Siebel SSO: Sign-In Options With SSOGEN

The Web Agent signs people in under your policy, MFA included, and hands Siebel its single sign-on user name in upper case, with no change to Siebel.

Request a trial

Siebel sees a signed-in user and nothing else.

Siebel SSO with SSOGEN gives Oracle Siebel users one sign-in with MFA, with no change to the application. The sign-in runs in the web server in front of Siebel:

Someone opens the Siebel address, and the SSOGEN Web Agent checks for a session.
If there is none, the agent sends the person to SSOGEN to sign in under your policy.
The agent passes the user name to Siebel in the single sign-on header Siebel reads, which the Web Agent sets by default.

Siebel receives its login name in the form it expects.

The Web Agent sets these values on each protected request, always replacing anything a browser sent:

What the agent sends	Value
The Siebel single sign-on user name	The application user, in upper case
The standard user names	The same user, for anything else that reads it
The email	The email address, when known

In the console, under Identify the person by, choose the attribute that equals the person’s Siebel user name. The agent sends that value as the user.

The application’s Test tab lists the exact names and values for a person. The on-premise application guide covers the full setup.

Routes for Siebel SSO

Your Siebel setup	Route
Served through Apache or Oracle HTTP Server that you control	SSOGEN Web Agent in that server
On a private network where you want nothing installed beside it	App Proxy on the SSOGEN Gateway
An application or component that offers a SAML or OpenID Connect setting	A SAML or OpenID Connect application in SSOGEN

The guide to choosing how to connect an application explains how to decide, in order.

Keep Siebel behind the web server

The agent and the application communicate through request values, so the application must accept them only from the web server.

Port. Restrict the application’s own port to the web server.
Network. Use a trusted network or TLS between the two.
Trust. You configure Siebel to trust the value in Siebel itself. Follow Oracle’s documentation for your release.

Policy, MFA and sign-out

Policy. The sign-in policy is attached to the Siebel application in SSOGEN.
MFA. MFA and step-up rules apply without any change to Siebel.
Sign-out. A link to /ssogen/logout ends the application session and, by default, the SSOGEN session too.

Questions people ask

Which identity providers work?

SSOGEN is a complete identity provider on its own. It also works with Microsoft Entra ID, Okta, Ping Identity, Keycloak or another SAML provider.

Is the same approach used for other Oracle products?

Yes. See Oracle EBS SSO, PeopleSoft SSO and JD Edwards SSO.

Where to go next

SSOGEN has protected Oracle applications in production since 2016.

Read the Web Agent page.
Then read the on-premise guide.

The login name Siebel receives