid Application.

1. In the Essential pane enter:

   Field	Value
   Label	The name of the application, as shown in your Okta tenant.
   Public Domain	The externally facing URL of the EBS application. For example: https://ebs-external.example.com Note This must be the same value used in the Enable EBS for Single Sign-On section, step 7.
   Protected Web Resource	The URL and port combination of the Oracle EBS Implementation being protected. For example: http://ebsinternal.com:8000/ Note: Always end the protected resource URL with a forward slash (/).
   Post Login URL	URL of the EBS server: https://ebs.example.com:8000/OA_HTML/OA.js?OAGFunc=OAHOMEPAGE Note: This must be the hostname and port of the back end EBS server and not the external name used in Public Domain.
   Group	The group containing users who can access the EBS instance.



Important

While optional, Okta recommends that all applications include certificates.
See About Access Gateway Certificates for general information about certificate.
See Certificate management tasks for a general task flow for obtaining and assigning certificates.  

2. Expand the Certificates tab.
   
   

   Note

   By default a wild card self signed certificate is created and assigned to the application when the application is initially created.

3. Optional. Click Generate self-signed certificate
   
   A self-signed certificate is created and automatically assigned to the application.
4. Optional. Select an existing certificate from the list of provided certificates.
   Use the Search field to narrow the set of certificates by common name.
   Use the page forward (>)and backward(<) arrows to navigate through the list of available certificates.
   
   

5. Click Next.The Application Configuration pane displays.

6. In the Application configuration pane enter:

   Field	Value
   EBS Service Account	The EBS username from the configuration section. In this example, OAGSSOUSER.
   EBS Service Account Password	Password associated with EBS Service Account.
   EBS User Identified	Either USER_NAME or EMAIL_ADDRESS.
   DBC File Contents	DBC file contents as provided by the Oracle EBS Administrator or the value from section Register Okta Access Gateway With Oracle E-Business Suite.

7. Click Not validated when complete.
   
   If all values are entered correctly, the Not Validated button will change to Validated.
   
8. Click Next

9. In the Attributes tab using the (+) icon, create the following attributes:

   See Application attributes for detailed information on the attribute options.

   Data Source	Field	Type	Name
   IDP	User profile field that represents the EBS user name. It can be data static and a fixed value for testing. EBS only supports user name values in upper case.	Header	EBS_USER
   static	Auth Context	Header	REMOTE_IP
   static	Auth Context	Header	SESSION_ID

   1. Click the (+) icon.

   2. From the Data Source drop-down box, select IDP or static.

   3. From the Field drop-down box, select one of the required fields.

   4. From the Type drop-down box, select the appropriate target type, either Header.

   5. In the Name field, enter the associated name for the cookie value expected by Oracle EBS.
      

   6. Click Okay when the attribute is complete.

   7. Repeat to create the all required attributes.

10. Click Done when complete.

Configure the EBS Classic application

The following steps describe how to create an EBS Classic application.

1. In the Essentials pane enter:
   

   Field	Value
   Label	The name of the application as shown in your Okta tenant.
   Public Domain	The externally facing URL of the EBS application. For example: https://ebs-external.<gateway.info>
   Protected Web Resource	The URL and port combination of the Oracle EBS Implementation being protected. For example: http://ebs122.oracle.com:8000/ Note: Always end the protected resource URL with a forward slash (/).
   Post Login URL	Browseable route-through location to pick up the required EBS cookie from Okta Access Gateway and pass along to the Oracle EBS implementation. For example https://https://ebs-external.<gateway.info>/accessgate/dossologin
   Group	The group containing users who can access the EBS instance.



Important

While optional, Okta recommends that all applications include certificates.
See About Access Gateway Certificates for general information about certificate.
See Certificate management tasks for a general task flow for obtaining and assigning certificates.  

2. Expand the Certificates tab.
   
   

   Note

   By default a wild card self signed certificate is created and assigned to the application when the application is initially created.

3. Optional. Click Generate self-signed certificate
   
   A self-signed certificate is created and automatically assigned to the application.
4. Optional. Select an existing certificate from the list of provided certificates.
   Use the Search field to narrow the set of certificates by common name.
   Use the page forward (>)and backward(<) arrows to navigate through the list of available certificates.
   
   

5. Click Next. The Application Configuration pane displays.

6. In the Application Configuration pane enter:

   Field	Value
   Access Gate URL	The EBS URL matching the protected resource in the prior step using port 680.1 For example: http://ebs122.oracle.com:6801
   OID Datasource	Enabled.
   OID Host	Fully qualified host name of the OID Host. For example: oidhost.oracle.com
   OID Port	Port for the OID Host, typically 3060.
   User Search Attribute	CN
   Matching Attribute	EBSUSER,

7. Click Next when complete. The Attributes pane will display.

8. In the Attributes tab, using the icon, create the following two attributes:

   See Application attributes for detailed information on the attribute options. .

   Data Source	Field	Type	Name
   IDP	cn	Header	USER_NAME
   oid	orclguid	Header	USER_ORCLGUID

   1. Click the (+) icon
   2. From the Data Source drop-down box, select OID.
   3. From the Field drop-down box, select one of the required fields.
   4. From the Type drop-down box, select the appropriate target type, either Header.
   5. In the Name field, enter the associated name for the cookie value expected by Oracle EBS.
      
   6. Click Okay when the attribute is complete.
   7. Repeat to create the two required attributes.
   8. Click Done when complete.

Related topics

• See Access Gateway supported application and version information for details of supported application and version information.
• See Add a generic header application.
• See Add a sample header application.
• See Add a sample policy application.
• See Troubleshoot applications.
• Add or review application essential settings. See About application essentials and Manage application essentials.
• Add application behaviors. See About application behaviors.
• Add fine grained policy to further protect resources. See About application policy and Manage application policy for an overview on user policy and for examples respectively.
• Extend existing policy using custom configuration. See Advanced Access Gateway policy.
• Associate a certificate with this application. See Manage certificates.
• Add supplemental database or LDAP based data stores. See Administer data stores.