{"id":7987,"date":"2019-12-11T06:48:27","date_gmt":"2019-12-11T06:48:27","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/set-up-oracle-access-manager-sso-in-e-business-suite\/"},"modified":"2026-11-03T19:29:12","modified_gmt":"2026-11-03T19:29:12","slug":"set-up-oracle-access-manager-sso-in-e-business-suite","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/de\/blogs\/set-up-oracle-access-manager-sso-in-e-business-suite\/","title":{"rendered":"Set up Oracle Access Manager SSO in E-Business Suite"},"content":{"rendered":"

Introduction<\/strong><\/p>\n

This blog shows how you can integrate Oracle\u00a9 ; Access Manager (OAM) 11g with Oracle E-Business Suite (EBS) by using the WebGate agent. If you are upgrading from Oracle Single Sign-On Server version 10gR3, you can integrate OAM with EBS by using the `mod_osso<\/em>` agent, but we don’t cover that in this blog.<\/p>\n

Overview of authentication with WebGate<\/strong><\/p>\n

WebGate is a component of OAM that intercepts HTTP requests and redirects them to the OAM server to determine how to access the  esources and authenticates the current user when required. If OAM is already deployed in the environment, you can configure an existing WebGate for this purpose.<\/p>\n

The following image shows the integration of WebGate and EBS AccessGate:<\/p>\n

\"Oracle<\/p>\n

Image Source<\/em><\/a><\/p>\n

When an unauthenticated user attempts to access a protected EBS resource, the user is directed to the EBS AccessGate application, which is a Java Enterprise Edition (EE) application responsible for mapping a single sign-on (SSO) user to an EBS user and creating the EBS session for that user. AccessGate is deployed to a WebLogic Server instance and is separate from EBS.<\/p>\n

The OAM server protects EBS AccessGate and reroutes the authentication request to a separate HTTP Server with WebGate installed.<\/p>\n

After a user is initially authenticated by OAM, EBS AccessGate picks up the request for a resource and the credentials returned by the OAM server. If the OAM server credentials are valid, WebGate connects to the EBS database to link the Oracle Directory Services user to an EBS user. If EBS fails to identify a linked user in the Oracle Directory Services, it redirects the user to the linking page to allow the user to map his or her unlinked Oracle Directory Services user account to the correct EBS username. After this mapping completes,
\nif the session is still valid, WebGate returns EBS resources directly to the user.<\/p>\n

The following sections cover the steps to set up OAM SSO in EBS version 12.2.5
\nafter cloning.<\/p>\n

Part 1: Set up OAM SSO in EBS<\/strong><\/p>\n

 1.1    Shutdown all apps services<\/strong><\/p>\n

Source the run file system ENV:<\/p>\n

    $ .. EBSapps.env run <\/em><\/p>\n

Run the following command to shutdown all the services in all nodes and start only Adminserver in the primary node:<\/p>\n

    $ .\/adadminsrvctl.sh start – Only Admin server<\/em><\/p>\n

 1.2    Deregister OID from EBS<\/strong><\/p>\n

Source the run file system ENV:<\/p>\n

    $ .. EBSapps.env run<\/em><\/p>\n

Run the following command to deregister the OID:<\/p>\n

\n    $FND_TOP\/bin\/txkrun.pl  \\
\n    -script=SetSSOReg  \\
\n    -deregisteroid=yes \\
\n    -appspass=<apps_password> \\
\n    -ldaphost=<oid_server> \\
\n    -ldapport=13060 \\
\n    -oidadminuserpass=”<OID_Admin_password>”<\/em><\/p>\n

 1.3    Remove SSO Reference from EBS<\/strong><\/p>\n

Source the run file system ENV and execute the following command:<\/p>\n

    $FND_TOP\/bin\/txkrun.pl -script=SetSSOReg -removereferences=yes<\/em><\/p>\n

Enter APPS password:<\/p>\n

    sqlplus -s apps\/<appspasswd>  @$FND_TOP\/patch\/115\/sql\/fndssouu.sql %<\/em><\/p>\n

 1.4    Delete Managed Server<\/strong><\/p>\n

Log in to the Weblogic console. Check the following managed servers to see if
\nthey are configured:<\/p>\n

– oaea\\_server1
\n– oaea\\_server2<\/em><\/p>\n

\nIf they are configured, remove them by using the following commands:<\/p>\n

    $ .. EBSapps.env run<\/em><\/p>\n

On application EBS node 1:<\/p>\n

    perl $AD_TOP\/patch\/115\/bin\/adProvisionEBS.pl  ebs-delete-managedserver \\
\n    -contextfile=$CONTEXT_FILE -managedsrvname=oaea_server1 \\
\n    -servicetype=oaea -logfile=\/usr\/tmp\/delMS_server.log<\/em><\/p>\n

\nOn application EBS node 1, (External Node): If the external node does exist, run the following command::<\/p>\n

    perl $AD_TOP\/patch\/115\/bin\/adProvisionEBS.pl  ebs-delete-managedserver \\
\n    -contextfile=$CONTEXT_FILE -managedsrvname=oaea_server2 \\
\n    -servicetype=oaea -logfile=\/usr\/tmp\/delMS_server.log<\/em><\/p>\n

Note: <\/strong> Log in to the Weblogic console and make sure no oaea_servers are
\npresent. If any are, delete them by using the preceding command and continue.<\/p>\n

 1.5    Delete the Data source, OAEADatasource<\/strong><\/p>\n

Log in to the Weblogic console and delete the data source and AccessGate
\ndeployments.<\/p>\n

From the console, select Lock & Edit<\/strong> -> Home<\/strong> -> Data Sources<\/strong> ->
\nOAEADatasource (Delete)<\/strong>->Activate Changes<\/strong>.<\/p>\n

Step 1.4 removed the AccessGate deployments. If any remain, remove them manually.<\/p>\n

 <\/p>\n

\"Oracle<\/p>\n

1.6    Sync up the context file and update the configuration on all nodes <\/strong><\/p>\n

Log in to each node, source the run file system, and then execute the following command:<\/p>\n

    perl $AD_TOP\/bin\/adSyncContext.pl contextfile=$CONTEXT_FILE<\/em><\/p>\n

 1.7    Delete the managed server PATCH file system<\/strong><\/p>\n

Source the patch file system ENV. Log in to the Weblogic console and check the
\nfollowing managed servers:<\/p>\n

– oaea\\_server1
\n– oaea\\_server2<\/em><\/p>\n

If the servers are configured, remove them by using the following command:<\/p>\n

    $ .. EBSapps.env patch<\/em><\/p>\n

\nStart the PATCH Admin server:<\/p>\n

\n    $ADMIN_SCRIPTS_HOME\/adadminsrvctl.sh start forcepatchfs<\/em><\/p>\n

On application EBS node 1:<\/p>\n

    perl $AD_TOP\/patch\/115\/bin\/adProvisionEBS.pl  ebs-delete-managedserver \\
\n    -contextfile=$CONTEXT_FILE -managedsrvname=oaea_server1 \\
\n    -servicetype=oaea -logfile=\/usr\/tmp\/delMS_server.log<\/em><\/p>\n

\nOn application EBS node 1, (External Node): If external node exists, run the following command:<\/p>\n

    perl $AD_TOP\/patch\/115\/bin\/adProvisionEBS.pl  ebs-delete-managedserver \\
\n    -contextfile=$CONTEXT_FILE -managedsrvname=oaea_server2 \\
\n    -servicetype=oaea -logfile=\/usr\/tmp\/delMS_server.log<\/em><\/p>\n

\nNote: <\/strong> Log in to the Weblogic console and make sure no oaea_servers are present. If any are, delete them by using the preceding command and continue.<\/p>\n

1.8    Delete the Data source “OAEADatasource” \u2013 PATCH File System<\/strong><\/p>\n

Log in to the PATCH Weblogic console and delete the database source and AccessGate deployments.<\/p>\n

From the console, select Lock & Edit<\/strong> -> Home<\/strong> -> Data Sources<\/strong>->OAEADatasource (Delete)<\/strong>->Activate Changes<\/strong><\/p>\n

Step 1.4 removed the AccessGate deployments. If any remain, remove them manually..<\/p>\n

 1.9    Upload the Patch file system context file to the database<\/strong><\/p>\n

Run the following commands:<\/p>\n

    $ .. EBSapps.env patch
\n    $ $ADJVAPRG oracle.apps.ad.autoconfig.oam.CtxSynchronizer action=upload
\n    contextfile=<full path to patch context file> logfile=\/tmp\/patchctxupload.log<\/em><\/p>\n

 1.10    Shutdown the admin server in the PATCH file system<\/strong><\/p>\n

Source the PATCH file system ENV and shutdown the admin server:<\/p>\n

 $ADMIN_SCRIPTS_HOME\/adadminsrvctl.sh stop forcepatchfs<\/em><\/p>\n

 Part 2:    Integrate EBS with OAM and enable SSO<\/strong><\/p>\n

 2.1    Configure oaea_server Managed Server<\/strong><\/p>\n

Source the run ENV file and execute the following command in the respective node:<\/p>\n

    $ .. EBSapps.env run<\/em><\/p>\n

On application EBS node 1 \u2013 run:<\/p>\n

    $ perl $AD_TOP\/patch\/115\/bin\/adProvisionEBS.pl ebs-create-oaea_resources \\
\n    -contextfile=$CONTEXT_FILE \\
\n    -deployApps=accessgate \\
\n    -SSOServerURL=https:\/\/xxxxxxxxx.com:8131 \\
\n    -OAMLogoutURL=https:\/\/xxxxxxxx.com\/oam\/server\/logout?end_url=https:\/\/xxxxxx.com\/oamwebsso\/logout-success.jsp \\
\n    -managedsrvname=oaea_server1 \\
\n    -managedsrvport=6888 \\
\n    -logfile=\/usr\/tmp\/deployaccessgate1_Time1.log<\/em><\/p>\n

Enter the APPS and WebLogic password for input.<\/p>\n

Use port 6888 for the managed server. Check the log for any error and make sure the log ends with the following command for all managed servers: <\/p>\n

\u201cShutdown the managed server oaea_server1 successfully\u201d<\/em><\/p>\n

 2.2<\/strong>    Add the AccessGate information to the OHS server<\/p>\n

On application EBS nodes 1 and 2, run the following commands:<\/p>\n

    $ perl $FND_TOP\/patch\/115\/bin\/txkSetAppsConf.pl -contextfile=$CONTEXT_FILE
\n    -configoption=addMS -accessgate=<ebs-node1.com>:6888<\/em><\/p>\n

    $ perl $FND_TOP\/patch\/115\/bin\/txkSetAppsConf.pl -contextfile=$CONTEXT_FILE
\n    -configoption=removeMS  -accessgate=<ext_ebs-node1.com>:6888<\/em><\/p>\n

On application EBS nodes 3 and 4 \u2013 run (External node):<\/em><\/p>\n

    $ perl $FND_TOP\/patch\/115\/bin\/txkSetAppsConf.pl -contextfile=$CONTEXT_FILE
\n    -configoption=addMS -accessgate=<ebs_node1.com>:6888<\/em><\/p>\n

    $ perl $FND_TOP\/patch\/115\/bin\/txkSetAppsConf.pl -contextfile=$CONTEXT_FILE
\n    -configoption=removeMS  -accessgate=<ebs_node1.com>:6888<\/em><\/p>\n

Copy the run file system $INST\\_TOP\/appl\/admin\/oaea\\_wls.properties<\/strong> to the
\npatch file system on application EBS node 1 and application EBS external node 1.<\/p>\n

 2.3    Register EBS in OAM<\/strong><\/p>\n

On application EBS node 1:<\/strong><\/p>\n

    $ .. EBSapps.env run
\n    $ perl $FND_TOP\/bin\/txkrun.pl -script=SetOAMReg -registeroam=yes \\
\n    -oamHost=https:\/\/XXXX.com:8130 \\
\n    -oamUserName=ebs_admin  \\
\n    -ldapUrl=ldap:\/\/XXXXX.com:13060 \\
\n    -oidUserName=cn=orcladmin \\
\n    -ldapSearchBase=cn=Users,dc=XXXXX,dc=com \\
\n    -ldapGroupSearchBase=cn=Groups,dc=XXXXX,dc=com \\
\n    -authScheme=XXXXXFormsAuthNScheme \\
\n    -authSchemeMode=reference \\
\n    -policyUpdate=No<\/em><\/p>\n

Enter OAM console password: XXXXXXX
\nEnter APPS password: <APPSPASSWD><\/p>\n

On application EBS node 1 \u2013 External Node:<\/p>\n

    $ . . EBSapps.env run
\n    $ perl $FND_TOP\/bin\/txkrun.pl -script=SetOAMReg -registeroam=yes \\
\n    -oamHost=https:\/\/XXXXX.com:8130 \\
\n    -oamUserName=ebs_admin  \\
\n    -ldapUrl=ldap:\/\/XXXXX.com:13060 \\
\n    -oidUserName=cn=orcladmin \\
\n    -ldapSearchBase=cn=Users,dc=XXXXX,dc=com \\
\n    -ldapGroupSearchBase=cn=Groups,dc=XXXXX,dc=com \\
\n    -authScheme=XXXXXFormsAuthNScheme \\
\n    -authSchemeMode=reference \\
\n    -policyUpdate=No<\/em><\/p>\n

Enter OAM console password: XXXXXXX
\nEnter APPS password: <APPSPASSWD><\/p>\n

 2.4    Copy webgate agent files from backup<\/strong><\/p>\n

Source the RUN env file and execute the following commands:<\/p>\n

    $ .. EBSapps.env run<\/em><\/p>\n

Move the config folder to config\\_old:<\/p>\n

 mv $FMW_HOME\/webtier\/instances\/EBS_web_<INSTANCE_NAME>_OHS1\/config\/OHS\/EBS_web_<INSTANCE_NAME>\/webgate\/config $FMW_HOME\/webtier\/instances\/EBS_web_<INSTANCE_NAME>_OHS1\/config\/OHS\/EBS_web_<INSTANCE_NAME>\/webgate\/config_old
\n    mv $FMW_HOME\/webtier\/instances\/EBS_web_<INSTANCE_NAME>_OHS2\/config\/OHS\/EBS_web_<INSTANCE_NAME>\/webgate\/config $FMW_HOME\/webtier\/instances\/EBS_web_<INSTANCE_NAME>_OHS2\/config\/OHS\/EBS_web_<INSTANCE_NAME>\/webgate\/config_old<\/em><\/p>\n

Restore the Webgate agent file from backup. Get in touch with the OAM
\nadministrator to get the Webgate agent files.<\/p>\n

Internal:<\/p>\n

    $ cd \/xxx\/xxxxx\/OAM\/XXXXX\/agent\/internal
\n    $ cp \u2013rf config $FMW_HOME\/webtier\/instances\/EBS_web_<INSTANCE_NAME>_OHS1\/config\/OHS\/EBS_web_<INSTANCE_NAME>\/webgate<\/em>
\n <\/p>\n

External:<\/p>\n

    $ cd \/xxx\/xxxxx\/OAM\/XXXXX\/agent\/external
\n    $ cp \u2013rf config $FMW_HOME\/webtier\/instances\/EBS_web_<INSTANCE_NAME>_OHS2\/config\/OHS\/EBS_web_<INSTANCE_NAME>\/webgate<\/em><\/p>\n

 2.5    Register OID<\/strong><\/p>\n

\n    $ .. EBSapps.env run
\n    $ $FND_TOP\/bin\/txkrun.pl \\
\n    -script=SetSSOReg \\
\n    -registeroid=yes \\
\n    -ldaphost=XXXXX \\
\n    -ldapport=13060 \\
\n    -provisiontype=4<\/p>\n

Enter the LDAP Directory Administrator (orcladmin) Bind password? XXXXXXX , enter the instance password that you will like to register this application instance with? <APPSPASSWD>
\nEnter Oracle E-Business apps database user password? <APPSPASSWD><\/p>\n

 2.6    Execute Post SSO steps<\/strong><\/p>\n

Source the RUN ENV and execute the following command:<\/p>\n

   $ .. EBSapps.env run
\n    $ Sqlplus apps\/<APPSPASSWD>
\n    SQL>execute fnd_oid_plug.setPlugin(p_default_user_repository =>’cn=Users,dc=XXXX,dc=com’);
\n    SQL>commit;<\/em><\/p>\n

Start up the application node 1 and set the following profile options that are
\nused in EBS to update behavior of the environment:<\/p>\n

    APPS_AUTH_AGENT        : \/accessgate
\n    APPS_SSO_LDAP_SYNC        : N
\n    APPS_SSO_AUTO_LINK_USER    : Y
\n    APPS_SSO            : SSWA_SSO
\n    APPS_SSO_LINK_SAME_NAMES    : Y
\n    APPS_SSO_LOCAL_LOGIN        : BOTH<\/p>\n

Shut down application node 1 and execute `autoconfig<\/em>` on the primary node.<\/p>\n

 2.7    <\/strong>Validate SSO with EBS<\/p>\n

     $ .. EBSapps.env run<\/em><\/p>\n

Start all the services in the run file system only on the primary node.<\/p>\n

Access the login screen and check: Internal – https:\/\/XXXXXX.com\/<\/p>\n

Note:<\/strong> The first time you access the SSO page, a home page error displays.<\/p>\n

Execute the below commands and try again:<\/p>\n

    $ .\/adopmnctl.sh stopall
\n    $ .\/adopmnctl.sh startall<\/em><\/p>\n

You can try out different browsers if the preceding command service bounces.<\/p>\n

You are re-directed to your OAM SSO page. Log in using valid OID user credentials. After successful authentication, you are re-directed to your EBS home page.<\/p>\n

After you can access the SSO page, start all services in all nodes and validate the instance. Also check the external URL, https:\/\/XXXXXX.com<\/strong>:<\/p>\n

Use the following URL to login as SYSADMIN:<\/p>\n

Backdoor URL – https:\/\/XXXXXX.com\/OA_HTML\/AppsLocalLogin.jsp<\/em><\/p>\n

 2.8  <\/strong>  Perform fs_clone<\/p>\n

If validation is good, execute the following command to synchronize the changes to your patch file system:<\/p>\n

    $ adop phase=fs_clone<\/em><\/p>\n

Conclusion<\/strong><\/p>\n

This blog walks you through integrating OAM with EBS by using the WebGate agent, providing the necessary steps. After performing these steps, you can log in to EBS by using your SSO credentials.<\/p>\n","protected":false},"excerpt":{"rendered":"

Set up Oracle Access Manager SSO in E-Business Suite<\/p>\n","protected":false},"author":2,"featured_media":7989,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26563","content_type":"blog","created_by":"10130","authored_on":"2024-02-01T06:48:26+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Integrate Oracle Access Manager 11g with Oracle E-Business Suite using WebGate agent for secure and efficient Single Sign-On.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26563-insights_image-oracle-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Oracle E-Business Suite","product":"","publisheddate":"2019-12-11T06:48:27","rxt_solutions":"Applications, Application Modernization, Enterprise Resource Planning (ERP)","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Integrating Oracle Access Manager with E-Business Suite | Rackspace Technology","field_topics":"","field_slug":"setup-oracle-access-manager-for-ebusiness-suite","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7987","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7987","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/comments?post=7987"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7987\/revisions"}],"predecessor-version":[{"id":9804,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7987\/revisions\/9804"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media\/7989"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media?parent=7987"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/categories?post=7987"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/tags?post=7987"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}