Oracle IDCS Integration with EBS and Active Directory – Complete SSO Setup Guide

Single Sign-On (SSO) has become a critical requirement for modern Oracle E-Business Suite deployments. Users expect to log in once and access all their enterprise applications seamlessly — without re-entering credentials. Oracle Identity Cloud Service (IDCS) makes this possible by providing a centralized, cloud-based identity management platform that integrates with both Oracle E-Business Suite and enterprise identity providers like Microsoft Active Directory.

In this comprehensive guide, I'll walk you through the complete integration of Oracle Identity Cloud Service (IDCS) with Oracle E-Business Suite 12.2 and Microsoft Active Directory, enabling:

• Single Sign-On (SSO) for EBS users using IDCS credentials
• Active Directory Federation so users log in with their corporate AD accounts
• Centralized user management across cloud and on-premises applications
• Multi-Factor Authentication (MFA) and adaptive security policies

This is a production-ready, step-by-step implementation guide with real commands, configuration files, and troubleshooting tips.

---

What is Oracle Identity Cloud Service (IDCS)?

Oracle Identity Cloud Service (IDCS) is Oracle's cloud-native, Identity-as-a-Service (IDaaS) platform. It provides:

• Single Sign-On (SSO) for cloud and on-premises applications
• Multi-Factor Authentication (MFA) with OTP, SMS, email, and biometric support
• User Lifecycle Management — create, update, deactivate users centrally
• Federation with external Identity Providers (IdP) — Active Directory, ADFS, Okta, Azure AD, Google
• API-driven access control and OAuth 2.0 / SAML 2.0 support
• Adaptive Security — risk-based authentication, IP whitelisting, device trust

IDCS replaces the traditional on-premises SSO stack (Oracle Access Manager + Oracle Internet Directory) with a simpler, cloud-native solution.

---

Why Integrate IDCS with EBS and Active Directory?

The Traditional EBS SSO Stack is Complex

Historically, implementing SSO for Oracle EBS required:

• Oracle Access Manager (OAM) — web SSO engine
• Oracle Internet Directory (OID) — LDAP directory
• Oracle HTTP Server (OHS) — reverse proxy with WebGate agent
• AD Sync Tools — to replicate users from Active Directory to OID

This multi-tier architecture is expensive to deploy, maintain, and upgrade.

IDCS Simplifies Everything

With IDCS:

✅ No OAM or OID required — IDCS replaces both
✅ Lightweight EBS Asserter — a small Java WAR app deployed on WebLogic
✅ Native AD Federation — SAML 2.0 federation with Active Directory Federation Services (ADFS) or AD Bridge for user sync
✅ Cloud-managed — Oracle handles patching, upgrades, and availability
✅ Works with EBS on-premises and in OCI — hybrid cloud ready

Business Benefits

• Faster Deployment — 1–2 weeks vs. 2–3 months for OAM/OID
• Lower TCO — no infrastructure to maintain
• Better Security — MFA, adaptive policies, audit logs in the cloud
• Unified User Experience — one login for EBS, cloud apps, and SaaS tools

---

Architecture Overview — How It All Fits Together

Here's the high-level integration architecture:

┌─────────────────────┐
│  End User Browser   │
└──────────┬──────────┘
           │
           │ 1. Access EBS URL
           ▼
┌──────────────────────────────┐
│   EBS Asserter (WebLogic)    │  ◄── Java WAR app
│   https://ebsasserter.com    │
└──────────┬───────────────────┘
           │
           │ 2. Redirect to IDCS for authentication
           ▼
┌──────────────────────────────┐
│  Oracle Identity Cloud       │
│  Service (IDCS)              │  ◄── Cloud Identity Provider
│  identity.oraclecloud.com    │
└──────────┬───────────────────┘
           │
           │ 3. Federate to AD FS (if AD user)
           ▼
┌──────────────────────────────┐
│  Microsoft Active Directory  │
│  Federation Services (ADFS)  │  ◄── On-Premises IdP
│  or AD Bridge                │
└──────────┬───────────────────┘
           │
           │ 4. Validate user credentials
           ▼
┌──────────────────────────────┐
│  Microsoft Active Directory  │  ◄── Enterprise LDAP
│  (Domain Controller)         │
└──────────────────────────────┘

Flow:

1. User accesses Oracle EBS URL
2. EBS redirects to EBS Asserter
3. EBS Asserter redirects to IDCS for authentication
4. IDCS offers login options: IDCS native or federated AD (via ADFS or AD Bridge)
5. User authenticates with Active Directory credentials
6. ADFS sends SAML assertion to IDCS
7. IDCS validates assertion and issues OAuth token
8. EBS Asserter exchanges token for EBS session cookie
9. User is logged into EBS — SSO complete!

---

Prerequisites — What You Need Before Starting

1. Oracle Identity Cloud Service (IDCS) Instance

You need an active IDCS tenant. If you don't have one:

• OCI Tenancy with IDCS — comes free with Oracle Cloud Free Tier
• Standalone IDCS subscription — available via Oracle sales

Check your IDCS URL format:
https://<tenant-name>.identity.oraclecloud.com

Example: https://mycompany.identity.oraclecloud.com

2. Oracle E-Business Suite Environment

Supported EBS Versions:

• Oracle EBS Release 11i (11.5.10) — with latest patches
• Oracle EBS Release 12.1.3 or later — with latest patches
• Oracle EBS Release 12.2.x — recommended

Important: EBS must NOT be integrated with OAM, OID, or any other SSO solution. If it is, remove the integration first.

Verify EBS is accessible via HTTPS (required for IDCS SSO):

https://ebs.example.com/OA_HTML/AppsLogin

3. Separate Oracle WebLogic Server 12c for EBS Asserter

Do NOT use the EBS application server for EBS Asserter. Deploy it on a dedicated WebLogic instance.

Supported Versions:

• Oracle WebLogic Server 12.1.3
• Oracle WebLogic Server 12.2.x
• Oracle WebLogic Server 14.1.1 (14c)

Java Requirements:

• Java SE Development Kit 8 (JDK 8) or Java EE 8

Domain Requirement:
⚠️ Critical: The EBS Asserter WebLogic server hostname and EBS application server hostname must be in the same domain for SSO to work.

✅ Correct:

• EBS Asserter: https://ebsasserter.example.com
• EBS Apps: https://ebs.example.com

❌ Wrong:

• EBS Asserter: https://ebsasserter.mydomain.com
• EBS Apps: https://ebs.anotherdomain.com

4. Microsoft Active Directory (Optional but Recommended)

If you want users to log in with their corporate AD credentials:

• Active Directory Domain Services (Windows Server 2012 R2 or later)
• Active Directory Federation Services (ADFS) — for SAML 2.0 federation
• OR Oracle IDCS AD Bridge — for direct user sync from AD to IDCS

5. IDCS Administrator Role

You need the Identity Domain Administrator or Security Administrator role in IDCS to:

• Register the EBS Asserter application
• Configure AD federation
• Manage users and policies

6. EBS Application DBA Access

You need SYSADMIN access in EBS to:

• Create the EBS Asserter service user
• Register the asserter application server
• Update user email addresses

7. Time Synchronization

⚠️ Critical: Ensure server clocks are synchronized across:

• EBS Asserter WebLogic server
• EBS Application server
• Active Directory server

Use NTP (Network Time Protocol) to sync all servers. SAML assertions are time-sensitive and will fail if clocks drift more than 5 minutes.

# Check time on Linux
date
timedatectl status

# Enable NTP sync
sudo systemctl enable chronyd
sudo systemctl start chronyd

---

Planning Checklist — Before You Start

Before touching any system, complete this planning checklist:

1. Network and Firewall

Ensure network connectivity:

Source	Destination	Port	Protocol	Purpose
EBS Asserter WebLogic	EBS DB	1521	TCP	JDBC connection to APPS schema
EBS Asserter WebLogic	IDCS	443	HTTPS	OAuth token exchange
User Browser	EBS Asserter	443	HTTPS	SSO login
User Browser	IDCS	443	HTTPS	Authentication
IDCS	ADFS (if used)	443	HTTPS	SAML federation
AD Bridge (if used)	AD Domain Controller	389/636	LDAP/LDAPS	User sync

2. DNS Resolution

Verify DNS resolution from all servers:

nslookup ebs.example.com
nslookup ebsasserter.example.com
nslookup mycompany.identity.oraclecloud.com
nslookup adfs.example.com

3. SSL Certificates

You need valid SSL certificates for:

• EBS Asserter WebLogic Server — signed by a trusted CA (not self-signed)
• EBS Application Server — signed by a trusted CA
• ADFS Server (if used) — signed by a trusted CA

Self-signed certificates will cause SSO failures.

4. User Identity Mapping

Decide how users will be matched between IDCS and EBS:

Attribute	EBS Column	IDCS Attribute	Recommended
Email	FND_USERS.EMAIL_ADDRESS	email	✅ Yes (most reliable)
Username	FND_USERS.USER_NAME	username	⚠️ Only if usernames match exactly

Best Practice: Use email address as the unique identifier. Ensure every EBS user has a valid email in FND_USERS.EMAIL_ADDRESS.

5. Backup

Take backups before starting:

# Backup EBS database
RMAN> BACKUP DATABASE PLUS ARCHIVELOG;

# Backup EBS configuration files
tar -czf ebs_config_backup_$(date +%Y%m%d).tar.gz $INST_TOP/appl

# Backup WebLogic domain
tar -czf wls_domain_backup_$(date +%Y%m%d).tar.gz $DOMAIN_HOME

6. Downtime Planning

No EBS downtime is required for this integration. The EBS Asserter is deployed externally, and you can test the integration before switching users to SSO.

Estimated implementation time: 6–8 hours

---

Part 1: Download and Prepare EBS Asserter

Step 1: Download EBS Asserter from IDCS

1. Sign in to Oracle Identity Cloud Service console:

   https://<tenant-name>.identity.oraclecloud.com/ui/v1/adminconsole

2. Click the Navigation Menu (≡), expand Settings, and click Downloads.

3. On the Downloads page, locate Identity Cloud Service E-Business Suite Asserter, and click Download.

4. Save the zip file: idcs-ebs-asserter-<version>.zip

   Example: idcs-ebs-asserter-19.1.4-1.2.2.zip

5. Extract the zip file on your desktop:

   unzip idcs-ebs-asserter-19.1.4-1.2.2.zip
   

6. Inside the extracted folder, you'll find:

   • ebs.war — the EBS Asserter Java application
   • idcs-wallet-<version>.jar — wallet creation utility
   • fndext.jar — EBS FND library
   • README.txt — installation guide

7. Copy ebs.war, idcs-wallet-<version>.jar, and fndext.jar to a working directory on the EBS Asserter WebLogic server:

   mkdir -p /opt/ebssdk
   cd /opt/ebssdk
   
   # Copy files from your desktop to the WebLogic server
   scp ebs.war oracle@ebsasserter.example.com:/opt/ebssdk/
   scp idcs-wallet-*.jar oracle@ebsasserter.example.com:/opt/ebssdk/
   scp fndext.jar oracle@ebsasserter.example.com:/opt/ebssdk/
   

Step 2: Copy fndext.jar to WebLogic Domain

The fndext.jar library is needed for EBS API calls.

# Log in to EBS Asserter WebLogic server
ssh oracle@ebsasserter.example.com

cd /opt/ebssdk

# Copy fndext.jar to WebLogic domain lib folder
cp fndext.jar $DOMAIN_HOME/lib/

# Verify
ls -lh $DOMAIN_HOME/lib/fndext.jar

Note: Replace $DOMAIN_HOME with your WebLogic domain path, e.g., /u01/app/oracle/middleware/user_projects/domains/ebsasserter_domain

---

Part 2: Configure Oracle E-Business Suite

Step 3: Create EBS Asserter Service User in EBS

The EBS Asserter needs a service account to communicate with the EBS database (APPS schema).

1. Log in to Oracle E-Business Suite as SYSADMIN:

   https://ebs.example.com/OA_HTML/AppsLogin

2. Navigate to: User Management → Users

3. Select User Account from the Register dropdown, and click Go.

4. In the Create User Account page, enter:

   Field	Value
   User Name	EBSASSERTER
   Password	<Strong_Password>
   Description	EBS Asserter Service Account
   Password Expire	None

5. Click Submit.

6. After the success message appears, click Assign Roles.

7. In the Assign Roles window, search by Code: UMX|APPS_SCHEMA_CONNECT

8. Select Apps Schema Connect Role and click Select.

9. Provide justification: EBS Asserter Service Account, and click Save.

10. Log out from EBS and log back in as EBSASSERTER to activate the account and set the password.

Note: Store the EBSASSERTER password securely — you'll need it later for the JDBC datasource configuration.

Step 4: Update SYSADMIN Email Address in EBS

IDCS matches users by email address. Ensure the SYSADMIN user has a valid email in EBS.

1. Log in to EBS as SYSADMIN.

2. Navigate to: User Management → Users

3. Search for User Name: SYSADMIN, and click the Update icon.

4. Update the Email field with a valid email address (e.g., sysadmin@example.com).

5. Click Apply.

Important: Use the same email address when creating the SYSADMIN user in IDCS in the next section.

Step 5: Register EBS Asserter Application Server with EBS

The EBS Asserter must be registered as a trusted application server in EBS.

1. Log in to the EBS database server as the oracle user.

2. Source the EBS environment file:

   source /u01/install/VISION/EBSapps.env
   

   Note: Replace /u01/install/VISION/EBSapps.env with your actual EBS environment file path. Find it with:

   find /u01 -name "EBSapps.env"
   

3. Locate the .dbc file for your EBS instance:

   cd $FND_SECURE
   ls -lh *.dbc
   

   Example output:

   VISION_ebs.dbc
   

   Note the full path including the filename:

   echo $FND_SECURE/VISION_ebs.dbc
   

   Example: /u01/install/VISION/fs1/inst/apps/VISION_ebs/appl/fnd/12.0.0/secure/VISION_ebs.dbc

4. Copy fndext.jar to a working directory on the EBS server:

   mkdir -p /opt/ebssdk
   cd /opt/ebssdk
   
   # Copy fndext.jar from the EBS Asserter package
   scp oracle@ebsasserter.example.com:/opt/ebssdk/fndext.jar .
   

5. Register the EBS Asserter application server:

   cd /opt/ebssdk
   
   java oracle.apps.fnd.security.AdminDesktop apps/<APPS_PASSWORD> \
     CREATE NODE_NAME=ebsasserter.example.com \
     DBC=/u01/install/VISION/fs1/inst/apps/VISION_ebs/appl/fnd/12.0.0/secure/VISION_ebs.dbc
   

   Replace:

   • <APPS_PASSWORD> — your EBS APPS schema password
   • ebsasserter.example.com — your EBS Asserter WebLogic server hostname
   • DBC path — your actual .dbc file path

   Expected Output:

   Registering ebsasserter.example.com...
   Successfully created node ebsasserter.example.com with APPL_SERVER_ID: 1234
   

6. Note the APPL_SERVER_ID — you'll need it for the bridge.properties file.

7. Verify the registration created a new .dbc file:

   cd $FND_SECURE
   ls -lh ebsasserter*.dbc
   

   Example output:

   ebsasserter.example.com_VISION.dbc
   

8. View the APPL_SERVER_ID value inside the new .dbc file:

   cat ebsasserter.example.com_VISION.dbc | grep APPL_SERVER_ID
   

   Example output:

   APPL_SERVER_ID=1234
   

9. Copy the new .dbc file to the EBS Asserter WebLogic server:

   scp ebsasserter.example.com_VISION.dbc oracle@ebsasserter.example.com:/opt/ebssdk/
   

---

Part 3: Register EBS Asserter in IDCS

Step 6: Create SYSADMIN User in IDCS

Create a user in IDCS that matches the SYSADMIN user in EBS.

1. Sign in to IDCS console:

   https://<tenant-name>.identity.oraclecloud.com/ui/v1/adminconsole

2. Click Navigation Menu (≡), and select Users.

3. Click Add.

4. In the Add User dialog, enter:

   Field	Value
   First Name	EBS
   Last Name	Sysadmin
   User Name	sysadmin
   Email	sysadmin@example.com ← same email as EBS
   Uncheck	☐ Use the email address as the user name

5. Click Finish.

Important: The email address must match exactly with the email in FND_USERS.EMAIL_ADDRESS for the SYSADMIN user in EBS.

Step 7: Register EBS Asserter as Confidential Application in IDCS

1. In the IDCS console, click Navigation Menu (≡), and select Applications.

2. Click Add.

3. Select Confidential Application.

4. In the Details tab, enter:

   Field	Value
   Name	EBS Asserter
   Description	EBS Asserter for SSO
   Application URL	https://ebsasserter.example.com/ebs
   Display in My Apps	☑ Yes

5. Click Next.

6. In the Client tab:

   • ☑ Configure this application as a client now

   • Allowed Grant Types:

     • ☑ Client Credentials
     • ☑ Authorization Code

   • Redirect URL:
     https://ebsasserter.example.com/ebs/response

   • Logout URL:
     https://ebsasserter.example.com/ebs/logout

   • Post Logout Redirect URL:
     https://ebsasserter.example.com/ebs

7. Scroll down to Grant the client access to Identity Cloud Service Admin APIs.

8. Click Add.

9. In the Add App Role dialog, select:

   • ☑ Authenticator Client
   • ☑ Me

10. Click Add.

11. Click Next through the remaining tabs (Resources, Web Tier Policy, Authorization, Trust).

12. Click Finish.

13. In the Application Added dialog:

    • Copy and save the Client ID
      Example: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

    • Copy and save the Client Secret
      Example: A1B2-C3D4-E5F6-G7H8-I9J0K1L2M3N4

    ⚠️ Important: Store these securely — you'll need them to create the wallet.

14. Click Close.

15. Click Activate to activate the application.

16. In the Activate Application dialog, click Activate Application.

Success message: The EBS Asserter application has been activated.

---

Part 4: Create IDCS Wallet for EBS Asserter

The EBS Asserter stores the IDCS Client ID, Client Secret, and IDCS Base URL in an encrypted wallet for security.

Step 8: Create the Wallet

1. Log in to the EBS Asserter WebLogic server:

   ssh oracle@ebsasserter.example.com
   

2. Navigate to the working directory:

   cd /opt/ebssdk
   

3. Run the wallet creation utility:

   java -jar idcs-wallet-<version>.jar
   

   Example:

   java -jar idcs-wallet-19.1.4.jar
   

4. The utility prompts for the following values:

   Prompt 1: Enter Wallet Path

   Enter Wallet Path: /opt/ebssdk/wallet
   

   Prompt 2: Enter Client ID

   Enter Client ID: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
   

   Prompt 3: Enter Client Secret

   Enter Client Secret: A1B2-C3D4-E5F6-G7H8-I9J0K1L2M3N4
   

   Prompt 4: Enter IDCS base URL

   Enter IDCS base URL: https://mycompany.identity.oraclecloud.com
   

   Note: Use your actual IDCS tenant URL.

5. The wallet file cwallet.sso is created in /opt/ebssdk/wallet/.

6. Verify:

   ls -lh /opt/ebssdk/wallet/cwallet.sso
   

   Expected output:

   -rw------- 1 oracle oinstall 2.5K Oct 14 10:30 /opt/ebssdk/wallet/cwallet.sso
   

Security Note: Protect the wallet file with restrictive permissions (600 or 400).

chmod 400 /opt/ebssdk/wallet/cwallet.sso

---

Part 5: Configure and Deploy EBS Asserter WAR File

Step 9: Update bridge.properties Configuration File

The bridge.properties file inside ebs.war contains all the EBS Asserter configuration parameters.

1. Log in to the EBS Asserter WebLogic server:

   ssh oracle@ebsasserter.example.com
   cd /opt/ebssdk
   

2. Extract the contents of ebs.war:

   mkdir ebs-war-extract
   cd ebs-war-extract
   jar -xvf ../ebs.war
   

3. Navigate to the WEB-INF folder:

   cd WEB-INF
   

4. Open bridge.properties for editing:

   vi bridge.properties
   

5. Uncomment and update the following parameters:

   ###########################################################
   ## SSO Bridge for E-Business Suite
   ###########################################################
   app.url=https://ebsasserter.example.com/ebs
   app.serverid=1234
   ebs.url.homepage=https://ebs.example.com/OA_HTML/OA.jsp?OAFunc=OANEWHOMEPAGE
   ebs.ds.name=ebsDS
   ebs.user.identifier=email
   idcs.iss.url=https://identity.oraclecloud.com
   idcs.aud.url=https://mycompany.identity.oraclecloud.com
   wallet.path=/opt/ebssdk/wallet/cwallet.sso
   whitelist.urls=/OA_HTML/RF.jsp,/OA_HTML/OA.jsp,/OA_HTML/BneApplicationService
   ebs.renew.session=true
   proxy.mode=false
   ###########################################################
   

   Parameter Descriptions:

   Parameter	Value	Description
   app.url	https://ebsasserter.example.com/ebs	EBS Asserter URL
   app.serverid	1234	APPL_SERVER_ID from Step 5
   ebs.url.homepage	https://ebs.example.com/OA_HTML/OA.jsp?OAFunc=OANEWHOMEPAGE	EBS home page URL
   ebs.ds.name	ebsDS	JDBC DataSource name (you'll create this in WebLogic)
   ebs.user.identifier	email	Match users by email (recommended)
   idcs.iss.url	https://identity.oraclecloud.com	IDCS issuer URL (fixed)
   idcs.aud.url	https://mycompany.identity.oraclecloud.com	Your IDCS tenant URL
   wallet.path	/opt/ebssdk/wallet/cwallet.sso	Full path to wallet
   whitelist.urls	/OA_HTML/RF.jsp,/OA_HTML/OA.jsp,...	Allowed EBS URLs
   ebs.renew.session	true	Auto-renew EBS Forms session

6. Save and exit.

7. Rebuild the ebs.war file with the updated bridge.properties:

   cd /opt/ebssdk/ebs-war-extract
   jar -cvf ../ebs-updated.war *
   

8. Verify the updated WAR file was created:

   ls -lh /opt/ebssdk/ebs-updated.war
   

Step 10: Create JDBC DataSource in WebLogic for EBS Database

The EBS Asserter needs a JDBC connection to the EBS database (APPS schema).

1. Log in to the WebLogic Server Administration Console:

   http://ebsasserter.example.com:7001/console

   Credentials: WebLogic admin username/password

2. In the left Domain Structure panel, expand Services, and click Data Sources.

3. Click New → Generic Data Source.

4. Enter the following:

   Field	Value
   Name	ebsDS ← same as ebs.ds.name in bridge.properties
   JNDI Name	jdbc/ebsDS
   Database Type	Oracle

5. Click Next.

6. Select Oracle's Driver (Thin) for Instance connections; Versions:Any and click Next.

7. Uncheck Supports Global Transactions and click Next.

8. Enter the EBS database connection details:

   Field	Value
   Database Name	VISION ← your EBS DB SID
   Host Name	ebs-db.example.com ← EBS DB server
   Port	1521
   Database User Name	EBSASSERTER ← service user from Step 3
   Password	<EBSASSERTER_password>
   Confirm Password	<EBSASSERTER_password>

9. Click Next.

10. Click Test Configuration.

    Expected output:

    Connection test succeeded.
    

    ✅ If successful, click Next.

    ❌ If it fails, verify:

    • EBS database is running
    • Firewall allows port 1521 from WebLogic to EBS DB
    • EBSASSERTER user credentials are correct
    • tnsnames.ora is not required for Thin driver

11. Select the EBSAsserter_server managed server (or your target managed server), and click Finish.

12. Click Activate Changes.

Step 11: Deploy ebs.war to WebLogic

1. In the WebLogic console, click Deployments in the left panel.

2. Click Install.

3. Click Upload your file(s).

4. Click Browse and select /opt/ebssdk/ebs-updated.war.

5. Click Next.

6. Select Install this deployment as an application, and click Next.

7. Select the EBSAsserter_server managed server as the target, and click Next.

8. Click Finish.

9. Click Activate Changes.

10. In the Deployments page, select the ebs-updated application.

11. Click Start → Servicing all requests.

12. Confirm the State column shows Active.

Step 12: Verify EBS Asserter Deployment

Test that the EBS Asserter is running:

curl -k https://ebsasserter.example.com/ebs

Expected output: You should be redirected to IDCS login page or see an HTML response (not a 404 error).

If you get a 404, check:

# Check WebLogic managed server logs
tail -f $DOMAIN_HOME/servers/EBSAsserter_server/logs/EBSAsserter_server.log

# Look for deployment errors
grep -i "error\|exception" $DOMAIN_HOME/servers/EBSAsserter_server/logs/EBSAsserter_server.log

---

Part 6: Integrate Microsoft Active Directory with IDCS

Now that EBS and IDCS are configured, let's add Active Directory so users can log in with their corporate AD credentials.

You have two options:

1. AD Federation via ADFS (SAML 2.0) — users log in through ADFS
2. AD Bridge — direct user sync from AD to IDCS

Recommended: Use ADFS if you already have it deployed. Use AD Bridge if you want automated user provisioning.

Option A: Federate IDCS with Active Directory Federation Services (ADFS)

This section covers SAML 2.0 federation between IDCS and Microsoft ADFS.

Step 13: Download ADFS Metadata

1. Access your ADFS Federation Metadata URL:

   https://adfs.example.com/FederationMetadata/2007-06/FederationMetadata.xml

   Replace adfs.example.com with your actual ADFS server hostname.

2. Save the file as FederationMetadata.xml.

Step 14: Register ADFS as Identity Provider in IDCS

1. Sign in to IDCS console.

2. Click Navigation Menu (≡) → Security → Identity Providers.

3. Click Add SAML IDP.

4. Enter:

   Field	Value
   Name	Active Directory Federation
   Description	Corporate AD SAML SSO

5. Click Next.

6. Select Import Identity Provider metadata.

7. Click Upload, select FederationMetadata.xml, and click Open.

8. Click Next.

9. Configure the User Mapping:

   Field	Value
   Oracle Identity Cloud Service User Attribute	Primary Email Address
   Requested NameID Format	Email Address

10. Click Next.

11. Click Finish.

12. Do NOT activate yet — we need to complete the ADFS side first.

Step 15: Download IDCS Metadata for ADFS

1. In the IDCS console, click Navigation Menu (≡) → Settings → Default Settings.

2. Turn ON the Access Signing Certificate option.

3. Click Save.

4. Download the IDCS SAML Metadata:

   https://<tenant-name>.identity.oraclecloud.com/fed/v1/metadata

   Example:
   https://mycompany.identity.oraclecloud.com/fed/v1/metadata

5. Save the file as IDCS_Metadata.xml.

6. Copy the file to your ADFS server (Windows Server).

Step 16: Register IDCS as Relying Party in ADFS

1. Log in to the Windows Server where ADFS is installed.

2. Open Server Manager → Tools → AD FS Management.

3. In the AD FS console, expand Trust Relationships, right-click Relying Party Trusts, and select Add Relying Party Trust.

4. Click Start.

5. Select Import data about the relying party from a file, and browse to IDCS_Metadata.xml.

6. Click Next.

7. Enter Display name: Oracle Identity Cloud Service

8. Click Next.

9. Select Permit all users to access this relying party.

10. Click Next → Next → Close.

Step 17: Configure Claim Rules in ADFS

ADFS needs to send the user's email address as the NameID claim.

1. In the AD FS Management console, right-click Oracle Identity Cloud Service relying party, and select Edit Claim Issuance Policy.

2. Click Add Rule.

3. Select Send LDAP Attributes as Claims and click Next.

4. Enter:

   Field	Value
   Claim rule name	Email
   Attribute store	Active Directory
   LDAP Attribute	E-Mail-Addresses
   Outgoing Claim Type	E-Mail Address

5. Click Finish.

6. Click Add Rule again.

7. Select Transform an Incoming Claim and click Next.

8. Enter:

   Field	Value
   Claim rule name	Name ID
   Incoming claim type	E-Mail Address
   Outgoing claim type	Name ID
   Outgoing name ID format	Email

9. Click Finish → OK.

Step 18: Test and Activate ADFS Identity Provider in IDCS

1. Return to IDCS console → Security → Identity Providers.

2. Click the Active Directory Federation IdP.

3. Click Test Login.

4. You are redirected to ADFS login page.

5. Enter your Active Directory credentials (e.g., csaladna@example.com).

6. If authentication succeeds, you'll see: Connection Successful.

   ✅ If successful:

   • Click Close
   • Click Activate
   • Click Show on Login Page

   ❌ If it fails:

   • Click Show Assertion Details to see the SAML error
   • Verify claim rules are correct in ADFS
   • Check ADFS event logs (Server Manager → AD FS → Events)

7. Add the IdP to the Default Identity Provider Policy:

   • Navigate to Security → IDP Policies
   • Click Default Identity Provider Policy
   • Click the Identity Providers tab
   • Click Assign
   • Select Active Directory Federation and click OK

Done! ADFS is now federated with IDCS.

Option B: Configure AD Bridge for Direct User Sync

If you don't have ADFS, use the IDCS AD Bridge to sync users directly from Active Directory to IDCS.

Step 19: Download and Install AD Bridge

1. In the IDCS console, click Navigation Menu (≡) → Settings → Directory Integrations.

2. Click Add.

3. Select Microsoft Active Directory.

4. Enter:

   Field	Value
   Name	Corporate AD Bridge
   Description	User sync from on-premises AD

5. Click Download to download the AD Bridge installer (IDCSIntegration.zip).

6. Copy the zip file to a Windows Server that has network access to your Active Directory Domain Controller.

7. Extract the zip file and run the installer:

   IDCSIntegration.exe
   

8. Follow the wizard:

   • Accept the license
   • Select installation directory (e.g., C:\Oracle\IDCSBridge)
   • Enter IDCS Tenant URL: https://mycompany.identity.oraclecloud.com
   • Enter IDCS Admin Username and Password
   • Click Install

9. After installation completes, the IDCS Bridge Configuration tool opens.

Step 20: Configure AD Bridge Synchronization

1. In the IDCS Bridge Configuration tool, click Configure.

2. Enter the Active Directory connection details:

   Field	Value
   AD Server	ad.example.com
   Port	389 (LDAP) or 636 (LDAPS — recommended)
   Base DN	DC=example,DC=com
   Bind DN	CN=IDCSSync,CN=Users,DC=example,DC=com
   Password	<service_account_password>

   Note: Create a dedicated AD service account (IDCSSync) with Read permissions on user objects.

3. Click Test Connection.

   ✅ Expected: "Connection successful"

4. Click Next.

5. Select the Organizational Units (OUs) to sync:

   • ☑ OU=Employees,DC=example,DC=com
   • ☑ OU=Contractors,DC=example,DC=com

6. Click Next.

7. Configure Attribute Mapping:

   AD Attribute	IDCS Attribute
   sAMAccountName	userName
   mail	email
   givenName	firstName
   sn	lastName

8. Click Next.

9. Select Synchronization Schedule:

   • ☑ Enable scheduled sync
   • Frequency: Every 1 hour

10. Click Finish.

11. Click Run Sync Now to perform the initial synchronization.

12. Monitor the sync progress in the Logs tab.

Verification:

1. In the IDCS console, click Users.
2. You should see users from Active Directory synced to IDCS.

---

Part 7: Test the Complete SSO Flow

Step 21: Assign EBS Asserter Application to Test User

1. In IDCS console, click Applications.

2. Click EBS Asserter.

3. Click the Application Users tab.

4. Click Assign.

5. Search for a test user (e.g., sysadmin or an AD-synced user).

6. Select the user and click OK.

Step 22: Test SSO Login

1. Open a new private/incognito browser window.

2. Access the EBS Asserter URL:

   https://ebsasserter.example.com/ebs

3. You are redirected to the IDCS login page.

4. If ADFS federation is enabled, you'll see:

   • Sign in with Oracle Identity Cloud Service (IDCS native login)
   • Sign in with Active Directory Federation (ADFS login)

5. Click Sign in with Active Directory Federation.

6. You are redirected to ADFS login page.

7. Enter your Active Directory credentials (e.g., csaladna@example.com).

8. After successful authentication, you are redirected back to IDCS.

9. IDCS validates the SAML assertion and redirects to EBS Asserter.

10. EBS Asserter creates an EBS session cookie and redirects to Oracle E-Business Suite.

11. Oracle EBS Home page opens — you are logged in!

✅ Success! SSO is working end-to-end:

User → EBS Asserter → IDCS → ADFS → Active Directory → IDCS → EBS Asserter → EBS

Step 23: Test Logout

1. In Oracle EBS, click Logout.

2. You are redirected to EBS Asserter logout → IDCS logout.

3. IDCS clears the session and redirects to the IDCS login page.

4. Try accessing EBS again — you are prompted to log in (session is cleared).

✅ Logout works correctly.

---

Troubleshooting — Common Errors and Fixes

⚠️ Issue 1: "Connection to IDCS failed" in EBS Asserter

Root Cause: Wallet path is incorrect or wallet file is missing.

Fix:

Check the bridge.properties wallet path:

cd /opt/ebssdk/ebs-war-extract/WEB-INF
grep wallet.path bridge.properties

Verify the wallet file exists:

ls -lh /opt/ebssdk/wallet/cwallet.sso

If missing, recreate the wallet (Step 8).

---

⚠️ Issue 2: "JDBC DataSource not found" Error

Root Cause: The ebs.ds.name in bridge.properties does not match the JNDI name in WebLogic.

Fix:

1. Check the DataSource JNDI name in WebLogic console: Services → Data Sources → ebsDS.

2. Update bridge.properties:

   ebs.ds.name=ebsDS
   

3. Rebuild ebs.war and redeploy (Steps 9–11).

---

⚠️ Issue 3: "User not found in EBS" After SSO Login

Root Cause: Email address mismatch between IDCS and EBS.

Fix:

1. Check the user's email in IDCS:

   • IDCS console → Users → search for the user
   • Note the Email field

2. Check the user's email in EBS:

   SQL> SELECT user_name, email_address 
        FROM fnd_users 
        WHERE user_name = 'SYSADMIN';
   

3. Ensure they match exactly (case-insensitive).

4. If they don't match, update EBS:

   SQL> UPDATE fnd_users 
        SET email_address = 'sysadmin@example.com' 
        WHERE user_name = 'SYSADMIN';
   SQL> COMMIT;
   

---

⚠️ Issue 4: ADFS SAML Assertion Fails ("Connection Failed" in IDCS)

Root Cause: SAML claim rules are incorrect in ADFS.

Fix:

1. In IDCS, click the failed test and click Show Assertion Details.

2. Look for the <samlp:Status> error message.

3. Common errors:

   Error	Cause	Fix
   urn:oasis:names:tc:SAML:2.0:status:Requester	Missing NameID claim	Verify Name ID transform claim rule in ADFS
   No email attribute	Email claim not sent	Verify Email LDAP attribute claim rule in ADFS
   Time mismatch	Server clocks out of sync	Sync clocks with NTP on ADFS and IDCS

4. Fix the claim rules in ADFS (Step 17) and retest.

---

⚠️ Issue 5: "Internal Server Error" in EBS Asserter

Root Cause: Missing or incorrect APPL_SERVER_ID in bridge.properties.

Fix:

1. Check the .dbc file for the correct APPL_SERVER_ID:

   cat /opt/ebssdk/ebsasserter.example.com_VISION.dbc | grep APPL_SERVER_ID
   

2. Update bridge.properties:

   app.serverid=1234
   

3. Rebuild ebs.war and redeploy.

---

⚠️ Issue 6: EBS Asserter and EBS Not in Same Domain

Symptom: SSO login succeeds, but EBS shows the login page again (no session cookie).

Root Cause: Cookies cannot be shared across different domains.

Fix:

Ensure both hostnames are in the same domain:

✅ Correct:

• EBS Asserter: ebsasserter.example.com
• EBS: ebs.example.com

❌ Wrong:

• EBS Asserter: ebsasserter.domain1.com
• EBS: ebs.domain2.com

If they're in different domains, you must reconfigure DNS or use a reverse proxy.

---

⚠️ Issue 7: AD Bridge Sync Fails

Root Cause: Insufficient AD permissions for the sync service account.

Fix:

1. In Active Directory Users and Computers, right-click the Base DN (e.g., DC=example,DC=com).

2. Select Properties → Security → Advanced.

3. Click Add and select the IDCSSync service account.

4. Grant the following permissions:

   • ☑ Read all properties
   • ☑ Read permissions
   • ☑ List contents

5. Click OK and retry the sync.

---

Best Practices — Production Deployment

1. Use SSL/TLS Everywhere

All communication must be encrypted:

• EBS Asserter WebLogic → HTTPS only
• EBS Application → HTTPS only
• ADFS → HTTPS only

Use valid SSL certificates signed by a trusted CA (not self-signed).

2. Enable MFA in IDCS

Add an extra layer of security:

1. In IDCS console, navigate to Security → MFA.
2. Enable Time-Based One-Time Password (TOTP) or SMS.
3. Assign MFA enrollment to users.

3. Configure Sign-On Policies

Restrict access based on IP, device, or risk:

1. Navigate to Security → Sign-On Policies.
2. Create a policy for EBS Asserter application.
3. Add rules:
   • Require MFA if user is outside corporate network
   • Block sign-in from blacklisted countries

4. Monitor IDCS Audit Logs

Track authentication events:

1. Navigate to Reports → Audit Reports.
2. Export logs to a SIEM (e.g., Splunk, Oracle Management Cloud).

5. High Availability for EBS Asserter

Deploy multiple EBS Asserter instances behind a load balancer:

• Load Balancer (F5, OHS, OCI Load Balancer) → ebsasserter.example.com
• EBS Asserter 1 → WebLogic Managed Server 1
• EBS Asserter 2 → WebLogic Managed Server 2

Session affinity (sticky sessions) is not required — IDCS handles session state.

6. Backup the Wallet

The wallet contains the IDCS credentials. Back it up securely:

cp /opt/ebssdk/wallet/cwallet.sso /backup/cwallet.sso.$(date +%Y%m%d)
chmod 400 /backup/cwallet.sso.*

7. Test Regularly

Schedule quarterly SSO testing:

• Test login with IDCS native users
• Test login with AD-federated users
• Test logout flow
• Test MFA enrollment and authentication
• Verify AD Bridge sync is running

8. Keep EBS Asserter Updated

Oracle releases new versions of the EBS Asserter with bug fixes and new features. Check for updates quarterly in IDCS console → Settings → Downloads.

9. Document Your Configuration

Create a runbook that includes:

• EBS Asserter server details (hostname, IP, WebLogic version)
• IDCS tenant URL and Client ID
• ADFS server details
• Firewall rules
• DNS entries
• Service account credentials (stored securely)

---

Summary

Congratulations! You've successfully integrated Oracle Identity Cloud Service (IDCS) with Oracle E-Business Suite and Active Directory for Single Sign-On. Here's what you accomplished:

1. Downloaded and prepared the EBS Asserter package
2. Created the EBS Asserter service account in EBS
3. Registered the EBS Asserter application server with EBS
4. Registered EBS Asserter as a confidential application in IDCS
5. Created an encrypted wallet for IDCS credentials
6. Configured and deployed the EBS Asserter WAR file to WebLogic
7. Federated IDCS with Active Directory using ADFS or AD Bridge
8. Tested the complete SSO flow — EBS → IDCS → AD → EBS
9. Troubleshot common errors and verified production readiness

Users can now log in to Oracle E-Business Suite using their corporate Active Directory credentials through a simple, cloud-managed SSO solution — no OAM or OID required.

This integration gives you:

• Simplified architecture — fewer moving parts
• Centralized identity management — one place to manage users
• Enhanced security — MFA, adaptive policies, audit logs
• Cloud-native scalability — IDCS handles high availability
• Hybrid flexibility — works with EBS on-premises or in OCI

Please do like and subscribe to my youtube channel: https://www.youtube.com/@foalabs
If you like this post please follow, share and comment

---

FAQ

Q1: Can I use IDCS with EBS 11i?
Yes, EBS Asserter supports Oracle E-Business Suite Release 11i (11.5.10) with the latest patches applied. However, Oracle recommends upgrading to EBS 12.2 for the best experience.

Q2: Do I need to remove my existing OAM/OID integration before using IDCS?
Yes. EBS cannot be integrated with both OAM/OID and IDCS simultaneously. You must remove the OAM/OID integration, restart the EBS application tier, and then proceed with IDCS integration.

Q3: Can I use IDCS with EBS running on OCI?
Absolutely. IDCS works seamlessly with EBS deployed on Oracle Cloud Infrastructure (OCI), including EBS Cloud Manager provisioned instances.

Q4: What if my users have different usernames in AD and EBS?
Use email address as the unique identifier (ebs.user.identifier=email in bridge.properties). Ensure every user has a valid, matching email in both AD and EBS (FND_USERS.EMAIL_ADDRESS).

Q5: Can I enforce MFA for only certain users?
Yes. In IDCS, create a Sign-On Policy specific to the EBS Asserter application. Add rules to require MFA for specific groups (e.g., EBS_Admins) or network conditions (e.g., outside corporate IP range).

Q6: How do I upgrade the EBS Asserter to a new version?
Download the latest EBS Asserter from IDCS console → Settings → Downloads. Extract the new ebs.war, update bridge.properties with your existing configuration, rebuild the WAR, and redeploy it to WebLogic. No EBS downtime is required.

Q7: Can I use Google Workspace or Okta instead of Active Directory?
Yes. IDCS supports SAML 2.0 federation with any SAML-compliant IdP, including Google Workspace, Okta, Azure AD, Ping Identity, and others. The integration steps are similar to ADFS (download metadata, register as IdP, configure claim mapping).