Starting Point
A leading insurance company with over 2,000 employees ran Oracle E-Business Suite (EBS) as its central ERP system for financial accounting, claims management, and policy administration. In parallel, the company used Microsoft Active Directory (AD) to manage all user accounts and access rights.
The problem: Two separate identity worlds.
- Employees had to log in twice — once at the Windows workstation (AD), once in Oracle EBS with separate credentials
- Password resets for Oracle EBS were the most common helpdesk ticket type (23% of all tickets)
- Provisioning was manual: when a new employee started, IT had to create Oracle users separately, assign roles, and configure access rights — lead time: 2-3 days
- Deprovisioning was risky: upon departure, the AD account was immediately deactivated, but Oracle access often remained active for days or weeks — a compliance risk
- No centralized audit trail for user activities across both systems
Challenge
The integration had to satisfy multiple requirements simultaneously:
- SSO: One login for everything — Windows login automatically opens Oracle EBS
- Automatic provisioning: New AD user → automatic Oracle user with correct roles
- Automatic deprovisioning: AD account deactivated → Oracle access immediately locked
- Role-based access control (RBAC): AD groups control Oracle EBS Responsibilities
- Audit trail: Every login, every role change logged without gaps
- Zero downtime: The integration must not interrupt ongoing Oracle EBS operations
Solution
Architecture
We implemented a three-layer integration architecture:
1. Identity Bridge (Oracle Access Manager)
- Oracle Access Manager (OAM) as the central authentication layer
- Kerberos-based SSO: Windows login is passed through as Oracle authentication
- Fallback to form-based login for external access (VPN)
2. Directory Synchronization (Oracle Internet Directory)
- Oracle Internet Directory (OID) synchronizes users and groups from Active Directory
- Bidirectional sync every 15 minutes
- Mapping rules: AD groups → Oracle EBS Responsibilities (e.g., “FIN-Accounting” → “General Ledger User”)
3. Lifecycle Automation
- Automatic user creation in Oracle EBS upon AD account creation
- Automatic role assignment based on AD group membership
- Immediate lock upon AD account deactivation (event-based, not batch)
- Self-service password reset via AD portal — Oracle password eliminated entirely
Migration Approach
The migration proceeded in three phases without operational interruption:
- Parallel operation (4 weeks): Both login methods active, SSO optional
- Soft cutover (2 weeks): SSO as default, legacy login still available
- Hard cutover: Legacy login deactivated, SSO only
Results
| Metric | Before | After |
|---|---|---|
| Login events per day | 2 (AD + Oracle) | 1 (AD only) |
| Password reset tickets | 23% of all tickets | 0% (no Oracle password) |
| Provisioning time | 2-3 days | Automatic (minutes) |
| Deprovisioning time | 1-5 days | Immediate (event-based) |
| Compliance findings (audit) | 3-4 per year | 0 since introduction |
| Helpdesk volume | Baseline | −18% |
Lessons Learned
1. Role Mapping Is the Real Complexity
The technical SSO integration took 3 weeks. Mapping 120 AD groups to 85 Oracle EBS Responsibilities — including consolidation, cleanup, and approval by business teams — took 8 weeks.
2. Event-Based Deprovisioning Is Mandatory
Batch-based deprovisioning (once daily) is insufficient in regulated industries. We implemented event-based deprovisioning: AD deactivation triggers immediate Oracle lockout.
3. Self-Service Reduces Helpdesk Load Dramatically
Eliminating the separate Oracle password was an unexpected quick win: 23% fewer helpdesk tickets without users having to do anything actively.