SSOGEN / Oracle IDCS Alternative: Single Sign-On for EBS Without the Bridge
Compare
Oracle IDCS Alternative: Single Sign-On for EBS Without the Bridge
The Web Agent in your EBS web tier does the bridge job Oracle describes for IDCS, and your own identity provider stays the place people sign in.
If you searched for Oracle IDCS, you are in one of two situations. EBS single sign-on is on your plan and the security guide named IDCS as one of two documented options, or IDCS is already in your estate and you want to know what an alternative replaces.
Oracle Identity Cloud Service is the bridge Oracle’s EBS 12.2 documentation describes between E-Business Suite and a third-party sign-in.
SSOGEN delivers EBS single sign-on without that bridge: the Web Agent in your web tier signs each person in and hands EBS the user it expects. The plan below keeps IDCS in place while you test one instance.
What we say about Oracle comes from Oracle’s own documentation, read on 2026-10-09, and is linked where it appears. Oracle products change.
Check Oracle’s pages for the release you run, including whether a newer EBS 12.2 Security Guide edition says the same as the one linked here.
What the name means in Oracle’s documentation
Oracle uses more than one name for related services. This table lists only what Oracle’s pages say.
| Where you see it | Name used | What Oracle’s page says |
|---|---|---|
| EBS 12.2 Security Guide | Oracle Identity Cloud Service (IDCS) | One of two single sign-on integration options for EBS, the other being Oracle Access Manager with Oracle Internet Directory or Oracle Unified Directory (Security Guide, read 2026-10-09) |
| Oracle Help Center, IDCS getting started | Oracle Identity Cloud Service | Oracle describes IDCS as a “fully integrated service that delivers all the core identity and access management capabilities”, running multi-tenant in the cloud; the same guide has sections on MFA settings, identity providers and provisioning (IDCS documentation, read 2026-10-09) |
| Oracle Cloud Infrastructure documentation | Identity domain, in OCI IAM | “A container for managing users and roles, federating and provisioning of users, secure application integration through Oracle Single Sign-On (SSO) configuration, and OAuth administration”; it represents a user population in Oracle Cloud Infrastructure with its configurations and security settings such as MFA (Identity domains, read 2026-10-09) |
The identity domains page also says where each is administered (read 2026-10-09):
- IDCS Admin Console. If you sign in and see it, your stripes have not been migrated into IAM and you do not have access to identity domains.
- Domains. Identity domains appear as Domains under Identity & Security in the Oracle Cloud Console.
Which one you see depends on your tenancy. Ask your Oracle contact how the EBS guide’s option maps to what you run.
What the bridge does for EBS sign-on
Oracle’s 12.2 guide says that if a third-party authentication mechanism is used, Oracle Access Manager with a directory, or IDCS, is still required: “they provide bridge functionality between Oracle E-Business Suite and the third-party single sign-on solution”.
It adds: “Direct integration with third-party authentication systems and third-party directory services is not supported.” This is Oracle’s statement about Oracle’s supported configurations.
From that guide, SSOGEN sees three jobs for IDCS in an EBS estate (our reading, not Oracle’s wording):
- Be the thing EBS trusts. EBS trusts the bridge service, not your identity provider.
- Pass through your sign-in. Your own provider (Entra ID, Okta, Ping Identity, AD FS, a directory) authenticates the person and the bridge relays the result.
- Hand EBS a user it can map. The signed-in person has to resolve to an EBS user.
SSOGEN does all three, as the table further down shows.
When Oracle IDCS is the better fit
- Your support or audit position names it. If Oracle support terms or an auditor require the configuration the Security Guide documents, follow that. The SSOGEN path is designed, documented and supported by SSOGEN.
- You use it for more than EBS. If IDCS or identity domains already sign people in to Oracle Cloud applications, Oracle’s service is the natural one place for them.
- You want Oracle to host the identity service. Oracle’s Get Started page describes it as running multi-tenant in the cloud.
When SSOGEN fits
SSOGEN is the stronger choice when:
- Your existing identity provider stays as the sign-in source for SSOGEN, with no Oracle identity service in the path.
- You want the same approach for PeopleSoft, JD Edwards and non-Oracle applications, with one policy, MFA and audit log.
- You want it hosted by SSOGEN or on your own servers. Both are offered.
- AI agents need owned identities and per-tool permissions. See AI agent identity and the MCP Gateway.
Two facts support the choice:
- Production record. SSOGEN has protected Oracle applications in production since 2016.
- Entra gallery. Microsoft lists SSOGEN in the Microsoft Entra gallery.
How SSOGEN covers each job
| Job IDCS does in the design | EBS 12.2 without it |
|---|---|
| Be the thing EBS trusts | The Web Agent in the EBS web tier is registered in SSOGEN. It signs the person in through SSOGEN and passes the user to EBS in request headers |
| Pass through your sign-in | SSOGEN signs the person in itself, or takes the sign-in from your own SAML or OpenID Connect provider |
| Hand EBS a user it can map | EBS profile options for external single sign-on, such as Applications SSO Auto Link User, set to the values for your EBS release. EBS maps the user whose name equals the one the agent sends |
| Keep a local login for some accounts | SSO users sign in at /OA_HTML/AppsLogin, while accounts that are not SSO users, such as SYSADMIN, keep the EBS local login at /OA_HTML/AppsLocalLogin.jsp. See Oracle EBS single sign-on |
Oracle EBS SSO has the commands and profile options. It also has one guide per provider:
- Microsoft Entra ID. Microsoft Entra ID.
- Okta. Okta.
- Ping Identity. Ping Identity.
- AD FS. AD FS.
- Active Directory. Active Directory.
What SSOGEN covers
- Oracle applications in your web tier. EBS, PeopleSoft and JD Edwards sign in through the Web Agent in Apache or Oracle HTTP Server.
- Applications with no web server you control. The SSOGEN Gateway publishes them, with nothing installed next to the application.
Oracle’s own support statement stays as Oracle wrote it. Nothing on this page changes what Oracle says it supports.
A migration order that keeps IDCS available
- Write down what IDCS or the identity domain does for each EBS instance: the provider behind it, the MFA rules, the user mapping.
- Clone one non-production instance.
- Register it in SSOGEN and protect it with the Web Agent and sign in with a test account from each user group.
- Compare the user name EBS receives with what it received before, using a few real accounts.
- Check local login and sign-out.
- Move one production instance, keeping the previous path ready to restore.
- Retire the IDCS configuration for EBS only when nothing else depends on it.
Questions people ask
Is Oracle IDCS required for EBS single sign-on?
Not with SSOGEN. The Web Agent signs people in to EBS with no IDCS and no Oracle Access Manager. Oracle’s 12.2 Security Guide lists those two as its documented options, so check how the SSOGEN path fits your Oracle support arrangement before you decide. Nothing here changes Oracle’s stated support position.
Is Oracle Identity Cloud Service the same as an identity domain?
Oracle’s documentation describes identity domains in OCI IAM, and describes IDCS in its own pages. It says you see the IDCS Admin Console if your stripes have not been migrated into IAM, and Domains if they have. Oracle can tell you how the two relate for your tenancy.
How does a move from IDCS to SSOGEN work?
One application at a time. You register each application in SSOGEN separately, so one EBS instance moves to SSOGEN while the others stay on IDCS. Test that instance on a clone first and confirm your support position with Oracle.
Where to go next
- Start with Oracle EBS SSO.
- Compare the older Oracle stack in Oracle Access Manager alternative.
- Read how to choose a connection method.
- For a row-by-row reference, see the Oracle IDCS vs SSOGEN comparison.
Sources, all read 2026-10-09: Oracle E-Business Suite 12.2 Security Guide; Oracle Identity Cloud Service Get Started; Oracle Cloud Infrastructure Overview of IAM.
About this comparison. SSOGEN Corporation prepared this page from Oracle’s public documentation and web pages, last read on 2026-10-09.
We took care to be accurate, but products, plans and prices change, and we may have misread or missed something, so some statements may be wrong or out of date. This page is for general information only and comes without any warranty.
SSOGEN is not responsible for errors, omissions or decisions made from it. Check the vendor’s own pages and test the products yourself before you decide. If you see a mistake, tell us and we will correct it.
Oracle, Oracle Identity Cloud Service, Oracle E-Business Suite, Oracle Access Manager, Oracle Internet Directory, Oracle Unified Directory, Oracle Cloud Infrastructure, Oracle Cloud, Oracle HTTP Server, Oracle SSO, OCI IAM, PeopleSoft, JD Edwards and Apache are trademarks or product names of their respective owners.
Microsoft Entra ID, Okta, Ping Identity, AD FS and Active Directory are product names of their respective owners. SSOGEN is an Oracle partner, but Oracle has not reviewed or endorsed this page.
Except for Oracle, the owners named are not affiliated with, endorsed by or sponsored by SSOGEN.