{"id":6969,"date":"2022-06-10T05:31:28","date_gmt":"2022-06-10T05:31:28","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/implementation-of-duo-and-saml-in-e-business-suite-12-2\/"},"modified":"2026-11-03T19:27:20","modified_gmt":"2026-11-03T19:27:20","slug":"implementation-of-duo-and-saml-in-e-business-suite-12-2","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/de\/blogs\/implementation-of-duo-and-saml-in-e-business-suite-12-2\/","title":{"rendered":"Implementation of DUO and SAML in E-business suite 12-2"},"content":{"rendered":"<p>This blog covers steps on how to implement Multi Factor Authentication (MFA) for E-business suite, and Security Assertion Markup Language (SAML). MFA is used for authenticating the identity of a user requiring a user to present two or more pieces of evidence, or factors, for authentication.<\/p>\n<p>Security Assertion Markup Language consists of two parties including:<\/p>\n<ul>\n<li>Identity Provider \u2014 &gt; Performs authentication and passes the user&#8217;s identity and authorization level to the service provider.<\/li>\n<li>Service Provider \u2014 &gt; Trusts the identity provider and authorizes the given user to access the requested resource.<\/li>\n<\/ul>\n<p>SAML works through exchange of information between the two above trusted entities.<\/p>\n<p><strong>Requirements<\/strong><\/p>\n<p>To begin with, users need to login to Duo portal or duo dashboard once. Once on the portal. the user can directly click on the E-business icon, without requiring any user-id or password authentication. Client might have a different portal, but in this example, I am working on the Duo central portal. All applications as highlighted in the following snapshot, do not require the user login.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture1_1.png\" alt=\"Implementation of DUO and SAML 1\" \/><\/p>\n<p>After you click on Oracle EBS icon, a page will be displayed with responsibilities.<\/p>\n<p>We can implement above requirement with Security Assertion Markup Language (SAML)&nbsp;<\/p>\n<p><strong>Pre-requisites for Implementing Duo:<\/strong><\/p>\n<p>We have one working E-business suite integrated with Access Manager. Oracle unified Directory used as back-end user directory. &nbsp;OAM managed server should be running in SSL mode.<\/p>\n<p><strong>Steps for implementing Multi Factor Authentication for EBS 12.2 using Duo setup:<\/strong><\/p>\n<ul>\n<li>You need to first download DuoUniversalPlugin.jar from the following URL to a local desktop. [Download Link:&nbsp;https:\/\/github.com\/duosecurity\/duo_universal_oam\/releases\/latest\/download\/DuoUniversalPlugin.jar)]<\/li>\n<li>Log in to OAM Console (URL is just an example) [Localhost Link] http:\/\/localhost.domain.com:8001\/oamconsole)<\/li>\n<li>Under Authentication Plugins, once the page is loaded click on &#8216;Import Plug-in&#8217;&#8230;.<\/li>\n<li>Browse the file DuoUniversalPlugin.jar which is downloaded and click on &#8216;import&#8217;.<\/li>\n<li>Once uploaded, select DuoUniversalPlugin which should be in the uploaded status.<\/li>\n<li>Client ID, Client Secret, Client Secret values are provided by duo admin team.<\/li>\n<li>Redirect URL: OAM instance ( https:\/\/&lt;&lt;oam-server-host&gt;&gt;:&lt;&lt;port&gt;&gt;\/oam\/server\/auth_cred_submit)<\/li>\n<li>Fail Mode: Open<\/li>\n<li>User Store: OIDIdentityStore<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture2_2.png\" alt=\"DUO and SAML Picture 2\" \/><\/p>\n<p><strong>&nbsp;<\/strong><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture3_1.png\" alt=\"DUO and SAML Picture 3\" \/><\/p>\n<ul>\n<li>Save after entering the values.<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture4_1.png\" alt=\"DUO and SAML Picture 4\" \/><\/p>\n<ul>\n<li>At the top of plugin, it will show as &#8220;Distribute Selected&#8221;, you need to click on it and refresh to change the &#8220;Activation Status&#8221; to Distributed.<\/li>\n<li>Then click on activate to change &#8220;Activation Status&#8221; to Activated<\/li>\n<li>Once the plugin &nbsp;is activated, you need to create a custom authentication module.<\/li>\n<li>In the next step, you need to Modify Plugins, the *UserIdentificationPlugIn* and *UserAuthenticationPlugIn*&nbsp;<\/li>\n<li>for parameter &#8211; &nbsp;KEY_IDENTITY_STORE_REF to OIDIdentityStore&nbsp;<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture5_0.png\" alt=\"DUO and SAML Picture 5\" \/><\/p>\n<ul>\n<li>In Oracle Access manager Console, click on \u201cAuthentication Modules\u201d, under &#8220;Plug-ins&#8221;<\/li>\n<li>Select Custom Authentication module, give name as LDAP_DUO (u can name any)<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture6.png\" alt=\"DUO and SAML Picture 6\" \/><\/p>\n<p><strong>&nbsp;<\/strong><\/p>\n<ul>\n<li>Click on the tab steps to add the following lines with step name and plugin name.<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture7.png\" alt=\"DUO and SAML Picture 7\" \/><\/p>\n<ul>\n<li>In the steps Orchestration tab, you need to add three steps with Duonuiversal, uid and uid2. Ideally, we are specifying what needs to be done by OAM in case of a successful and failed login.<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture8.png\" alt=\"DUO and SAML Picture 8\" \/><\/p>\n<ul>\n<li>Once the Authentication Moule is created, you need to change EBsauthscehme to LDAP_DUO from LDAP_EBS by navigating to Launchpad &gt;Authentication scheme &gt;<\/li>\n<li>EBsauthscehme is the scheme which gets created while registration with OAM and is used by default for authentication which needs to be changed.<\/li>\n<li>By completing the above steps, we have successfully implemented the multifactor Duo authentication, and once you login, the following window pops up.<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture9.png\" alt=\"DUO and SAML Picture 9 \" \/><\/p>\n<p><strong>&nbsp;<\/strong><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture10.png\" alt=\"DUO and SAML Picture 10\" \/><\/p>\n<p><strong>Implementing SAML to enable single click &nbsp;Authentication from Duo Central<br \/>\n=================================================================<\/strong><\/p>\n<p>In duo portal, icons created by duo admin team and in Access manager we perform the following steps:&nbsp;<\/p>\n<p><strong>Step 1: Enable the Federation Services&nbsp;<\/strong><\/p>\n<p>In OAM console click on Federation.<br \/>\n-Click on the &#8220;Available Services&#8221; button&nbsp;&nbsp; &nbsp;<br \/>\n-Click the &#8220;Enable Service&#8221; button in the Identity Federation row<br \/>\n-Complete the following steps using wlst.sh<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Code.PNG\" alt=\"DUO and SAML Code\" \/><\/p>\n<p>&#8211; Connect to the AdminServer as the weblogic administrator user using the connect() command.<\/p>\n<p>&#8211; Switch to the runtime context using the domainRuntime() command.<\/p>\n<p>&#8211; Enable the Federation SP service using the command configureFederationService(&#8220;sp&#8221;,&#8221;true&#8221;)<\/p>\n<p>&#8211; Optionally, enable the Federation IdP service using the command<strong> <\/strong><\/p>\n<p><strong><em>configureFederationService(&#8220;idp&#8221;,&#8221;true&#8221;) (**)<\/em><\/strong><\/p>\n<p>&#8211; Enable the Federation SP Test Engine (Web Page that allows testing with IdP partners without use of protected resources) using the command configureTestSPEngine(&#8220;true&#8221;)&nbsp;&nbsp;<\/p>\n<p>Following are examples of the commands<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_technical_images\/25941-body-Code-2.PNG\" alt=\"DUO and SAML Code 2\" \/><\/p>\n<p>Command was successful.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_technical_images\/25941-body-Code-3.PNG\" alt=\"DUO and SAML Code 3\" \/><\/p>\n<p><strong>&nbsp;<\/strong><br \/>\nCommand was successful.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_technical_images\/25941-body-code-4.PNG\" alt=\"DUO and SAML Code 4\" \/><\/p>\n<p><strong>&nbsp;<\/strong><\/p>\n<p><strong>Step 2 : Create Identity Provider<\/strong><\/p>\n<p>You need to request metadata of Duo portal as xml file from Duo admin team that can be imported by completing the following steps.<\/p>\n<p>Once received, create Identity Provider Partner by completing the following steps.<\/p>\n<ul>\n<li>In the OAM console, navigate to the &#8220;Federation&#8221; section of the console using the buttons at the upper right corner of the page (*)<\/li>\n<li>or click the Service Provider Management link (*)<\/li>\n<li>Click Create Identity Provider Partner<\/li>\n<li>Provide a Name for your partner. &nbsp;<\/li>\n<li>Optionally, provide a description<\/li>\n<li>Provide the Service Information by uploading the metadata file provided by Duo admin team.<\/li>\n<li>Specify a User Identity Store to map the federated user ,in OAM we need to select as OIDidentity store.<\/li>\n<li>Specify a User Search Base to search for user entries&nbsp;<\/li>\n<li>Map assertion Name Id to User ID Store attribute to use the value of the Name ID field of the assertion to search the user store for user with a matching value in the specified attribute, here we are using mail.<\/li>\n<li>Select an Attribute Mapping profile as an IDP attribute profile.<\/li>\n<li>Click Save<\/li>\n<li>After saving, a new screen will be displayed. &nbsp;Click the &#8220;Create Authentication Scheme and Module&#8221; as shown in the following snapshot<\/li>\n<\/ul>\n<p><em>Refer to the following screenshots<\/em><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture11.png\" alt=\"DUO and SAML Picture 11\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture12.png\" alt=\"DUO and SAML Picture 12\" \/><\/p>\n<p>&nbsp;<strong>Step 3: Send OAM federation metadata to Duo Admin Team<\/strong><\/p>\n<p>\n&#8211; In the OAM Console &gt; Click on Configuration &gt;Settings&gt;click on Federation<\/p>\n<p>&#8211; Click on Export SAML 2.0 Metadata and send the xml to duo admin team. The duo team will import in DUO central portal.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture13.png\" alt=\"DUO and SAML  Picture 13\" \/><\/p>\n<p>Following are the important values which will be in the xml file.<br \/>\n1. &nbsp;entityID&nbsp;<br \/>\n2. Assertion Consumer Service (ACS) URL&nbsp;<br \/>\n3. Single Logout URL<\/p>\n<p><strong>Step 4: &nbsp;Testing of federation configuration<\/strong><\/p>\n<p>You can test the federation using URL:<\/p>\n<p>https:\/\/&lt;OAM_HOST_NAME&gt;:&lt;OAM_MANAGED_SERVER_PORT&gt;\/oamfed\/user\/testspsso<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture14.png\" alt=\"DUO and SAML Picture 14\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>In partner drop down list (screen above), you will have the custom authentication scheme value that we created in the previous steps.<\/p>\n<p>Select the value and click to Start SSO.<\/p>\n<p>You will get the Duo login prompt indicating that the federation is successful, and you will be able to login with credentials of IDP.<\/p>\n<p><strong>Step 5: &nbsp;Configure OAM to protect resources using your federated IDP partner<\/strong><\/p>\n<p>&#8211; In the OAM console, navigate to <em>Application Security &gt;Application Domains &gt;search for the Application Domain<\/em>&nbsp;<\/p>\n<p>&#8211; Application domain will be generally with <em>SID+hostname+port<\/em><\/p>\n<p>&#8211; <em>select Domain &gt;Click on Authentication Policies &gt;Protected Resource Policy &gt;Change Authentication Scheme to<\/em><\/p>\n<p>&lt;partner name&gt;FederationScheme which is &lt;partner name&gt;FederationScheme .<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/25941-body-Picture15.png\" alt=\"DUO and SAML Picture 15\" \/><\/p>\n<p>Once all above steps are done, the E-business suite will be launched from duo central without passwords.<\/p>\n<h3>Conclusion<\/h3>\n<p>SAML improves user experience in login process for several applications as a user need to sign in only once. SAML leads to increased security because authentication process ensures that credentials are only sent to identity provider directly.&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Implementation of DUO and SAML in E-business suite 12.2<\/p>\n","protected":false},"author":2,"featured_media":6971,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"25941","content_type":"blog","created_by":"10130","authored_on":"2023-08-29T05:31:28+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Explore Capital One data breach incident and importance of security controls. Review and implement key security controls.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/25941-insights_image-oracle-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Oracle E-Business Suite","product":"","publisheddate":"2022-06-10T05:31:28","rxt_solutions":"Applications","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Implementation of DUO and SAML in E-Business Suite 12.2","field_topics":"","field_slug":"implementation-of-duo-and-saml-in-e-business-suite-12.2","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-6969","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/6969","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/comments?post=6969"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/6969\/revisions"}],"predecessor-version":[{"id":17128,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/6969\/revisions\/17128"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media\/6971"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media?parent=6969"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/categories?post=6969"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/tags?post=6969"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}