Oracle EBS 12.1 SSO: E-Business Suite 12.1 single sign-on

After checking the package, in this order:

# AccessGate server
./ssogen eagsetup
#   then restart the AccessGate WebLogic domain

# EBS server
./ssogen createeaguser
./ssogen reg -ebsinstance=<instance> -eagurl=https://eag.acme.example
#   then copy the DBC file that reg names to the AccessGate server

# AccessGate server
./ssogen deployag
./ssogen ohsreg -mode=ssogen -platform_url=https://acme.ssogen.ai -client_id=<client ID> -agent_key_file=$HOME/ebs-agent-key.txt

• eagsetup unpacks the AccessGate patch and prepares the data source.
• createeaguser creates the EBS user the AccessGate connects with.
• reg creates the EBS node for the AccessGate and sets the EBS single sign-on profile options.
• deployag deploys the AccessGate for this EBS instance. With several AccessGate nodes, target it to the cluster by hand, as the tool says.
• ohsreg installs the Web Agent in the AccessGate’s Oracle HTTP Server, writes its configuration and restarts that server. It prints the Redirect URI to register in SSOGEN, https://<AccessGate address>/ssogen/callback.
• Each function asks for what it needs (folders, WebLogic user, passwords) when you leave it off the command line. ./ssogen -h <function> lists the options that answer those questions.
• Run reg again after each clone, on one web tier only.

reg sets the profile options at site level, the same set as on EBS 12.2 (see the EBS 12.2 page), with APPS_AUTH_AGENT pointing at https://<AccessGate address>/ebsauth_<instance>.

What is left for you:

1. User names. Every person needs an EBS user whose user name equals the signed-in identity the agent passes on, in capitals.
2. Local login. Login Types is Both at site level; keep a local way in for SYSADMIN.
3. Restart all EBS services, as the tool’s last line says.

deployag sets the AccessGate’s logout to the Web Agent’s sign-out address on the AccessGate, https://<AccessGate address>/ssogen/logout. For shared computers, see sign-out.

For SAML or OpenID Connect straight to your identity provider, run ohsreg with -mode=saml or -mode=oidc and a license key. The values work as on the EBS 12.2 page, with the AccessGate address in place of the EBS address and the metadata file saved as eag-idp.xml.