Short answer
Oracle EBS SSO with Active Directory normally needs an identity bridge between the Windows identity and E-Business Suite. In the implementation described here, Oracle Access Manager (OAM), WebGate and E-Business Suite AccessGate handled authentication, while Oracle Internet Directory synchronized the attributes needed to map an AD identity to an EBS user. Provisioning, responsibilities and deprovisioning were governed separately.
Starting point
A leading insurance company with more than 2,000 employees ran Oracle E-Business Suite as its central ERP system for financial accounting, claims management and policy administration. Microsoft Active Directory managed workforce identities and access outside EBS.
The two identity worlds created avoidable work and risk:
- Employees signed in once to Windows and again to Oracle EBS with separate credentials.
- Oracle password resets represented 23% of helpdesk tickets in the project baseline.
- New EBS accounts, roles and access rights took two to three days to provision manually.
- Deactivating an AD account did not automatically remove the matching Oracle access.
- Auditors had no single, current view of identity status across both systems.
This made the engagement both an identity integration and a governance project. Our Infrastructure Management service covers the Active Directory and operational layer; the implementation also drew on our broader Cloud & Infrastructure capabilities.
Requirements and control objectives
The target design had to provide:
- Single sign-on: the authenticated Windows identity opens Oracle EBS without a second password.
- Controlled provisioning: new users receive only approved EBS responsibilities.
- Immediate deprovisioning: disabling the source identity blocks EBS access without waiting for a daily batch.
- Traceable role mapping: AD groups and EBS responsibilities have named owners and approval rules.
- Audit evidence: login, provisioning and role changes are logged end to end.
- Controlled migration: the existing EBS operation remains available throughout rollout.
Oracle EBS and Active Directory SSO architecture
1. Authentication bridge
Oracle Access Manager acted as the central authentication layer. WebGate and E-Business Suite AccessGate passed the authenticated identity into EBS and created the application session. The Windows sign-in was used for the internal Kerberos flow; an approved fallback covered remote access.
Oracle’s documentation emphasizes that the unique user attributes passed by the identity layer must match the EBS user record. That mapping is a critical design and test point—not a detail to leave until cutover.
2. Directory synchronization
Oracle Internet Directory synchronized users and groups from Active Directory. In this project:
- a scheduled synchronization ran every 15 minutes;
- unique identity attributes linked the directory entry to the EBS user;
- approved mapping rules translated AD groups into EBS responsibilities;
- exceptions were surfaced for manual review instead of silently assigning access.
3. Lifecycle automation
The lifecycle workflow created the EBS user, applied approved responsibilities and locked access when the source account was disabled. Event-based deprovisioning covered departures and urgent access revocation; scheduled reconciliation detected missed or inconsistent records.
Migration without operational interruption
The rollout used three controlled phases:
- Parallel operation for four weeks: SSO was optional and the legacy login remained available.
- Soft cutover for two weeks: SSO became the default while a restricted fallback and rollback path remained.
- Hard cutover: the legacy login was disabled after user, role, audit and support criteria passed.
Testing covered representative responsibility combinations, disabled users, renamed accounts, remote access, bookmarked EBS URLs and failure of individual identity components. This reduced the risk of treating a successful login as proof that the full lifecycle worked.
Project results
| Metric | Before | After |
|---|---|---|
| Login events per day | 2 (AD + Oracle) | 1 (AD only) |
| Oracle password-reset tickets | 23% of all tickets | 0% (no separate Oracle password) |
| Provisioning time | 2–3 days | Minutes through automation |
| Deprovisioning time | 1–5 days | Immediate event-based lock |
| Compliance findings in this control area | 3–4 per year | 0 since rollout at time of review |
| Total helpdesk volume | Baseline | 18% lower |
These are client-specific before/after figures captured for this implementation. They should not be used as a forecast without measuring the current ticket mix, identity processes and EBS responsibility model in your own environment.
What determined the project effort
Role mapping was the largest workstream
The technical SSO integration took three weeks. Reconciling 120 AD groups with 85 Oracle EBS responsibilities took eight weeks because IT, business owners and compliance had to consolidate duplicates, define ownership and approve separation-of-duties rules.
Deprovisioning needed two controls
Event-based lockout reduced the access window after an AD account was disabled. A scheduled reconciliation remained necessary to identify delivery failures, stale mappings and manual changes.
Cutover needed business evidence
Authentication success alone was not enough. Each pilot group validated its actual responsibilities and critical EBS flows before the next rollout wave.
Oracle EBS SSO FAQ
How can Oracle EBS be integrated with Active Directory for SSO?
A supported pattern uses Oracle Access Manager and E-Business Suite AccessGate between EBS and the identity layer. Active Directory supplies the user identity, while synchronized unique attributes map the user to the corresponding EBS account.
Which Oracle components are required for Oracle EBS SSO?
The exact components depend on the EBS and OAM releases. A common Oracle-documented architecture uses Oracle Access Manager, WebGate, E-Business Suite AccessGate and an Oracle directory service, plus a provisioning or synchronization path from Active Directory.
Can Active Directory groups control Oracle EBS responsibilities?
Yes, but the mapping is a governance project as well as a technical one. Groups, EBS responsibilities, approval owners and separation-of-duties rules must be reconciled before automated provisioning is enabled.
How do you migrate Oracle EBS to SSO without downtime?
Run legacy and SSO authentication in parallel, validate representative user and responsibility mappings, make SSO the default with a controlled fallback, and retire the legacy login only after monitoring and rollback criteria are met.
Plan your SSO assessment
A useful first assessment inventories the EBS/OAM versions, identity source, user keys, responsibility model, provisioning path and audit requirements. Discuss your Oracle EBS SSO landscape with us and we will turn that inventory into an architecture and migration outline.