Oracle EBS Ping SSO with PingFederate and PingOne

EBS does not support SAML directly, so SSOGEN bridges the two as a service provider in your Ping SAML identity provider.

Request a trial

The service provider values for Ping are on the page.

Oracle HTTP Server with the SSOGEN Web Agent sends the browser to a sign-in source, then opens EBS as the EBS user.

Two steps: run the SSOGEN tool on the web tier, then finish the sign-on setting in PeopleSoft, JD Edwards or EBS.

A person opens https://ebs.acme.example/OA_HTML/AppsLogin.
The SSOGEN Web Agent on the EBS web tier sends the browser to SSOGEN, which sends it to Ping.
Ping signs the person in. After a successful sign-in the browser returns to the EBS home page through SSOGEN.

The experience is the same as for any other application behind Ping. SSOGEN does not show a page in between. No Oracle Access Manager, Oracle Internet Directory or Oracle Unified Directory is needed, and PeopleSoft and JD Edwards use the same Ping setup.

What you need

A Ping administrator: PingFederate, or PingOne with your Environment ID.
Oracle E-Business Suite 12.2 or 12.1, and the SSOGEN integration tool for it.
An SSOGEN tenant, https://acme.ssogen.ai, or a license key for the direct path below.

Path A: through SSOGEN

In Ping

Add SSOGEN as a SAML service provider (a SAML application in PingOne):

Ping asks for	Value
Entity ID	`https://acme.ssogen.ai/saml/sp/pingone`
ACS URL, binding HTTP-POST	`https://acme.ssogen.ai/saml/sp/pingone/acs`
Signing	Sign the assertion; Name ID format unspecified or emailAddress
Attribute	`email` mapped to the email address; `saml_subject` mapped to a stable sign-in name
Access	The group that may use EBS

In PingFederate the same values go into an SP connection with the browser SSO profile. The PingOne screens, the OpenID Connect option (issuer https://auth.pingone.com/<Environment ID>/as) and the errors are on PingOne as the sign-in source. For PingFederate, any SAML identity provider lists what the provider must send.

In SSOGEN

Import the Ping metadata and map email. Then create, validate, test, try and activate the provider. Allow it in the policy that covers EBS (Add a SAML identity provider in SSOGEN).

On the EBS side

Register EBS in SSOGEN as a Web Agent application with the Client URL https://ebs.acme.example. Set Identify the person by to the value that equals the EBS user name: jdoe or JDOE for the EBS user JDOE. The agent sends it in capitals and never cuts off a domain part.
Run the tool and finish the setting in EBS as on the Oracle EBS single sign-on page.
Create the EBS users; EBS links the account at the first sign-in. Keep https://ebs.acme.example/OA_HTML/AppsLocalLogin.jsp for SYSADMIN.

Path B: straight to Ping, no SSOGEN in between

With a license key from SSOGEN, the tool connects the EBS web tier to Ping directly (-mode=saml).

Ping asks for	Value
Entity ID	`https://ebs.acme.example`
ACS URL	`https://ebs.acme.example/ssogen/acs`
Signing	Sign the assertion
Name ID or `saml_subject`	The EBS user name

Save the Ping metadata as ebs-internal-idp.xml in the ssogen folder, or set SSOGENSamlIdpMetadataURL, and run the tool as on the EBS page. For OpenID Connect use -mode=oidc with the redirect URI https://ebs.acme.example/ssogen/oidc/callback.

If it does not work

Symptom	What to do
Try connection says the assertion carried no subject	Ping sends no Name ID. Map `saml_subject` or configure a Name ID.
One person gets a new account at each sign-in	Ping sends a transient Name ID. Send a stable one.
Sign-in works, EBS does not know the user	The name sent is not an EBS user name. Change Identify the person by, or what Ping sends.
Sign-ins stop after Ping changes its signing certificate	Fetch the metadata again and activate it.

Okta, Microsoft Entra ID, AD FS, any SAML provider, multi-factor.

How a sign-in goes