Oracle OIC - ERP/HCM Adapter with OAuth Authentication

Oracle has introduced an OAuth authentication mechanism to access ERP and HCM applications using ERP/HCM  adapter respectively in OIC. 

This will solve the following security issues. 

1. Can maintain user credentials in IDCS. 
2. Wont require to reset the passwords during P2T refresh. 
3. Better security compared to basic authentication. 
4. Authentication will work even password will get expired in IDCS or Fusion. 

Set Up Trust Between Oracle Fusion Applications and Oracle Identity Cloud Service.

• Get the JWK signing certificates from the Oracle IDCS of Oracle Integration.
• Get the REST API of the Oracle IDCS endpoint that gives you the signing certificate endpoint.
• <IDCS_HOST_NAME>/admin/v1/SigningCert/jwk
• Note :  Before accessing the key make sure, access certificate is enabled in IDCS . Got to  Settings -> Default Settings and Toggle ON the "Access Signing Certificate"
• Copy the certificates present under "x5c" JSON element.
• Use the following template and save the certificates as .crt files.

-----BEGIN CERTIFICATE-----

 content_of_certificate

. . .

. . .

-----END CERTIFICATE----- 

• Upload the above certificates to the Oracle Fusion/HCM Applications Security Console.
• Note:  Since HCM and Fusion are using IDCS and following Authenticator provider will be in non editable mode. https://identity.oraclecloud.com/
• Raise an SR with Oracle team to upload the certificates and attached to this authentication provider. 

Create an ERP/HCM resource application. 

• Login into IDCS
• On the left Panel , Click the Applications and then click Add
• Select the confidential application option
• Provide a Name
• Go to next page
• Select the option - Configure this application as a resource server now.
• Select Is Refresh Token Allowed.
• In the Primary Audience field, add the Oracle Fusion/HCM Applications URL and port.
• https://FA_URL:443
• In the Scopes section, click Add.
• In the Scope field, enter /.
• In the Description field, enter All.
• Select Requires Consent.
• Click Add, then click Next.
• Click Finish to complete resource application creation.
• Click Activate to activate your client application.

 

Create a confidential Client application 

• In the left navigation pane, select Applications, then click Add to add a client application.
• Select Confidential Application.
• The Add Confidential Application wizard is displayed.
• Provide a Name
• Select Configure as a client application
•  Select appropriate Grant Types

• Provide callback URL 
• https://<OIC_HOST_NAME>/icsapis/agent/oauth/callback
• Select Client Type as Trusted if required and import SaaS certificate (Optional and Not Required)
• Add Scope
• Select ERP/HCM Resource application which we created earlier. 
• Select the scope
• Save changes
• Activate the application
• Collect Client Id and Secret. 

OIC Configurations:

• Login into OIC using admin or developer access.
• Make sure this user has got an access to Oracle Fusion as well. 
• Create ERP/HCM Adapter with Invoke Operation. 
• Provide SaaS URL
• Select Authentication type as OAuth Client Credentials.
• Provide Client Id and Secret which we got above. 
• Provide Authorization  and Token URL.
• https://idcs-<Id>.identity.oraclecloud.com/oauth2/v1/authorize
• https://idcs-<Id>.identity.oraclecloud.com/oauth2/v1/token
• Provide Scope Value (Get it from IDCS client application.)
• Add offline_access to the scope. 
• https://<SaaS_Host_Name>.fa.ocs.oraclecloud.com:443/ offline_access
• Select Provide Consent.
• Provide OIC user credentials. 
• Note : This user must present in Fusion as well. 
• Save and Test the connection.

ORACLE OIC - IDCS SEARCH TO RETRIEVE DATA

 We can IDCS search API to get the required attributes and limited user list using pagination logic. 

Use the following API details to fetch the data from IDCS. 

URL: https://idcs-<id>.identity.oraclecloud.com/admin/v1/Users/.search

Operation : POST

IDCS Scope : urn:opc:idm:__myscopes__

Sample Request Payload:

{

  "schemas" : [ "urn:ietf:params:scim:api:messages:2.0:SearchRequest" ],

  "attributes" : [ "displayName", "userName", "emails", "active", "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber" ],

  "filter" : "((urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber pr))",

  "startIndex" : 1,

  "count" : 100

}

OIC Expression  for Filter: 

filter :   conct("meta.lastModified ge ", '"', $varStartDate, '"', " and meta.lastModified le ", '"', $varEndDate, '"')

ORACLE OCI - Object Storage Multi Part Upload

In some cases we may have to upload larger file and uploading larger file may take more time and bandwidth.  In such cases we can split the file into multi parts and upload them in parallel. 

We can use the following steps to split and upload the files to object storage. 

• First split the file based on the required size using split command. 
• split -b 5M -d /tmp/bigfilename.txt /tmp/bigfilename.split
• Create a multi part upload request. 
• POST
• /n/{namespaceName}/b/{bucketName}/u
• Request Payload

{

  "object": "example_object1"

}

• Response Payload 

{

  "namespace": "ansh8lvru1zp",

  "bucket": "MyBucket",

  "object": "MyObject1",

  "uploadId": "c892336f-ccvb-1bb8-6e75-a5649fd91178"

}

•  Use the above upload Id to upload the files. 
• Loop over each file and upload the files 
• PUT
• /n/{namespaceName}/b/{bucketName}/u/{FinalFileName}?uploadid={UploadID}&uploadPartNum={partNum/SequenceNum}
• After Upload , get all the multi part upload details. 
• GET
• /n/{namespaceName}/b/{bucketName}/u/{FinalFileName}?uploadid={UploadID}
• Sample Response

[

  {

    "partNumber": 1,

    "etag": "3d240a5a-a2b0-45b2-bcvb-2ac6a02b422c",

    "md5": "rvr3UC1SmUw7cvb2NqPN0g==",

    "size": 8

  },

  {

    "partNumber": 2,

    "etag": "15de104e-7cvb-3513-8da1-3b5e75a65ad7",

    "md5": "3poFVtJezCVBOi8RzhUB8Q==",

    "size": 8

  }

]

• Finally commit the upload. 
• POST
• /n/{namespaceName}/b/{bucketName}/u/{FinalFileName}?uploadid={UploadID}
• Request Payload

 

{

  "partsToCommit": [

    {

      "partNum": 1,

      "etag": "3d240a5a-a2b0-45b2-bcvb-2ac6a02b422c"

    },

    {

      "partNum": 2,

      "etag" : "15de104e-7cvb-3513-8da1-3b5e75a65ad7"

    }

  ]

}

ORACLE IDCS - OAUTH2 - Get Token

Use the following details to get the OAuth Token from IDCS and invoke the service. 

Authentication URL:  https://idcs-xxxx.identity.oraclecloud.com/oauth2/v1/authorize

Authentication Token URL:  https://idcs-xxxx.identity.oraclecloud.com/oauth2/v1/token

Scope:  From IDCS application. 

Python - Generate SSL Certificate and Invoke SOAP/REST Using SSL certificate.

Steps to generate Keystore , CSR and Import Signed Certificates. 

• Login into Unix Box 
• Go to Java Home Dir
• cd %JAVA_HOME%/jre/bin
• Run the Keytool Command to Create Kestore - JKS
• keytool -genkey -keyalg RSA -alias <aliasname> -keystore identityKeystore.jks -storepass <replace_with_strong_password> -validity 900 -keysize 2048 
• <aliasName>  = Meaningfull Alias
• <replace_with_strong_password>  = Ketstore Password
• When prompted, change the values provided based on your company's security policy

What is your first and last name?

  [Unknown]:  VijayaKumar

What is the name of your organizational unit?

  [Unknown]:  Development

What is the name of your organization?

  [Unknown]:  ICS

What is the name of your City or Locality?

  [Unknown]:  Bangalore

What is the name of your State or Province?

  [Unknown]:  KA

What is the two-letter country code for this unit?

  [Unknown]:  IN

Is CN=<>, OU=<>, O=<>, L=Redwood Shores, ST=California, C=US correct?

  [no]:  yes 

Enter key password for <aliasName>

        (RETURN if same as keystore password):

 

• List the file generated using ls command. Now you should see jks file
• ls
• Generate CSR file for signing authority. 
• keytool -certreq -alias <aliasName> -keystore identityKeystore.jks -storepass <replace_with_strong_password>  -storetype JKS -file icsclient.csr
• List the files generated using ls command.  Now you should see both jks and csr file. 
• ls
• Share the CSR file with signing authority.  Or generate one using following URL.
• https://ssltools.digicert.com/checker/views/csrCheck.jsp
• In case if you receive the root and intermediate certificates from signing authrity us the followin commands to Import Root Certificates: 
• keytool -import -keystore identityKeystore.jks -file <root_certificate_CA>.crt -alias DigiCertCARoot
• Import Intermediate Certificates : 
• keytool -import -keystore identityKeystore.jks -file <intermediate_certificate_CA>.crt -alias DigiCertCAInter
• keytool -import -keystore identityKeystore.jks -file <my_company_signedcert.crt/pem> -alias icslientcert
• Use the following command to generate Client or Server certificate using Keystore. 
• keytool -export -alias <aliasName> -storepass <replace_with_strong_password> -keystore identityKeystore.jks -file  icsclient.cer/pem 
• keytool -export -alias <aliasName> -storepass <replace_with_strong_password> -keystore identityKeystore.jks -file  icsclient.cer/pem
• List all the certificates from JKS file. 
• keytool -list -keystore identityKeystore.jks

Python Code : 

headers = {'SOAPAction': '<wsdl_action>', 'Content-Type': 'text/text; charset=utf-8'}

requests.post('https://vijayakumarkv/ics/cloud.org', headers=headers,data=body.encode('utf-8'),cert=('/path/client.cert', '/path/client.key'))

DATABASE - DROP OBJECTS SCRIPT

 BEGIN

for i in (select 'drop ' || object_type || ' SCHEMA_OWNER.' || object_name as stmt

from all_objects

where object_type in ('PACKAGE') and owner = 'SCHEMA_OWNER') loop

execute immediate i.stmt;

end loop;

end;

/

BEGIN

for i in (select 'drop ' || object_type || ' SCHEMA_OWNER.' || object_name || ' Cascade constraints purge' as stmt

from all_objects

where object_type in ('TABLE') and owner = 'SCHEMA_OWNER') loop

execute immediate i.stmt;

end loop;

END;

/

BEGIN

for i in (select 'drop ' || object_type || ' SCHEMA_OWNER.' || object_name || ' force' as stmt

from all_objects

where object_type in ('TYPE') and owner = 'SCHEMA_OWNER' ) loop

execute immediate i.stmt;

end loop;

end;

/

BEGIN

for i in (select 'drop ' || object_type || ' SCHEMA_OWNER.' || object_name  as stmt

from all_objects

where object_type in ('SEQUENCE') and owner = 'SCHEMA_OWNER' ) loop

execute immediate i.stmt;

end loop;

END;

/

ORACLE OIC - OCI Object Storage List and Download Files

We can use the REST adapter to invoke the OCI Object Storage API's to list the files under a given bucket and download the files. 

Following API will provide all the files with a specific prefix. 

/n/{tenancy_name}/b/{bucket_name}/o/

Operation = GET.

Add a request parameter . 

Name = prefix 

Type = string. 

Note:  In the request mapping provide the values for tenancy_name , bucket_name and prefix elements. 

Use the following sample JSON response message to receive and parse the response message. 

Sample Response Message : 

{

  "objects" : [ {

    "name" : "1MB.data"

  } ]

}

If there are files in object storage then response will return an array of file names. Use the loop activity to loop over each file and download the file from Object Storage. 

To download the file use the following rest URI and GET operation. 

/n/{tenancy_name}/b/{bucket_name}/o/{object_name}

While defining response type select Binary value this will auto select media type.  

Use the response and write a file using stage activity.  Use an opaque schema element to write a file. 

While mapping , user the reference element from OCI response and add reference encoding function and map it to write schema element. 

To Upload Files to OS

Context URL to Use : /n/telenet/b/{bucket_name}/o/{object_name}

Operation : PUT

Select Request Parameter and Request Payload option.

Select the request type as BINARY.

curl --verbose -X PUT https://objectstorage.eu-frankfurt-1.oraclecloud.com/n/{tenancy}/b/{bucket_name}/o/{object_name} \

 -H "Authorization: [authorization-value]" \

 -H "Content-Type: application/octet-stream" \

 --data-binary "@file.ext"