Check below 25 points which Apps DBA should know for Apps(11i\/R12) integration with SSO\/OID (Single Sign-On\/Oracle Internet Directory)<\/p>\n
1. If you change APPS password<\/strong> using FNDCPASS utility, update provisioning profile with new password using OIDPROVTOOL<\/strong>. (More on OID Scripts & Tools coming soon<\/em><\/span>). This is required as APPS password is stored in provisioning profile in OID.<\/p>\n 2. If you clone E-Business Suite Instance<\/strong>, 3. Session Idle Timeout<\/strong> value in E-Business\/Apps is set to 30 minute by default but there is NO Session Idle timeout value set on SSO<\/strong> (There is Global Timeout value set to 8 hours in Oracle SSO which is different from Idle Timeout<\/em><\/span>). If session is Idle for more than 30 minutes in Apps\/E-Business suite, users will be redirected to SSO and user can get back to Apps “without<\/strong>” entering username password as user session cookie is still valid on SSO Server . 4. User with Name USER1<\/em> in FND_USERS<\/strong> can be linked to username USER2<\/em> in OID , so username need not to be same. Users in E-Business Suite\/Apps are linked to Users in OID\/SSO via GUID.<\/strong><\/p>\n 5. User mapping between OID & E-Business\/Apps<\/strong> -> Login name in OID is identified by attribute “orclcommonnicknameattribute<\/em><\/strong>” which by default is “uid<\/strong>“. To understand this better, think of user User “Atul Kumar” in OID with various attribute like first name<\/em>, lastname<\/em>, phonenumber, cn, sn, uid<\/em> …. If for “Atul Kumar” value of attribute uid<\/strong> is set to “akumar<\/em>” then user should use “akumar<\/em>” to login. 6. Currently supported nickname <\/strong>attribute to be mapped to FND_USER table are “uid<\/strong>” and “mail<\/strong>”<\/p>\n 7. If naming convention of your users in OID is different from users in E-Business\/Apps (like atul.kumar in OID but kumaratul in apps\/E-Business Suite) then disable profile “Applications SSO Auto Link User<\/strong>”<\/p>\n 8. Not all attributes for users can be integrated\/synchronized from OID to E-Business Suite or Vice Versa. For list of attributes supported currently (as of build 5) check Appendix C on Page 88 of Integration guide.<\/p>\n 9. Updates to email ID in Oracle Internet Directory are not correctly reflected in the E-Business Suite HZ_CONTACT_POINTS<\/strong> in TCA unless the PERSON_PARTY_ID foreign key in the FND_USER table has been defined. Furthermore, if PERSON_PARTY_ID<\/strong> is changed i.e. user is linked to another person in TCA, information stored in OID can overwrite this other person\u2019s information during provisioning.<\/p>\n 10. As of build 5, logout from OAM (Oracle Application Manager<\/span>) results in page not found, though users can logout successfully from professional forms and self service web applications.<\/p>\n 11. Users can be provisioned from E-Business\/11i\/R12 (FND_USER) to OID, OID to E-Business Suite, and two way. (How to find current user provisioning direction coming soon in OID Scripts post<\/em><\/span>)<\/p>\n 12. User Provisioning from TCA <\/strong>(Trading Community Architecture)<\/span> to OID is not yet supported<\/strong> (as of build 5). Provisioning of HR to OID, FND_USER to OID or from OID to FND_USER is supported.<\/p>\n 13. If provisioning profile includes password to be provisioned from E-Business Suite\/Apps to OID, password policy in E-Business Suite should be atleast as restrictive as OID<\/strong> else when you create user in E-Business Suite\/Apps without password not not in line with password policy, you will get non descriptive error message.<\/p>\n 14. User can login to E-Business Suite Locally<\/strong> (NO SSO, directly from FND_USER) or to SSO<\/strong> (authentication via SSO) or BOTH<\/strong>. Set profile option “Applications SSO Login Types<\/em><\/strong>” to LOCAL or BOTH at userlevel<\/strong> and use<\/p>\n http(s):\/\/(hostname).(domainname):(port)\/ OA_HTML\/ AppsLocalLogin.jsp<\/em><\/p>\n For SSO authentication use URL 15. It is possible to register multiple E-Buisness Suite Instance (Test, Dev, UAT) to single OID\/SSO Instance. (How to find list of E-Business Suite instance registered against OID, coming soon in OID Scripts<\/span><\/em>)<\/p>\n 16. If you have OID with multiple Realm (How to find default and all available realms in OID, coming soon in OID scripts<\/span><\/em>), E-Business Suite\/11i\/R12 can be registered against default OID realm only (As of SSO build 5).<\/p>\n 17. It is possible to link multiple E-Business Suite accounts to single SSO account but vice versa is not possible\/supported. i.e. User1 and User2 in E-Business account can be linked to user3 in OID\/SSO (For more 18. It is possible to synch User Password<\/strong> from E-Business Suite to OID but vice versa is not allowed. This is because passwords in E-Buisness Suite\/Apps\/11i\/R12 are encrypted but are hashed in OID.<\/p>\n 19. If you are palnning to implement SSO Integration with E-Business \/11i\/R12 in enterprise where E-Business Suite and OID are already implemented and working independently, it is possible to bulkload user from OID to E-Business<\/strong><\/em>(Users which are already in OID but not in E-Business Suite) or from E-Busienss to OID<\/em><\/strong> (Users which are already in E-Business Suite but not in OID) and map common users.<\/p>\n 20. For bulk migrating users from E-Business Suite to OID or from OID to E-Business Suite, check AppsUserExport<\/strong>, LDAPUserImport<\/strong>, ldifmigrator<\/strong>, bulkload.sh utility<\/p>\n 21. When users are imported (initial load) from OID to E-Business\/Apps 11i\/R12 using LDAPUserImport, all user “attributes” can’t be imported<\/strong>.<\/p>\n 22. If hashing method in OID is not MD5<\/strong>, bulkload of users to OID (initial set of users migrated from Apps\/E-Business Suite) . (How to find default hasing method in OID, coming soon in OID Scripts..<\/span><\/em>)<\/p>\n 23. During initial load of users from E-Business Suite to OID (using bulkload.sh), password policy in OID is not verified<\/strong> . This is because E-Business Suite passwords are encrypted in dump file and bulk load tool can’t check passwords.<\/p>\n 24. Oracle Application Server (SSO\/OID) & Apps\/E-Business Suite database server system clocks should be in synch else users will face issue during login\/logoff<\/p>\n 25.<\/p>\n Leave your comments on what you think is important for Apps\/11i\/R12 integration with OID\/SSO to fill point no. 25<\/p>\n <\/p>\n If you have not yet downloaded\u00a0FREE eBook \u2013 7 Docs every Oracle Apps DBA must read for EBS R12 integration with OAM\/OID for SSO<\/a>\u00a0get a copy in your Email<\/p>\n
\n——2.1 Deregister old E-Business Suite details from target OID Instance,
\n——2.2 Deregister Integration details from cloned target E-Business Suite instance
\n——2.3 Reregister target E-Business Suite Instance to target OID and SSO instance
\n(More on cloning Oracle Apps instance integrated with OID\/SSO coming soon<\/em><\/span>)<\/p>\n
\nFor global Idle Session time out to work properly set Idle timeout value to required value in Oracle SSO server and match that with E-Business Suite Instance.<\/p>\n
\nThis “akumar” (value of attribute “uid”) is mapped to USER_NAME<\/strong> column of table FND_USER<\/strong> and “orclguid<\/strong>” attribute in OID should have same value as USER_GUID<\/strong> column value in FND_USER<\/strong> table. As mentioned in point 4, users in OID & Apps are linked via GUID<\/strong> and this value should be same. (More on user mapping and authentication flow with SSO coming soon<\/span><\/em> )<\/p>\n
\nhttp(s):\/\/(hostname).(domainname):(port)\/oa_servlets\/AppsLogin<\/em><\/p>\n
\ninformation Check Profile Option “Applications SSO Allow Multiple Accounts<\/strong>” <\/span><\/em>)<\/p>\nRelated Post<\/h2>\n
\n