- · PDF fileProvisioning (DIP) templates ... Authentication vs. Authorization Identifies the...

<Insert Picture Here>

Using Oracle Application Server 10g with Oracle E-Business Suite Steven ChanDirector, Applications Technology Group

Topics

• Supported Architectures• Features and Benefits• Technical Integration Overview• Integration with Third Party Access Managers & LDAP

Directories• Customer Snapshots

• Release 11i Certification Roadmap• Release 12 Technology Stack Plans• References

Last updated: Oct 22, 2006

Desupport NoticesOr, “Why You Should Plan for OracleAS 10g Now”

• Discoverer 4i October 2006

• Login Server 3.0.9• Portal 3.0.9 July 2007• Oracle Internet Directory 3.0.1

For more details:http://blogs.oracle.com/schan/desupport

However…

If Sun desupports JDK 1.3, the required prerequisite for 3.0.9, in ~ Fall 2006, then Sun’s desupport date overrides Oracle’s for these products.

Now Generally Available!

• E-Business Suite 11i integrations with Oracle Application Server 10g 10.1.2.0.2 and 10.1.2.1 are now certified and Generally Available

Simple Physical Architecture

ExternalUsers

(via VPN)

Release 11iDatabase

InternalUsers

IntranetFirewall

Oracle Application Server 10g• Portal• Single Sign-On• Oracle Internet Directory• Directory Integration & Provisioning• Delegated Administration Services• Discoverer• OracleAS Certificate Authority• OracleAS 10g Metadata Repository

Firewall

Release 11i9iAS 1.0.2.2.2Application Server

11i Integration with OracleAS 10g

• Release 11i instance runs Oracle9i Application Server 1.0.2.2.2

• 11i is integrated with a stand-alone Oracle Application Server 10g instance

• The existing Release 11i application-tier server nodes continue to run on Oracle9i Application Server 1.0.2.2.2

Distributed Architecture

FirewallFirewall

Internet ReverseProxy

Firewall

OracleAS 10gInfrastructure

Database

OracleInternet

DirectoryServer 10gInternal 9iAS 1.0.2

Server

Release 11iDatabase

InternalUsers

ExternalUsers

External9iAS 1.0.2

Server

SingleSign-On 10g

Portal10g

Distributed Architecture Benefits

Enterprise Portal ServerMay be scaled & managed by separate organizations responsiblefor corporate communications

Enterprise Security ServersMay be scaled & managed by separate organizations responsiblefor corporate security and identity management

Enterprise Application ServersMay be scaled & managed by separate organizations responsiblefor enterprise applications such as Oracle E-Business SuiteRelease 11i

OracleAS 10g Integration Benefits

1. Enable Single Sign-On for 11i2. Manage users in Oracle Internet Directory3. Access 11i via custom Portals4. Integrate 11i with third-party PKI, SSO & LDAP

directories, and legacy applications5. Analyse 11i with Discoverer workbooks6. Accelerate 11i performance with WebCache

Enable Single Sign-On for 11i

• E-Business Suite is a Single Sign-On partner application • Log on to Oracle Single Sign-On to get access to all registered partner

applications, including 11i• Log off any one partner application to log off all of them

E-Business Suite 11i Application Server

User

SingleSign-On 10g

Manage Users in Oracle Internet Directory

• Synchronise user credentials bidirectionally between Oracle Internet Directory and Release 11i (FND_USER)

• Set master “source of truth” as OID, Release 11i, or both• Manage user provisioning via powerful OID Directory Integration &

Provisioning (DIP) templates• Link an OID userid with one or more 11i userids “on-the-fly”

E-Business Suite 11i FND_USER

OracleInternetDirectory

DIP

DBMS_LDAP

Access 11i via custom Portals

• Access one or more E-Business Suite 11i instances from a single Oracle Portal instance

• Add 11i portlets to custom Portal pages• Display data in 11i portlets based on 11i responsibilities

OraclePortal 10g

E-BusinessSuite 11i

AppsPortlets

Release 11i Portlets

• Applications NavigatorAccess Applications menus based on user responsibilities

• Applications FavoritesBookmark specific Applications links for quick access

• Applications WorklistSummary of current workflow notifications

• Oracle Balanced ScorecardDisplay status of strategic and tactical business objectives

• Performance Management ViewerDisplay business intelligence key performance indicators in graphical and tabular format

Applications Navigator PortletFlat Mode Tree Mode

Applications Favorites Portlet

Applications Worklist Portlet

Balanced Scorecard Portlets

Integrate 11i with…

• Over 250 adapters for Enterprise Application Integration with third-party applications

• J2EE and open standards-based integration, including:• E-Business Suite, third-party applications, database sources• XML, JMS, JCA• Web Services: SOAP, WSDL, UDDI• B2B Protocols: RosettaNet, HIPAA, EDI

Release 11iLegacyApplication

OracleIntegration

Analyse 11i with Discoverer 10g

• Access APPS_MODE End-User Layer via Business Intelligence System Discoverer workbooks secured by Applications responsibilities

• Provide powerful end-user reporting via ad hoc queries• Drill-down into data via tabular & graphical analytical tools• Run Discoverer on separate cluster for enhanced scalability, wide deployment

Discoverer

E-Business Suite End-User Layer

User

Why Upgrade Discoverer 4i to 10g?

It’s better• Automatic SQL trimming, per user

memory caps, faster, new features

It’s safe• Installation upgrades a copy of 4i

End-User Layer to 10g

It’s low-impact• TIP: Run Discoverer 4i and 10g on

different physical servers to avoid Visibroker conflicts

• Compare 4i and 10g workbooks side-by-side for User Acceptance Tests

It’s free• Your existing Business Intelligence

product license includes 10g

It’s supported• Discoverer 4i is desupported on

October 31, 2006

Start your upgrade now to avoid being

desupported

Tasty Carrots Big Stick

Accelerate 11i Performance with WebCache

• Cache and compress frequently used items• Reduce network consumption and accelerate response time• Can act as a reverse-proxy server• Can act as a load-balancer

WebCache 10g

User E-Business Suite 11i Application Server

<Insert Picture Here>

Technical Integration Overview

Apps 11i Configuration Options

A. Single Sign-On ServerMinimum requirement for single sign-on support.Release 11i and regions via OA Framework

B. Portal and Single Sign-On ServerOptional.

C. DiscovererOptional. SSO also optional for Discoverer standalone implementations.

OracleAS 10g + 11i Integration Points

APPS_MODE End-User Layer in 11i databaseDiscoverer

Oracle Applications Framework Web Provider & portlets

Portal

Provisioning integrated application via Directory Integration & Provisioning Platform

OID

Single Sign-On partner application via SSO SDK 9.0.2

SSO

Logical Architecture

Ext OracleAS Metadata

SingleSign-On

OracleInternet

Directory

Apps WebProvider &

Portlets

9iAS1.0.2.2.2

11iDatabase(FND_USER)

PortalMetadata

OID UserRepository

DirectoryIntegration

Platform 10g

Third-PartyLDAP(optional)

Third-PartySSO

(optional)

Asynchronousprovisioning

Synchronousprovisioning(DBMS_LDAP)

SSO SDK

Portal

External OracleAS 10g

11i Application Server 11i Database Server

JDB

C/SQ

L*Net

JDB

C/SQ

L*Net

DiscovererMetadata

DiscovererEnd-User

Layer

Authentication vs. Authorization

Identifies the user

OracleSingle

Sign-On

E-BusinessSuite

Authentication Authorization

Identifies data & actions the user

can access

Checks user credentials

Checks user responsibilities

How Single Sign-On Works with 11iOverview

• Unauthenticated users attempting E-Business Suite access are automatically redirected to Oracle Single Sign-On 10g

Oracle SingleSign-On 10g

E-BusinessSuite 9iAS1.0.2.2.2

… delegates user authentication to …

How Single Sign-On Works with 11iOverview

E-Business Suite 11iDatabase

SingleSign-On 10g

Oracle InternetDirectory 10g

OracleAS 10gLDAP Directory

UserE-BusinessSuite 11iApplicationServer

How Single Sign-On Works with 11i

• Step 1: Unauthenticated user attempts to access the E-Business Suite

E-Business Suite 11i Application Server

User

How Single Sign-On Works with 11i

• Step 2: E-Business Suite redirects user to Single Sign-On 10g for authentication

E-Business Suite 11i Application Server

User SingleSign-On 10g

How Single Sign-On Works with 11i

• Step 3: Single Sign-On challenges the user with a logon form

UserSingleSign-On 10g

LogonForm

How Single Sign-On Works with 11i

• Step 4: User provides her credentials via the logon form

UserSingleSign-On 10g

LogonForm

How Single Sign-On Works with 11i

• Step 5: Single Sign-On passes user credentials to Oracle Internet Directory for validation

SingleSign-On10g

Oracle InternetDirectory 10g

How Single Sign-On Works with 11i

• Step 6: Oracle Internet Directory authenticates the user credentials against the OracleAS 10g LDAP Directory (in the OracleAS 10g Metadata Repository)

OracleAS 10gLDAP Directory

Oracle InternetDirectory 10g

How Single Sign-On Works with 11i

• Step 7: Single Sign-On provides the authenticated user with a security token

SingleSign-On 10g

User

SSO SecurityToken

How Single Sign-On Works with 11i

• Step 8: User is redirected to E-Business Suite, which accepts the SSO security token as proof of an authenticated user

E-Business Suite 11iApplication Server

User

SSO SecurityToken

How Single Sign-On Works with 11i

• Step 9: E-Business Suite’s application server checks the user’s authorization (i.e Apps responsibilities) in FND_USER

E-Business Suite 11iApplication Server

E-Business Suite 11iDatabase (FND_USER)

How Single Sign-On Works with 11i

• Step 10: E-Business Suite issues its own Apps security tokens to the user, redirecting her to the requested Apps module

E-Business Suite 11iApplication Server

Apps SecurityToken

E-Business Suite 11iDatabase

User

How Single Sign-On Works with 11i

E-Business Suite 11iDatabase

SingleSign-On 10g

Oracle InternetDirectory 10g

OracleAS 10gLDAP Directory

UserE-BusinessSuite 11iApplicationServer

Oracle Internet Directory Integration

• Oracle Internet Directory and FND_USER must be kept synchronised• Supported synchronisation directions:

• From OID to FND_USER (Asynchronous via the Directory Integration & Provisioning Platform)

• From FND_USER to OID (Synchronous via dbms_ldap calls)• Bidirectionally

• Synchronisation events are raised via the Workflow-based Business Event System whenever users are added or modified

E-Business Suite 11i FND_USER

OracleInternetDirectory

DIP

DBMS_LDAP

Link Accounts

OracleInternet

Directory

Userid =“John.Smith”

Release 11i(FND_USER)

Userid =“jsmith”

One-time User Registration• Done at setup time by system administrator

• Optional: can be done by end-user on first logon (“Link on the fly”)

• Useful for situations where existing accounts in Oracle Internet Directory 10g or a third-party LDAP directory differ from existing accounts in Release 11i.

“Link Account”Global Unique Identifier (GUID)

Link to Multiple 11i Accounts

• Note: It’s not possible to link multiple OID accounts to the same 11i account

OracleInternet

Directory

Userid =“John.Smith”

Release 11i(FND_USER)

Userid =“jsmith”

“Link Account”

Userid =“testuser1”

Userid =“testuser2”

Portal Integration

Portal 10g

Apps 11i Portlet

OAF WebProvider

11i App Server

JPDK 3.0.9

Portal Metadata

User

Portal Integration

• Single Sign-On is a prerequisite for Portal

• Oracle Applications Framework Web Provider is registered in Portal 10g

• 11i Portlets communicate with 11i 9iAS 1.0.2.2.2 server:

• Oracle Applications Framework Web Provider

• JPDK 3.0.9

• 11i portlets are added to custom Portal pages• 11i portlet users must have a valid 11i responsibility, validated via ICX_SESSION

Discoverer Integration

• Discoverer 10g End-User Layer resides in 11i database• APPS_MODE option enforces Applications security for all Discoverer

users• Discoverer 10g Server is often deployed standalone for performance

DiscovererServer 10g

DiscovererEnd-User Layer forE-Business Suite

User

Full Discoverer 10g Support for Single Sign-On

• Earlier versions of Discoverer 10g did not support Single Sign-On & Oracle Internet Directory integration for E-Business Suite users

• Full SSO/OID support is now available

• No more dual-maintenance of E-Business Suite user passwords in both FND_USER and OID for standalone Discoverer connections

• See Metalink Note 313418.1 for details

Accelerate 11i Performance with WebCache

• Frequently used items (e.g. images, static text) are cached, compressed, and served by WebCache

• Secured data (I.e. requiring authorization) is not cached• Partial page refresh supported for Portal• Can act as a reverse-proxy server• Can act as a load-balancer

WebCache 10g

User E-Business Suite 11i Application Server

<Insert Picture Here>

Integrating the E-Business Suite with Third-Party Access Management &LDAP Directories

Third-Party Single Sign-On Integration

Oracle SingleSign-On 10g

E-BusinessSuite 9iAS1.0.2.2.2

Third-PartySSO

… delegates user authentication to …

… delegates user authentication to …

Supported Third-Party SSO Integrations

Integrate Oracle Single Sign-On with• Windows Native Authentication via Kerberos• CA Entrust, CA Netegrity, IBM Tivoli, RSA • PKI X.509v3 Digital Certificates• Biometric and smartcard systems• Other SSO systems via custom adapters

• Oracle Identity Federation• Formerly Oblix COREid Federation• SAML, WS-Federation, Liberty Alliance

• Oracle Access Manager• Formerly Oblix COREid Access & Identity• Oracle Identity Federation

If you already have a third-party LDAP…

OracleInternetDirectory10g

E-BusinessSuite DB(FND_USER)

Third-PartyLDAP

… synchronizes user attributes with …

… synchronizes user attributes with …

Supported Third-Party LDAP Integrations

Integrate Oracle Internet Directory with• Microsoft Active Directory 2000/2003• Microsoft Exchange 2000/2003• Sun Java System Directory (Sun ONE / iPlanet) 5.2• Novell eDirectory 8.6 / 8.7• OpenLDAP 2.2• Any LDAP directory via LDIF files• Any other directory via custom DIP agent

• Oracle Identity Manager• Formerly Thor Xellerate Identity Provisioning

• Oracle Virtual Directory• Formerly OctetString Virtual Directory Engine

E-BusinessDatabase(FND_USER)

OracleInternet

Directory

Third-PartyLDAP(optional)

User Password User Password User PasswordX X

Passwords Stored in Third-Party LDAP

• Third-party LDAP:• Handles user authentication, usually with a third-party authentication

solution• Commonly considered “Master” source-of-truth

• Oracle Internet Directory and E-Business Suite take minimal copies of master user definition -- excluding passwords

• E-Business Suite doesn’t maintain user passwords in this configuration

<Insert Picture Here>

How Third-Party Identity Management works withthe E-Business Suite

Third-Party Integration Architecture

Single Sign-On 10g

OracleInternetDirectory 10g

EndUser

Third-PartySSO

Third-PartyLDAP

Apps 11i9iAS 1.0.2.2.2

Apps 11iDatabase(FND_USER)

How Third-Party Logons Work with 11i

• Step 1. User provides userid & password to third-party single sign-on system

Third-PartySSO

How Third-Party Logons Work with 11i

• Step 2. Third-party single sign-on sends user’s credentials to third-party LDAP for authentication

Third-PartyLDAP

Third-PartySSO

How Third-Party Logons Work with 11i

• Step 3. Third-party single sign-on provides authenticated user with third-party security token

Third-PartySSO

Third-PartyToken

How Third-Party Logons Work with 11i

• Step 4. User attempts to access E-Business Suite, and is redirected to Oracle Single Sign-On 10g

E-BusinessSuite

Single Sign-On10g

How Third-Party Logons Work with 11i

• Step 5. Oracle Single Sign-On recognizes the third-party security token, then issues its own

Single Sign-On 10g

SSO Security Token

How Third-Party Logons Work with 11i

• Step 6. User is redirected back to E-Business Suite, which recognizes the SSO security token and issues its own

Single Sign-On 10gApps

SecurityToken

E-BusinessSuite

Third-Party Integration Architecture

Single Sign-On 10g

OracleInternetDirectory 10g

EndUser

Third-PartySSO

Third-PartyLDAP

Apps 11i9iAS 1.0.2.2.2

Apps 11iDatabase(FND_USER)

<Insert Picture Here>

Customer Case Studies

Customer Snapshots

• Over 1,000 customers deploying so far• At least 30 in production

Customer References Speaking at OpenWorld 2006• RAFAEL Armament Development Authority (S281389)• Regal Beloit Corporation (S283122)

Others Deployed in Production • Amdocs (Israel)• Alcoa (Europe)• Applied Materials (Israel)• Atento (Norway)• Berwind Pharmaceuticals (USA)• Bunnings (Australia)• CapGemini / Councils Online (Australia)• Central Bank of Nigeria• Cisco Systems• Cox Communications (USA)• Fiera Milano (Italy)• General Dynamics Land Sys• General Electric (USA)• Google (USA)

• Guandong Unicom (China)• Inter-Arab Investment Guarantee (Kuwait)• International Enterprises (Singapore)• International Institute for Applied Systems

Analysis (Austria)• Ireland Dept of Defence• Kansas State University• Libgo Travel (USA)• Mitac (Taiwan)• Phoenix Technologies (USA)• Putrajaya (Malaysia)• Telecom Italia Mobile (Italy)• Texas Instruments (USA)• Universal Weather & Aviation (USA)• Wind River Systems (USA)• World Wide Technology

These are not customer references

Integration with MicrosoftActive Directory Only

Single Sign-On10g

OracleInternetDirectory 10g

EndUser

MicrosoftActiveDirectory

Apps 11i9iAS 1.0.2.2.2

Apps 11iDatabase(FND_USER)

Integration with MicrosoftActive Directory & Kerberos

Single Sign-On 10g

OracleInternetDirectory 10g

EndUser

Microsoft WindowsNative Authenticationvia Kerberos

Microsoft ActiveDirectory

Apps 11i9iAS 1.0.2.2.2

Apps 11iDatabase(FND_USER)

Internal / External Configuration

FirewallFirewall

Internet ReverseProxy

Firewall

External9iAS 1.0.2

Server

OracleAS 10gInfrastructure

Database

OracleInternet

DirectoryServer 10gInternal 9iAS

1.0.2 Server

Release 11iDatabase

InternalUsers

SingleSign-On 10g

ExternalUsers

Shared 11i Filesystem

RAC 1 RAC 2

Highly Available

FirewallFirewall

ExternalUsers

Internet ReverseProxy

Firewall

InternalUsers

WebNode 3

WebNode 4

HTTP LBR2

HTTPLBR1

WebNode 2

WebNode 1

LBR1

SSONode 2

SSONode 1

OracleAS 10gInfrastructure DB

OID 1 OID 2

The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions.The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.

<Insert Picture Here>

Release 11iCertification Roadmap

New Certifications Since OpenWorld 2005

Now Available

• SSO 10g Integration Rollup 4 (a.k.a Build 4.0)Full SSL, RAC, DMZ Support

• Oracle Application Server 10g Version 10.1.2.1

• Portal 10.1.4

• Critical Patch Updates (CPUs)• October 2005

• January, April, July, October 2006

Upcoming Certifications

• Oracle Identity Management 10g Ver. 10.1.4

• Oracle Application Server 10g Ver. 10.1.2.2

• Oracle Application Server 10g Ver. 10.1.3.1 Service Oriented Architecture Suite

• Business Intelligence 10g Ver. 10.1.3.2(Siebel Business Analytics, “Maui” release)

"This presentation is for informational purposes only and may not be incorporated into a contract or agreement"

<Insert Picture Here>

Release 12Technology Stack Plans

Release 12 Technology Stack 3-Tier Logical Architecture

Application

JSP

Forms

Reports

BC4J

OC4J

Web

Lis

tene

rUIX

DatabaseClient

Data Guard

Partitioning

RAC & ASM

Global Single Data Model

JDB

C/SQ

L Net

HTTP / S

Application Tier Overall Structure

COMMON TOP

APPL TOP

Apache 1.3

OC4J

RSF 10.1

AS 10.1.3Java Oracle Home

Reports 10

Forms 10

RSF 10.1

Developer 10.1.2C Oracle Home

RDBMSComponents

RSF 10.2

DatabaseOracle Home

R12 Application Server Tier

• OracleAS 10g 10.1.2 for Forms & Reports Services• Replaces the 8.0.6-based Oracle_Home provided by iAS 1.0.2.2 in

11i

• OracleAS 10g 10.1.3 for Oracle Containers for Java (OC4J)• Replaces the 8.1.7-based Oracle_Home provided by iAS 1.0.2.2 in

11i

• Oracle JDeveloper 10.1.3• JDBC 10.2• JDK 5.0 for web & concurrent processing

Optional External Integrations

Ext OracleAS Metadata

SingleSign-On

OracleInternet

Directory

Apps WebProvider &

Portlets

OracleAS10.1.3

R12Database(FND_USER)

PortalMetadata

OID UserRepository

DirectoryIntegration

Platform 10g

Third-PartyLDAP(optional)

Third-PartySSO

(optional)

Asynchronousprovisioning

Synchronousprovisioning(DBMS_LDAP)

mod_osso

Portal

External OracleAS 10g

R12 Application Server R12 Database Server

JDB

C/SQ

L*Net

JDB

C/SQ

L*Net

DiscovererMetadata

DiscovererEnd-User

Layer

Optional on External Servers for R12

• OracleAS 10g Single Sign-On & Oracle Internet Directory 10.1.2.x

• Discoverer 10.1.2.x• OracleAS 10g 10.1.3.1 SOA Suite• Portal 10.1.4• WebCache 10.1.2.x• Oracle Integration 10.1.2.x• Collaboration Suite 10gR2• Enterprise Manager 10gR2

Apps Portlets in Third-Party Portals

• E-Business Suite portlets expected to be releasedfor third-party portals

• WSRP / JSR-168 compatibility

New and Changed Features

• SSO integration using mod_osso• “SWAN” UI based new local login page• Support for adding custom local login pages• Synchronous provisioning from E-Business Suite to OID• Support for username changes• Pending user creation• On-demand user creation• Support for case-sensitive passwords• Support for E-Business Suite proxy user sessions

Local Login PageRelease 11i User Interface

Local Login PageRelease 12 “SWAN” User Interface

Local Login PageRelease 12 Login Assistance

Local Login Page Benefits

• Replaces the current local login page AppsLocalLogin.jsp• Ability to customize local login page• Automated password reset• Automated userid reminder• Accessibility mode for screen readers

The preceding is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions.The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.

New E-Business Suite Technology Stack Blog

http://blogs.oracle.com/schan

• Certification, desupport announcements• Discussion architectures, advanced

configurations• Early Adopter Programs• Statements of Direction• Supports RSS feedreaders• Discuss Apps techstack topics with

senior Development Architects

OracleAS + E-Business Suite Resources

• Frequently Asked Questions Note 186981.1

• SSO/OID Installation Guide Note 233436.1

• SSO/OID Implementation Guide Note 261914.1

• Portal Installation Guide Note 305918.1

• Discoverer Installation Guide Note 313418.1

• Documentation Roadmap Note 207159.1

• Statement of Direction Note 223927.1

<Insert Picture Here>

Release 12More SSO/OID Integration Features

The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions.The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.

Synchronous Provisioning Description

• Synchronous user creation and modification• Users can be created or updated in the E-Business Suite

e.g. iStore• This feature provides the capability to create and update users

synchronously in Oracle Internet Directory• Useful for self service user registration applications, especially for

external users • Users can login immediately after self-registration

R12Database(FND_USER)

OID UserRepository

Synchronous provisioning(DBMS_LDAP)

• Eliminates delays in provisioning user attribute changes from the E-Business Suite to Oracle Internet Directory

• Users can log in immediately after self-registration in E-Business Suite applications like iStore

• Reduces potential confusion of users due to lags in the provisioning process

Synchronous Provisioning Benefits

User Name ChangesDescription & Benefits

Description• This feature provides the ability to change the fnd_user username.

• Optionally triggers updates to user entries in Oracle Internet Directory• Username updates are made to the Oracle Internet

Directory attribute designated as the nickname

Benefits• Useful for updating user names in the event of marital status

changes

Pending UsersDescription

• Pending users are optionally created by selected E-Business Suite modules:• User Management (UMX)• Applications that support self-registration (e.g. iStore)

• Pending users are created with a future start and end date• Not activated until approved by a system administrator• If approved, the E-Business user’s dates are updated and the

user is enabled in Oracle Internet Directory• If rejected, the E-Business and OID users are deleted

On-Demand User Creation Description

Possible Scenario• An Oracle Internet Directory instance exists with a large number of

users (e.g. 6 million registered users)• A small subset of those registered OID users require access to the

E-Business Suite (e.g. only 600,000 users)

Implementation Problem• It’s unnecessary and a waste of resources to create equivalent E-

Business Suite accounts for all registered OID users

On-Demand User Creation Description

Solution• On-Demand User Creation creates E-Business Suite accounts for

a registered OID user only if needed

Functional Flow1. User logs into Single Sign-On with their account registered in Oracle

Internet Directory2. User requests access to an E-Business Suite function

(e.g. iStore, iRecruitment)3. An E-Business Suite account is automatically created for the registered

OID user. The two accounts are linked.4. User is permitted immediate access to the requested E-Business Suite

function (e.g. iStore, iRecruitment)

Case-Sensitive PasswordsDescription

• Users must enter passwords in the correct case• Example

• Password stored in user account: “OpenSesame”• User enters “opensesame”: login is rejected• User enters “OpenSesame”: login is accepted

• This setting can be enabled at the site-level

Case-Sensitive PasswordsChanging Passwords

When this feature is enabled:

• A change password hint, FND_SENSITIVE_PASSWORD_CHANGE,reminds the user that their password is case-sensitive

• The hint is displayed on:• SSO “Change Password” dialog for expired passwords• OA Framework “Preferences” page• “Change Password” popup in Forms

Support for Proxy Users

• Allows a user to grant permission to another user to perform a limited set of actions in their name

• Scenario:• Sharon, a vice-president, is going on vacation• Sharon gives permission to John, her secretary, to approve

expense reports in her absence• John logs on using his own account, but temporarily can

access Sharon’s “approve expense report” responsibility• By proxy, John approves expense reports submitted for

Sharon’s review

The preceding is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions.The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.

New E-Business Suite Technology Stack Blog

http://blogs.oracle.com/schan

• Certification, desupport announcements• Discussion architectures, advanced

configurations• Early Adopter Programs• Statements of Direction• Supports RSS feedreaders• Discuss Apps techstack topics with

senior Development Architects

OracleAS + E-Business Suite Resources

• Frequently Asked Questions Note 186981.1

• SSO/OID Installation Guide Note 233436.1

• SSO/OID Implementation Guide Note 261914.1

• Portal Installation Guide Note 305918.1

• Discoverer Installation Guide Note 313418.1

• Documentation Roadmap Note 207159.1

• Statement of Direction Note 223927.1