Oracle EBS SSO (Single Sign-On) Options and Setup Guide

• Oracle Validated Integration. Oracle validated SSOGEN’s single sign-on integration with E-Business Suite 12.2 and publishes the datasheet.
• Oracle’s own AccessGate. The tool deploys the AccessGate application that ships with EBS (fndauth.war from FND_TOP). No separate asserter, no OAM, no OID.
• One tool, one pass. ./ssogen reg installs the Web Agent, writes its configuration, adds one marked block to httpd.conf and sets the EBS profile options. Every file it changes is backed up first, and --check shows what would change without changing anything.
• No users copied to a cloud. Unlike IDCS, which needs EBS users synchronized to Oracle Cloud, SSOGEN needs no copy of your EBS users anywhere. The match is the user name.
• The local login stays. SYSADMIN and other accounts without a company login keep signing in at the local login page.
• Three ways to connect. Through your SSOGEN tenant, straight to a SAML 2.0 provider, or straight to an OpenID Connect provider. Same tool, one option.
• Policy in one place. In SSOGEN mode, who may open EBS, multi-factor rules and sign-in policy are set in the SSOGEN console and apply to EBS like every other application.
• No separate charge for the tool. The integration tool and the Web Agent come with SSOGEN.

Each page below says what to set on the provider’s side for EBS and which value goes where.

The same tool connects the EBS web tier straight to a SAML 2.0 or OpenID Connect (OAuth 2.0) provider, such as Microsoft Entra ID, Okta or AD FS, without SSOGEN in between. Both modes need a license key from SSOGEN.

SAML. Ask the identity provider administrator for the metadata XML file and save it as ebs-internal-idp.xml in the ssogen folder of the web tier, then run:

./ssogen reg -mode=saml -ssogen_license=<license key>

Give the identity provider the two values reg prints: the Identifier (Entity ID), which is the EBS address, and the Reply URL, https://<EBS address>/ssogen/acs. The identity provider sends the EBS user name as the NameID. If you ran reg before you had the metadata, the configuration holds two commented example lines; remove the # from the one you use (the file, or the metadata URL) and restart. -custom_logout_url=https://... sets where people go after sign-out.

OpenID Connect. Register a web client at the provider with the Redirect URI https://<EBS address>/ssogen/oidc/callback, then:

SSOGEN_OIDC_SECRET=<client secret> ./ssogen reg -mode=oidc -ssogen_license=<license key> -client_id=<client ID>

Add the provider’s discovery address to the configuration as SSOGENOidcProviderMetadataURL and run reg again. If the provider sends an email address as the user name, have it send the short EBS user name in another claim and name that claim with SSOGENOidcUserClaim.

ORA-20001: Unable to call fnd_ldap_wrapper.create_user because Oracle Internet Directory is not registered correctly

The Application SSO LDAP Synchronization profile (APPS_SSO_LDAP_SYNC) affects how users are created. Set it to No at site level; reg does that. Check the other profile options against the table above, and make sure the system was not registered with another SSO before, such as Oracle Access Manager, Oracle SSO or OID/OUD. If it was, run ./ssogen cleanup first (see Before you start).

Unable to link account: this E-Business Suite user account is marked as a local account

After sign-in, EBS shows this page:

The cause is Applications SSO Login Types (APPS_SSO_LOCAL_LOGIN) set to Local for that user. For SSO to work the profile must be Both or SSO. It is normally Both at site level and not set at user level.

Local is used temporarily to reset an EBS local password in the FND_USER table. After the password is reset, remove the user-level value of the profile.

Your Oracle E-Business Suite account has not been linked with the Single Sign-On account

EBS shows this auto-link page when it cannot find the user by the GUID sent by the sign-in source. Either EBS was registered with another SSO earlier, so FND_USER holds an old GUID, or the person linked their account to another user by typing a different user name and password on this page.

Unlink the user by setting the GUID to null. EBS auto-link then writes the right GUID at the next sign-in:

SQL> select user_name,end_date,user_guid from fnd_user where user_name='JDOE';

USER_NAME  END_DATE  USER_GUID
JDOE                 B31318AC7A93622BC050A3C0250108F2

SQL> update fnd_user set user_guid = null where user_name = 'JDOE';
1 row updated.

SQL> commit;
Commit complete.

Ask the person to sign in again. The GUID is filled in with a new value:

SQL> select user_name,end_date,user_guid from fnd_user where user_name='JDOE';

USER_NAME  END_DATE  USER_GUID
JDOE                 B34C930A342BBE63D140A8C046014980

To unlink everyone at once, ./ssogen cleanup does it for every user and saves the old values.

Verify the SSO profile options

Run this as APPS to list the site-level values of the options that matter:

select fpot.user_profile_option_name, fpov.profile_option_value, fpov.last_update_date, fu.user_name
from apps.fnd_profile_options fpo, apps.fnd_profile_options_tl fpot,
     apps.fnd_profile_option_values fpov, apps.fnd_user fu
where fpo.profile_option_id = fpov.profile_option_id
and fpov.level_id = 10001
and fpov.last_updated_by = fu.user_id
and fpo.profile_option_name = fpot.profile_option_name
and fpot.language = 'US'
and fpo.profile_option_name in (
 'APPS_FRAMEWORK_AGENT', 'APPS_AUTH_AGENT', 'APPS_SSO', 'APPS_SSO_LOCAL_LOGIN',
 'APPS_SSO_AUTO_LINK_USER', 'APPS_SSO_ALLOW_MULTIPLE_ACCOUNTS',
 'APPS_SSO_USER_CREATE_UPDATE', 'APPS_SSO_LDAP_SYNC',
 'APPS_SSO_LINK_TRUTH_SRC', 'FND_OVERRIDE_SSO_LANG')
order by 1;

The output should match:

Check the EBS user: end date, GUID and user-level profile options

Look at the user:

select user_name, end_date, user_guid from fnd_user where user_name = '&EBS_SSO_USER_NAME';

An end-dated user cannot sign in, SSO or not. When in doubt, clear the GUID so it is set again at the next sign-in:

update fnd_user set user_guid = null where user_name = '&EBS_SSO_USER_NAME';

Then look at the user-level profile options for anything suspicious, such as a Login Types of Local:

select fpot.user_profile_option_name, fpov.profile_option_value, fpov.last_update_date, fu1.user_name
from apps.fnd_profile_options fpo, apps.fnd_profile_options_tl fpot,
     apps.fnd_profile_option_values fpov, apps.fnd_user fu, apps.fnd_user fu1
where fpo.profile_option_id = fpov.profile_option_id
and fpov.level_id = 10004
and fpov.level_value = fu.user_id
and fpov.last_updated_by = fu1.user_id
and fpo.profile_option_name = fpot.profile_option_name
and fpot.language = 'US'
and fu.user_name = '&EBS_SSO_USER_NAME'
order by 1;

AccessGate troubleshooting

• Check the AccessGate version at https://ebs.acme.example/accessgate/style/EbusinessAccessGate.class.
• If the AccessGate misbehaves, see Oracle Support note 2202932.1 for the latest AccessGate patch.
• To log the AccessGate, create a logging configuration, point the AccessGate at it and restart oaea_server1 (or the server you use):

cat <<EOC > /tmp/oaealog
handlers=java.util.logging.FileHandler
.level= ALL
java.util.logging.FileHandler.pattern = /tmp/fndauth%u.log
java.util.logging.FileHandler.limit = 10000000
java.util.logging.FileHandler.count = 1
java.util.logging.FileHandler.level = FINE
java.util.logging.FileHandler.formatter = java.util.logging.SimpleFormatter
oracle.apps.fnd.ext.common.level=FINE
oracle.apps.fnd.ext.common.server.level=FINE
EOC

cat <<EOC2 >> $INST_TOP/appl/admin/oaea_wls.properties
LOG_CONFIG_FILE=/tmp/oaealog
EOC2

For more, see Oracle’s note How To Collect E-Business Suite 12.2 AccessGate LogFiles (Doc ID 1683163.1). Remove the setting when you are done.

HTTP 400 Bad Request after enabling SSO

SSO adds cookies, so EBS R12.1 and R12.2 can answer HTTP 400 when Apache’s request limits are reached. Set the limits in the context file ($CONTEXT_FILE), run AutoConfig and restart all services.

R12.2:

<limitrequestfieldsize oa_var="s_limitrequestfieldsize">16384</limitrequestfieldsize>
<limitrequestfields oa_var="s_limitrequestfields">128</limitrequestfields>
<limitrequestbody oa_var="s_limitrequestbody">0</limitrequestbody>
<limitrequestline oa_var="s_limitrequestline">16384</limitrequestline>

R12.1:

<limitrequestfieldsize oa_var="s_limitrequestfieldsize">8190</limitrequestfieldsize>
<limitrequestfields oa_var="s_limitrequestfields">64</limitrequestfields>
<limitrequestbody oa_var="s_limitrequestbody">0</limitrequestbody>
<limitrequestline oa_var="s_limitrequestline">8190</limitrequestline>

Related Oracle notes:

• EBS requests fail with “Size of a request header field exceeds server limit” [ID 1370626.1]
• Lengthy Configurator URL: CZ Does Not Launch [ID 1374444.1]
• Url Causes Http 400 Error [ID 1374260.1]

EBS R12 timeouts

Check these variables in $CONTEXT_FILE:

• s_sesstimeout
• s_oc4j_sesstimeout
• s_forms_time
• s_ohstimeout

And these EBS profile options:

• ICX: Session Timeout
• ICX: Limit connect
• ICX: Limit time

Oracle notes:

• R12: Forms Timeout More Than 2 Hrs Is Not Working After R12 Upgrade [ID 734077.1]
• How to Change User Session Timeout in e-Business Suite R12 [ID 1067115.1]
• User Sessions Get Timed Out Before Idle Time Parameter Values Are Reached [ID 1306678.1]
• Self-Service Pages Are Failing After Changing the s_oc4j_sesstimeout [ID 780612.1]
• How AutoConfig sets ICX: Session Timeout [ID 307149.1]
• 11i/R12 How to Debug “Transaction Context Is Lost” or “You are trying to access a page that is no longer active” [ID 456906.1]
• Random error “Your login session has expired” when using Load Balancing [ID 387306.1]

Load balancer redirects to the wrong address

For the load balancer address to work, these context variables must be right:

• s_webentryhost
• s_webentrydomain
• s_active_webport
• s_webentryurlprotocol
• s_url_protocol
• s_local_url_protocol
• s_login_page
• s_enable_sslterminator
• s_external_url

To see them:

egrep 's_web|s_active_webport|s_login_page|s_enable_sslterminator|s_url_protocol|s_local_url_protocol|s_login|s_external_url' $CONTEXT_FILE

SSL terminated at the load balancer: redirects go to http or the wrong port

When the load balancer ends SSL, EBS needs these values (the host is an example):

• s_webentryhost=ebs
• s_webentrydomain=acme.example
• s_webentryurlprotocol=https
• s_active_webport=443
• s_enable_sslterminator= with the leading # removed
• s_login_page=https://ebs.acme.example:443/OA_HTML/AppsLogin
• s_external_url=https://ebs.acme.example:443

Run AutoConfig and restart after the change. The Client URL in SSOGEN and the Redirect URI must use the address people type, the load balancer’s, not the node’s.

HTTP 500 after sign-in

The AccessGate log shows:

<Error> <ServletContext-/ebsauth_acme> <BEA-000000> <Context initialization failed
java.lang.NoClassDefFoundError: oracle/ias/cache/ObjectNotFoundException
    at oracle.apps.fnd.ext.sso.FndSsoConfigListener.contextInitialized(Unknown Source)
    ...
Caused By: java.lang.ClassNotFoundException: oracle.ias.cache.ObjectNotFoundException
    at weblogic.utils.classloaders.GenericClassLoader.findLocalClass(GenericClassLoader.java:297)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:425)

Cause. The AccessGate WebLogic domain was created without JRF (Java Required Files). The oracle/ias/cache classes are in the JRF jar files. Fix. Recreate the WebLogic domain with JRF included.

Oracle iSupplier in a DMZ: sign-in does not work

Make sure the DMZ is set up as Oracle documents in Oracle E-Business Suite R12 Configuration in a DMZ (Doc ID 380490.1), then:

1. Run txkChangeProfH.sql with the SERVRESP argument from $FND_TOP/patch/115/sql, as that note describes.

2. Set the profile Node Trust Level to External at the DMZ node level.

3. Check the values in the DMZ context file and run AutoConfig:

   • s_webentryhost=dmz
   • s_webentrydomain=acme.example
   • s_webentryurlprotocol=https
   • s_active_webport=443
   • s_enable_sslterminator= with the # removed, if SSL ends at the load balancer
   • s_login_page=https://dmz.acme.example:443/OA_HTML/AppsLogin
   • s_external_url=https://dmz.acme.example:443

4. Check the profile options of the products you use:

   • Oracle iSupplier: POS: External URL, POS: Internal URL
   • Oracle Sourcing Supplier: PON: External Applications Framework Agent, PON: External login URL
   • Oracle iProcurement: Self Registered Employee Default Responsibility, Self Registered New User Default Responsibility

5. Check the hierarchy type of these profile options. txkChangeProfH.sql SERVRESP from the first step sets it:

On the DMZ node use ./ssogen dmzreg, not reg.

OAEA error after the 12.2.6 upgrade: URL Validation Failed

The browser shows URL Validation Failed at /OA_HTML/jsp/fnd/fnderror.jsp?text=Exception+while+updating+user+session. The AccessGate log has:

oracle.apps.fnd.ext.sso.FndSsoException: Exception while updating user session.
    at oracle.apps.fnd.ext.sso.FndSsoFilter.doFilter(Unknown Source)
Caused by: java.lang.IllegalArgumentException: Illegal empty string argument
    at oracle.apps.fnd.util.PreCondition.assertNotNull(PreCondition.java:109)

Cause 1. EBS was upgraded to 12.2.6 without the latest AccessGate patch. Apply patch 24008856, then undeploy and deploy the AccessGate:

./ssogen undeployag
./ssogen deployag

Cause 2. A 12.1 SSO registration was not cleaned up before the upgrade to 12.2. Run ./ssogen cleanup, or $FND_TOP/bin/txkrun.pl -script=SetSSOReg -removereferences=yes (cleanup runs it for you), then register again with reg.

Applications SSO Login Types (APPS_SSO_LOCAL_LOGIN): local login fails for some users

After SSO is on, /OA_HTML/AppsLogin uses SSO and /OA_HTML/AppsLocalLogin.jsp is the back door for accounts without a company login, such as SYSADMIN. If some of those cannot sign in at the back door, Applications SSO Login Types is set to SSO.

• Local allows only local logins, at /OA_HTML/AppsLocalLogin.jsp.
• SSO allows only SSO logins, at /OA_HTML/AppsLogin.
• Both allows both.

Set it to Both or Local for the user (for example SYSADMIN), or at site level. The tool sets Both at site level.

The password field in the FND User form is greyed out

You cannot set an EBS local password after enabling SSO. EBS passwords live in the FND_USER table. The cause is Applications SSO Login Types set to SSO. Set it to Both or Local, at user level or site level, to set an EBS password. Both at site level is the setting we recommend: it allows local logins and password changes.

Errors from the tool

./ssogen info changes nothing and needs no password. It prints a summary of the web server it found, for support.