|
| 1 | +--- |
| 2 | +title: Configure Datawiza for Azure Active Directory Multi-Factor Authentication and single sign-on to Oracle EBS |
| 3 | +description: Learn to enable Azure AD MFA and SSO for an Oracle E-Business Suite application via Datawiza |
| 4 | +services: active-directory |
| 5 | +author: gargi-sinha |
| 6 | +manager: martinco |
| 7 | +ms.service: active-directory |
| 8 | +ms.subservice: app-mgmt |
| 9 | +ms.topic: how-to |
| 10 | +ms.workload: identity |
| 11 | +ms.date: 01/26/2023 |
| 12 | +ms.author: gasinh |
| 13 | +ms.collection: M365-identity-device-management |
| 14 | +--- |
| 15 | + |
| 16 | +# Configure Datawiza for Azure Active Directory Multi-Factor Authentication and single sign-on to Oracle EBS |
| 17 | + |
| 18 | +In this tutorial, learn how to enable Azure Active Directory Multi-Factor Authentication (MFA) and single sign-on (SSO) for an Oracle E-Business Suite (Oracle EBS) application via Datawiza. |
| 19 | + |
| 20 | +The benefits of integrating applications with Azure Active Directory (Azure AD) via Datawiza: |
| 21 | + |
| 22 | +* [Embrace proactive security with Zero Trust](https://www.microsoft.com/security/business/zero-trust) - a security model that adapts to modern environments and embraces hybrid workplace, while it protects people, devices, apps, and data |
| 23 | +* [Azure Active Directory single sign-on](https://azure.microsoft.com/solutions/active-directory-sso/#overview) - secure and seamless access for users and apps, from any location, using a device |
| 24 | +* [How it works: Azure AD Multi-Factor Authentication](../authentication/concept-mfa-howitworks.md) - users are prompted during sign-in for forms of identification, such as a code on their cellphone or a fingerprint scan |
| 25 | +* [What is Conditional Access?](../conditional-access/overview.md) - policies are if-then statements, if a user wants to access a resource, then they must complete an action |
| 26 | +* [Easy authentication and authorization in Azure AD with no-code Datawiza](https://www.microsoft.com/security/blog/2022/05/17/easy-authentication-and-authorization-in-azure-active-directory-with-no-code-datawiza/) - use web applications such as: Oracle JDE, Oracle E-Business Suite, Oracle Sibel, and home-grown apps |
| 27 | +* Use the [Datawiza Cloud Management Console](https://console.datawiza.com) (DCMC) - manage access to applications in public clouds and on-premises |
| 28 | + |
| 29 | +## Scenario description |
| 30 | + |
| 31 | +This document focuses on modern identity providers (IdPs) integrating with the legacy Oracle EBS application. Oracle EBS requires a set of Oracle EBS service account credentials and an Oracle EBS database container (DBC) file. |
| 32 | + |
| 33 | +## Architecture |
| 34 | + |
| 35 | +The solution contains the following components: |
| 36 | + |
| 37 | +* **Azure AD** Microsoft's cloud-based identity and access management service, which helps users sign in and access external and internal resources. |
| 38 | +* **Oracle EBS** the legacy application to be protected by Azure AD. |
| 39 | +* **Datawiza Access Proxy (DAP)**: A super lightweight container-based reverse-proxy implements OIDC/OAuth or SAML for user sign-on flow and transparently passes identity to applications through HTTP headers. |
| 40 | +* **Datawiza Cloud Management Console (DCMC)**: A centralized management console that manages DAP. DCMC provides UI and RESTful APIs for administrators to manage the configurations of DAP and its granular access control policies. |
| 41 | + |
| 42 | +### Prerequisites |
| 43 | + |
| 44 | +Ensure the following prerequisites are met. |
| 45 | + |
| 46 | +* An Azure subscription. |
| 47 | + * If you don't have on, you can get an [Azure free account](https://azure.microsoft.com/free/) |
| 48 | +* An Azure AD tenant linked to the Azure subscription |
| 49 | +* An account with Azure AD Application Admin permissions |
| 50 | + * See, [Azure AD built-in roles](../roles/permissions-reference.md) |
| 51 | +* Docker and Docker Compose are required to run DAP |
| 52 | + * See, [Get Docker](https://docs.docker.com/get-docker/) and [Overview, Docker Compose](https://docs.docker.com/compose/install/) |
| 53 | +* User identities synchronized from an on-premises directory to Azure AD, or created in Azure AD and flowed back to your on-premises directory |
| 54 | + * See, [Azure AD Connect sync: Understand and customize synchronization](../hybrid/how-to-connect-sync-whatis.md) |
| 55 | + |
| 56 | +* An Oracle EBS environment |
| 57 | + |
| 58 | +## Configure the Oracle EBS environment for SSO and create the DBC file |
| 59 | + |
| 60 | +To enable SSO in the Oracle EBS environment: |
| 61 | + |
| 62 | +1. Sign in to the Oracle EBS Management console as an Administrator. |
| 63 | +2. Scroll down the Navigator panel and expand **User Management**. |
| 64 | + |
| 65 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/navigator-user-management.png#lightbox) |
| 66 | + |
| 67 | +3. Add a user account. |
| 68 | + |
| 69 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/user-account.png#lightbox) |
| 70 | + |
| 71 | +4. For **User Name**, enter **DWSSOUSER**. |
| 72 | +5. For **Password**, enter a password. |
| 73 | +6. For **Description**, enter **DW User account for SSO**. |
| 74 | +7. For **Password Expiration**, select **None**. |
| 75 | +8. Assign the **Apps Schema Connect** role to the user. |
| 76 | + |
| 77 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/assign-role.png#lightbox) |
| 78 | + |
| 79 | +## Register DAP with Oracle EBS |
| 80 | + |
| 81 | +In the Oracle EBS Linux environment, generate a new DBC file for DAP. You need the apps user credentials, and the default DBC file (under $FND_SECURE) used by the Apps Tier. |
| 82 | + |
| 83 | +1. Configure the environment for Oracle EBS using a command similar to: `./u01/install/APPS/EBSapps.env run` |
| 84 | +2. Use the AdminDesktop utility to generate the new DBC file. Specify the name of a new Desktop Node for this DBC file: |
| 85 | + |
| 86 | +>>`java oracle.apps.fnd.security.AdminDesktop apps/apps CREATE NODE_NAME=\<ebs domain name> DBC=/u01/install/APPS/fs1/inst/apps/EBSDB_apps/appl/fnd/12.0.0/secure/EBSDB.dbc` |
| 87 | +
|
| 88 | +3. This action generates a file called `ebsdb_\<ebs domain name>.dbc` in the location where you ran the previous command. |
| 89 | +4. Copy the DBC file content to a notebook. You will use the content later. |
| 90 | + |
| 91 | +## Enable Oracle EBS for SSO |
| 92 | + |
| 93 | +1. To integrate JDE with Azure AD, sign in to [Datawiza Cloud Management Console (DCMC)](https://console.datawiza.com/). |
| 94 | +2. The Welcome page appears. |
| 95 | +3. Select the orange Getting started button. |
| 96 | + |
| 97 | +  |
| 98 | + |
| 99 | +4. Enter a **Name**. |
| 100 | +5. Enter a **Description**. |
| 101 | +6. Select **Next**. |
| 102 | + |
| 103 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/deployment-name.png#lightbox) |
| 104 | + |
| 105 | +7. On **Add Application**, for **Platform** select **Oracle E-Business Suite**. |
| 106 | +8. For **App Name**, enter the app name. |
| 107 | +9. For **Public Domain** enter the external-facing URL of the application, for example `https://ebs-external.example.com`. You can use localhost DNS for testing. |
| 108 | +10. For **Listen Port**, select the port that DAP listens on. You can use the port in Public Domain if you aren't deploying the DAP behind a load balancer. |
| 109 | +11. For **Upstream Servers**, enter the URL and port combination of the Oracle EBS implementation being protected. |
| 110 | +12. For **EBS Service Account**, enter the username from Service Account (DWSSOUSER). |
| 111 | +13. For **EBS Account Password**, enter the password for the Service Account. |
| 112 | +14. For **EBS User Mapping**, the product decides the attribute to be mapped to Oracle EBS username for authentication. |
| 113 | +15. For **EBS DBC Content**, use the content you copied. |
| 114 | +16. Select **Next**. |
| 115 | + |
| 116 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/add-application.png#lightbox) |
| 117 | + |
| 118 | +### IdP configuration |
| 119 | + |
| 120 | +Use the DCMC one-click integration to help you complete Azure AD configuration. With this feature, you can reduce management costs and configuration errors are less likely. |
| 121 | + |
| 122 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/configure-idp.png#lightbox) |
| 123 | + |
| 124 | +### Docker Compose file |
| 125 | + |
| 126 | +Configuration on the management console is complete. You are prompted to deploy Datawiza Access Proxy (DAP) with your application. Make a note the deployment Docker Compose file. The file includes the image of the DAP, PROVISIONING_KEY, and PROVISIONING_SECRET. DAP uses this information to pull the latest configuration and policies from DCMC. |
| 127 | + |
| 128 | +  |
| 129 | + |
| 130 | +### SSL configuration |
| 131 | + |
| 132 | +1. For certificate configuration, select the **Advanced** tab on your application page. |
| 133 | + |
| 134 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/advanced-tab.png#lightbox) |
| 135 | + |
| 136 | +2. Enable SSL. |
| 137 | +3. Select a **Cert Type**. |
| 138 | + |
| 139 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/cert-type.png#lightbox) |
| 140 | + |
| 141 | +4. There's a self-signed certificate for localhost, which you can use for testing. |
| 142 | + |
| 143 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/self-signed-cert-type.png#lightbox) |
| 144 | + |
| 145 | +5. (Optional) You can upload a certificate from a file. |
| 146 | + |
| 147 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/file-based-cert-option.png#lightbox) |
| 148 | + |
| 149 | +6. Select **Save**. |
| 150 | + |
| 151 | +### Optional: Enable MFA on Azure AD |
| 152 | + |
| 153 | +To provide more security for sign-ins, you can enforce MFA for user sign-in by enabling MFA on the Azure portal. |
| 154 | + |
| 155 | +1. Sign in to the Azure portal as a Global Administrator. |
| 156 | +2. Select **Azure Active Directory** > **Manage** > **Properties**. |
| 157 | +3. Under **Properties**, select **Manage security defaults**. |
| 158 | + |
| 159 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/manage-security-defaults.png#lightbox) |
| 160 | + |
| 161 | +4. Under **Enable security defaults**, select **Yes**. |
| 162 | +5. Select **Save**. |
| 163 | + |
| 164 | + [  ](./media/datawiza-azure-ad-sso-mfa-oracle-ebs/enable-security-defaults.png#lightbox) |
| 165 | + |
| 166 | +## Next steps |
| 167 | + |
| 168 | +- Video: [Enable SSO and MFA for Oracle JD Edwards with Azure AD via Datawiza](https://www.youtube.com/watch?v=_gUGWHT5m90) |
| 169 | +- [Tutorial: Configure Secure Hybrid Access with Azure AD and Datawiza](./datawiza-with-azure-ad.md) |
| 170 | +- [Tutorial: Configure Azure AD B2C with Datawiza to provide secure hybrid access](../../active-directory-b2c/partner-datawiza.md) |
| 171 | +- Go to docs.datawiza.com for Datawiza [User Guides](https://docs.datawiza.com/) |
0 commit comments