diegoecab/oci-deal-accelerator
1
1
Fork 2
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b30a4f0d329ccdfb0b6e7fdd92c81e39989512ba
oci-deal-accelerator/kb/diagram/assets/archcenter-refs/sso-between-process-fusion-applications/_description.md
root b30a4f0d32 Diagram generation: ref-arch-driven procedure + spec validator + KB enrichment 
The diagram path now follows a documented standard procedure (lookup
the closest Oracle Architecture Center reference → confirm components
→ author absolute_layout → spec validator → render → visually verify)
and ships persistent guardrails so layout regressions can't recur.

Persistent procedure changes (apply to all users, all sessions):
- tools/diagram_spec_validator.py — geometry checks (CONTAINER_TOO_THIN,
  CONTAINER_PADDING_VIOLATION, LABEL_OVERFLOW_PARENT) run BEFORE either
  renderer (drawio + PPTX). Catches the subnet-collapse / label-overflow
  bugs that the post-render drawio validator missed.
- tools/oci_diagram_gen.py + tools/oci_pptx_diagram_gen.py — call the
  spec validator before emitting any output. Adds mysql / mysql_heatwave
  type aliases.
- tools/archcenter_pattern_lookup.py — scores against cached page
  descriptions (not just the 1-line summary), supports --queries for
  multi-fragment composition, and applies synonym expansion via
  kb/architecture-center/synonyms.yaml so "LB HA cross AD" matches
  "load balancer high availability availability domain".
- kb/architecture-center/synonyms.yaml — canonical synonym table
  (load balancer, autonomous database, data guard, …) used by the
  lookup scorer.

KB enrichment:
- tools/archcenter_description_fetcher.py + 121 cached _description.md
  under kb/diagram/assets/archcenter-refs/<slug>/. Removes the runtime
  dependency on docs.oracle.com when authoring specs and feeds the
  pattern-lookup scorer.
- 110+ cached .drawio / .svg / .png references for offline reuse,
  plus the OCI Toolkit v24.2 import (kb/diagram/assets/oci-toolkit-drawio).

Documentation:
- docs/skill/output-formats.md — new "Standard diagram-generation
  procedure (MANDATORY)" + geometry rules + the new validator entry.
- SKILL.md option 2 — references the mandatory procedure.
- README.md — describes the spec validator, archcenter_pattern_lookup
  and description fetcher, and updates the KB-health table.

Tooling that backs the procedure (cumulative across recent sessions):
tools/archcenter_case_runner.py, archcenter_batch_driver.py,
archcenter_zip_downloader.py, drawio_visual_validator.py,
drawio_fidelity_eval.py, harvest_drawio_icon.py, import_oci_library.py,
oci_pptx_diagram_gen.py, oci_pptx_render.py, refresh_pptx_icon_index.py.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-25 21:15:21 -03:00

5.6 KiB
Raw Blame History

Configure single sign-on between Oracle Integration and Oracle Fusion Applications

Summary (catalog)

SSO configuration between OIC and Fusion Applications. SAML-based federation for seamless user experience across integration and application platforms.

Architecture (fetched from source)

Architecture

SSO federation enables you to choose the most suitable approach for your enterprise architecture and identity management needs from the available approaches. You can configure SSO between Oracle Fusion Applications , Oracle Integration , Microsoft Active Directory Federation Service , and other OCI services like OCI Object Storage .

SSO with Oracle Fusion Cloud Applications identity domain

The Fusion Applications identity domain can deploy extensions and integrations, including provisioning Oracle Integration within the same domain. This approach eliminates the need to create additional OCI IAM identity domains, and helps you reduce both licensing costs and administrative overhead. Since the Oracle Fusion Applications identity domain is an Oracle App, extension use cases are supported without incurring extra costs, which minimizes operational and governance overhead. This involves provisioning Oracle Integration within the Oracle Fusion Applications identity domain.

The following diagram illustrates this authentication flow:

Description of the illustration sso-fusion-apps-idm.png

SSO with Oracle Fusion Applications identity domain and an external identity provider

If you already use an external identity provider (such as, Microsoft Entra ID or Okta) for your applications you can extend it as the identity provider for Oracle Fusion Applications and Oracle Integration . This approach centralizes user and access management, and also reduces duplication and administrative effort. You configure SSO with Oracle Fusion Applications identity domain as the service provider and your external identity provider. Oracle Integration is provisioned with Oracle Fusion Applications identity domain.

The following diagram illustrates this authentication flow:

Description of the illustration sso-fusion-apps-idm-external-idp.png

SSO between Oracle Fusion Applications identity domain, an OCI IAM identity domain, and an external identity provider

The Oracle Fusion Applications identity domain can act as the identity store for managing users and groups specific to Oracle Fusion Applications and Oracle Integration . At the same time, a separate OCI identity domain can function as a centralized identity store to manage users and groups that require controlled access to OCI services such as OCI Object Storage , OCI Logging , and OCI Functions .

The following diagram illustrates this authentication flow:

Description of the illustration sso-fusion-apps-idm-oci.png

Considerations for Oracle Fusion Cloud Applications

All Fusion Applications environments are provisioned with an OCI Identity and Access Management identity domain.

This identity domain is pre-integrated with Fusion Applications internal identity system and acts as the identity backbone for tools like Oracle Visual Builder Studio . Users created in Fusion Applications are automatically synchronized with this domain.

By default, federated SSO is configured, with Fusion Applications serving as the identity provider (IdP) and the Fusion Applications identity domain as the service provider.

Oracle Fusion Cloud Applications Identity Domain and Identity Upgrade

Oracle Fusion Cloud Applications are upgrading their user identity service to Oracle Cloud Infrastructure Identity and Access Management , with this transition being rolled out to existing Oracle customers over the coming quarters.

The new Oracle Fusion Cloud Applications identity domain in OCI will provide enhanced capabilities for authentication, sign-on policies, SSO, multifactor authentication, and identity lifecycle management. This upgrade designates the Oracle Fusion Cloud Applications identity domain as the identity provider for Oracle Fusion Cloud Applications .

For more information, see Identity Upgrade Overview in the Explore More section.

About Required Services, Products, and Roles

This solution requires the following services, products, and roles:

Oracle Fusion Cloud Applications

  • Oracle Integration

  • Oracle Cloud Infrastructure Identity and Access Management

These are the roles needed for each service.

Service Name: Role Required to...

Oracle Fusion Applications : Application Administrator

Configure and test federated SSO configuration for Oracle Fusion Applications .

Oracle Integration : Service Administrator

Configure and test federated SSO configuration for Oracle Integration .

Identity Domain Administrator

  • Configure SSO between Oracle Fusion Applications identity domain and Microsoft Entra ID .

  • Configure SSO between Oracle Cloud Infrastructure Identity and Access Management and Microsoft Entra ID .

See Oracle Products, Solutions, and Services to get what you need.

Title and Copyright Information

Configure single sign-on between Oracle Integration and Oracle Fusion Applications

F17402-02

August 2025

Copyright © 2019,2025,

Oracle and/or its affiliates.

Reference in New Issue View Git Blame Copy Permalink