> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/connector-configuration/oracleebs.md).

# Oracle EBS connector

This page describes how to set up connection to Oracle EBS

The Oracle EBS connector provides the ability to manage users — their info and **responsibilities** — in the **Oracle E-Business Suite** system.

| Operation                                                  | Supported |
| ---------------------------------------------------------- | --------- |
| Create user                                                | ✅         |
| Modify user                                                | ✅         |
| End-date user                                              | ✅         |
| Add responsibility / modify membership / remove membership | ✅         |
| Synchronize users and responsibilities (roles)             | ✅         |
| Test connection                                            | ✅         |

{% hint style="info" %}
**Which Oracle connector do I need?** This page covers **Oracle E-Business Suite** application users. For **Oracle database accounts**, see the [Oracle RDBMS connector](/connector-configuration/oracle.md); for **Oracle Identity Cloud Service**, see the [Oracle IDCS connector](/connector-configuration/oracle-idcs.md).
{% endhint %}

## Use cases

* Managing **EBS application users and their responsibilities** from OpenIAM.
* **Importing EBS responsibilities** into OpenIAM via role synchronization, for use in the catalog and access review.
* Driving EBS access from OpenIAM roles/entitlements.

## Versions and compatibility

The end application is **Oracle E-Business Suite**, reached over a JDBC connection to the EBS database rather than over HTTP. The connector does not write EBS tables directly: it calls Oracle's own supported PL/SQL package, which is what keeps the records consistent with what EBS expects.

<table><thead><tr><th width="164">Property</th><th>Value</th></tr></thead><tbody><tr><td><strong>Platform</strong></td><td>Oracle E-Business Suite</td></tr><tr><td><strong>Interface</strong></td><td>JDBC to the EBS database</td></tr><tr><td><strong>API used</strong></td><td><code>apps.fnd_user_access_api_pkg</code>, EBS's own user and responsibility API</td></tr><tr><td><strong>Object types</strong></td><td><code>FND_USER_OBJ</code>, <code>FND_RESP_OBJ</code>, <code>FND_TAB_USER</code>, <code>FND_TAB_RESP</code></td></tr></tbody></table>

{% hint style="info" %}
Because provisioning goes through `fnd_user_access_api_pkg` rather than through `INSERT` and `UPDATE`, the database account the connector uses needs execute permission on that package — table privileges alone are not enough, and granting them instead will not make it work.
{% endhint %}

## Prerequisites

The EBS-side setup below must be completed by an EBS administrator/DBA:

{% stepper %}
{% step %}
**Create an APPS connect user in EBS.**

* Navigate to **System Administrator → Security → User → Define**.
* Create a user and assign "System Administrator".
* Navigate to Roles & Responsibility Management and assign the `UMX|APPS_SCHEMA_CONNECT` role to this user.
* Run the Workflow Background Process to reflect the new roles (reset the user password with a first-time login).
* Provide the created user ID & password to OpenIAM for the connection.
  {% endstep %}

{% step %}
**Register the external server as a node in EBS.**

* Download the EBS SDK for Java from Patch 13882058 and use `fndext.jar` to generate a Desktop DBC file with the command below.
* To register the external server with the Oracle E-Business Suite instance, the system administrator should run the following, passing the name of the external application server node:

```
java oracle.apps.fnd.security.AdminDesktop <apps user>/<apps pwd> \
CREATE \
NODE_NAME=<node name of the external application server> \
[IP_ADDRESS=<IP address of external application server>] \
DBC=<full name and path of existing standard dbc_file>
```

* Run CREATE only once per node; if the node is already registered, use UPDATE instead.
* The standard DBC file should be present in the `$FND_SECURE` directory (generate with auto-config if missing).
* Provide the resulting Desktop DBC file to OpenIAM for the connection.
  {% endstep %}

{% step %}
**Set the following profile options in the application.**

<table><thead><tr><th width="225">Profile option name</th><th>Profile option code and recommended setting</th></tr></thead><tbody><tr><td>FND: Validate User Type</td><td>FND_SERVER_SEC - Desktop Only (internal value D) at the site level</td></tr><tr><td>FND: Validate IP address</td><td>FND_SERVER_IP_SEC - Desktop Only (internal value D) at the site level</td></tr><tr><td>FND: Desktop Nodes allowed</td><td>FND_SERVER_DESKTOP_USER - . For example: NODENAME1, NODENAME2, where these are values of NODE_NAME in the <code>fnd_nodes</code> table. Set at the user level for the user with the Apps Schema Connect role (the AppsDataSource user).</td></tr></tbody></table>
{% endstep %}

{% step %}
**Compile database objects.** From the SYSDBA user:

* `xxfnd_grant_apps_to_iam.sql`

From the xx\_iam user:

* `xxfnd_db_object.sql`
* `xxfnd_log_trg_who.sql`
* `xx_iam_fnd_responsibility.ddl`

From the apps user:

* `xxfnd_resp_view.sql`
* `xxfnd_user_access_api_pkg.pkh`
* `xxfnd_user_access_api_pkg.pkb`
  {% endstep %}
  {% endstepper %}

## Installing the connector

In an RPM installation, use the general startup script to start the connector. See [Connectors via RPM](/installation/rpm/rpm-single-node/add-a-connector.md) for deploying on a separate host.

## Starting, stopping, and restarting

<table><thead><tr><th width="168">Deployment</th><th>Commands</th></tr></thead><tbody><tr><td>RPM (systemd)</td><td><code>systemctl start|stop|restart openiam-connector@oracleebs-connector-rabbitmq</code></td></tr><tr><td>Kubernetes</td><td><code>kubectl rollout restart</code> the connector deployment.</td></tr></tbody></table>

## Command-line parameters and properties

The connector is a Spring Boot application. Its defaults ship inside the jar, and you override them in either of two places:

* **An external property file**, read at `${confpath}/conf/properties/oracle-ebs-connector-rabbitmq.properties`. The file is optional, and `confpath` is itself a system property, set with `-Dconfpath=/data/openiam/`.
* **Directly on the command line**, as `-D` arguments, which win over the file.

{% code overflow="wrap" %}

```bash
java -Dconfpath=/data/openiam/ -Dlogging.level.root=INFO -Dorg.openiam.connector.queue=Oracle_EBS_Connector_1_Request -jar oracle-ebs-connector-rabbitmq.jar
```

{% endcode %}

| Property                                  | Default               | Purpose                                                       |
| ----------------------------------------- | --------------------- | ------------------------------------------------------------- |
| `oracle.ebs.property.date.format`         | `HH:mm:ss MM/dd/yyyy` | Date format used for EBS start and end dates                  |
| `org.openiam.health.check.sweeptime`      | `30000`               | How often, in milliseconds, the connector reports its health  |
| `management.health.elasticsearch.enabled` | `false`               | Left disabled — the connector has no Elasticsearch dependency |
| `management.health.redis.enabled`         | `false`               | Left disabled — the connector has no Redis dependency         |

The connection details themselves are **not** set here — they are managed system parameters, covered under [Configuring the managed system](#configuring-the-managed-system).

## Verifying the connector is running

{% stepper %}
{% step %}
In the Webconsole, open the managed system — the **Running connector status** indicator must be green.
{% endstep %}

{% step %}
Click **Test Connection** — it must return success.
{% endstep %}

{% step %}
Run the role sync with `*` and confirm responsibilities arrive in OpenIAM.
{% endstep %}
{% endstepper %}

## Troubleshooting

Connector troubleshooting can be done by raising the logging level to DEBUG mode: `-Dlogging.level.org.openiam=DEBUG`.

| Symptom                                                               | Likely cause                                                         | Resolution                                                                                                                                 |
| --------------------------------------------------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Connection fails                                                      | Wrong DBC file path, node not registered, or profile options not set | Re-verify Prerequisites steps 2–3; the Host URL must be the full DBC file path.                                                            |
| Access API errors                                                     | Database objects not compiled                                        | Compile the objects from Prerequisites step 4 under the correct users.                                                                     |
| Sync returns nothing                                                  | Filter syntax                                                        | Start with `*`, then apply the listed filters.                                                                                             |
| Suspend, resume or password reset reports success but nothing changes | Those operations are stubs                                           | Suspend, resume, password reset and group create/delete each return `SUCCESS` without calling E-Business Suite. Create and update do work. |

See also: [general connector troubleshooting](/connector-configuration/4-troubleshootingconnector.md) and the [connector error-code reference](/connector-configuration/4-troubleshootingconnector.md#connector-error-codes).

## Registering the connector in OpenIAM

Register the connector under **Provisioning → Connectors** and attach it to the managed system — see [Registering the connector](/administration-guide/lifecycle/connectors-and-managed-systems.md).

## Configuring the managed system

During managed-system configuration, provide:

<table><thead><tr><th width="136">Field</th><th>Value</th></tr></thead><tbody><tr><td><strong>Login</strong></td><td>The EBS service account username (from Prerequisites step 1).</td></tr><tr><td><strong>Password</strong></td><td>The service account password.</td></tr><tr><td><strong>Host URL</strong></td><td>The <strong>full path to the DBC file</strong> (from Prerequisites step 2).</td></tr></tbody></table>

## Attribute mapping and policy map

The out-of-the-box Oracle EBS managed system provides rules for writing to the following user fields:

* `userName`
* `description`
* `emailAddress`
* `employeeId`
* `endDate`
* `memberOf`
* `startDate`
* `unencryptedPassword`

## Reconciliation and synchronization

OpenIAM provides out-of-the-box **user sync** and **role sync** configurations for Oracle EBS.

* Example user search query: `*` to grab all users; other filters: `userName` / `effectiveDate` / `userId` / `employeeId` / `lastUpdateDate`.
* Example role search query: `*` to grab all roles; other filters: `responsibilityName` / `applicationId` / `menuId` / `effectiveDate` / `lastUpdateDate` / `managedSys` / `sourceTrack` / `status`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/connector-configuration/oracleebs.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.