Shibboleth SSO and MFA for Oracle EBS: The Higher Education Playbook
Table of contents
If your institution runs Oracle E-Business Suite, you know the mismatch: the campus standardized on Shibboleth years ago, with InCommon federation, eduPerson attributes, and single sign-on across academic services, while EBS often still depends on FND_USER local passwords. Faculty with finance roles, procurement teams, and students-turned-staff may end up with one more password, and the audit findings about MFA on the financial system land on IT's desk every cycle.
The fix does not require touching EBS or adopting Oracle's identity stack. Datawiza Access Proxy sits in front of the EBS web tier as the SAML service provider. Users are redirected to your Shibboleth IdP, authenticate with campus credentials, and complete the MFA your campus already enforces, often Duo behind Shibboleth. On success, Datawiza uses the configured EBS service-account and DBC-file flow to establish the user's ICX session as their mapped FND_USER, with their normal responsibilities. Step-by-step configuration is available in the Datawiza docs.
What This Looks Like in Practice
- Campus login for EBS. The same Shibboleth session that opens academic and administrative services can open Oracle EBS, instead of forcing one more portal password.
- MFA inherited from the campus stack. Whatever your Shibboleth deployment enforces, commonly Duo, now covers EBS. That helps with cyber insurance MFA requirements and access reviews around financial systems.
- Attribute mapping handled at the proxy. Shibboleth may assert eduPerson-style identifiers, while EBS expects an FND_USER username. The proxy maps between them.
- Nothing installed on EBS. No OAM, no OID, no EBS Asserter WebLogic app, and no app-tier plugin to retest during EBS patch cycles.
- External populations too. iSupplier and other external-facing modules can use built-in MFA with no IdP for users who are not in the campus directory.
Implementation Outline
- Register Datawiza as a SAML service provider with your Shibboleth IdP. InCommon-federated IdPs work through the same SAML 2.0 metadata pattern.
Create the EBS service account and map the Shibboleth attribute to the EBS FND_USER username. Follow the Shibboleth SSO for EBS best-practice guide for the exact configuration flow.
- Deploy Datawiza Access Proxy, SaaS or self-hosted, with the EBS web entry point as the upstream application.
- Lock the trust boundary so users reach EBS through the proxy. For internet-facing EBS modules, this reduces direct unauthenticated exposure as well as enabling SSO.
- Pilot with one department, validate FND_USER mapping and responsibilities, then expand.
Frequently Asked Questions
Does Oracle EBS support Shibboleth natively?
No. Oracle EBS has no native SAML support. Shibboleth SSO requires a component that performs the SAML exchange and establishes the EBS session. Datawiza Access Proxy does this without Oracle identity middleware or EBS code changes.
Do we need OAM or the EBS Asserter for campus SSO?
No. Datawiza acts as the SAML service provider toward Shibboleth and creates the user's ICX session through the configured EBS service-account and DBC-file flow. You do not need OAM, OID, OCI IAM, or an EBS Asserter WebLogic application.
Can Shibboleth MFA protect Oracle EBS?
Yes. MFA is enforced wherever your Shibboleth deployment enforces it. For many campuses that means Duo or another campus MFA policy during the SAML login flow before the user reaches EBS.
Does this work with InCommon federation?
Yes. Datawiza is configured as a SAML 2.0 service provider, so your IdP can treat it like other federated campus services.
What about EBS users who are not in the campus IdP?
External populations such as suppliers, contractors, and vendors can be protected with Datawiza built-in MFA. Existing EBS logins can remain in place, with an MFA challenge before application access continues.
Bottom Line
The campus already solved identity; EBS just never joined. A proxy that speaks SAML to Shibboleth and ICX to EBS connects the two without a new Oracle identity project. Book a demo and bring your Shibboleth metadata and EBS release; we can walk through the exact flow.
