Oracle E-Business Suite with Access Gateway rapid SSO reference architecture

This reference architecture describes the components, flow, and version requirements to integrate Oracle E-Business Suite and Access Gateway when configured for EBS rapid SSO.

Architecture

EBS rapid flow

Flow

  1. The user signs in to Okta.
  2. Okta sends a SAML assertion to Access Gateway.
  3. Access Gateway sends the EBS_User header to ebs-ssoagent on Access Gateway.
  4. ebs-ssoagent verifies the EBS user against the database. After the user is authenticated, the database generates and issues a session cookie.
  5. The user is redirected to EBS with the EBS session cookie.

Components and requirements

Component Description and requirements
Okta Access Gateway All versions of Okta Access Gateway support Oracle E-Business Suite when configured as Access Gateway rapid EBS.
Oracle E-Business Suite

Supported versions:

  • 12.1
  • 12.2
DBC file Created by the Oracle E-Business Suite owner and made available to the Access Gateway administrator.

EBS service user account

Account used by Access Gateway to access the Oracle E-Business Suite.

In this example: OAGSSOUSER and granted the UMX|APPS_SCHEMA_CONNECT role.

Okta attributes

USER_NAME or USER_EMAIL, in email address form.

Header attributes

Header attributes passed by Access Gateway to the Oracle E-Business Suite application:

  • EBS_USER
  • REMOTE_IP
  • SESSION_ID
External URL External URL specified by the Public Domain field within Access Gateway. For example: ebs-external.example.com
Internal URL Internal URL and port specified by the Protected Web Resource field within Access Gateway. For example: ebs-internal.example.com:8000
Web domain Rapid EBS SSO uses domain cookies to communicate between Access Gateway and the EBS server. The domain used by the protected web resource and the externally facing instance of Access Gateway must share the domain. In this example, the shared domain is example.com.