Enable Okta SSO and MFA to Oracle Hyperion via Datawiza

Overview

This tutorial shows how to enable Okta Single Sign-On (SSO) and Okta Multi-Factor Authentication (MFA) for an Oracle Hyperion application using Datawiza Access Proxy (DAP).

Benefits of integrating applications with Okta using DAP include:

• Proactive security with Zero Trust through Okta SSO.
• Easy authentication and authorization in Okta with no-code Datawiza. Use of web applications such as: Oracle JDE, Oracle E-Business Suite, Oracle Sibel, Oracle Peoplesoft, Oracle Hyperion, and home-grown apps.
• Use the Datawiza Cloud Management Console to manage access to applications in public clouds and on-premises.

Background

This document focuses on Oracle Hyperion application integration using HTTP authorization headers to manage access to protected content.

For legacy applications, due to the absence of modern protocol support, a direct integration with Okta SSO is difficult. Datawiza Access Proxy bridges the gap between the legacy application and the modern ID control plane, through protocol transitioning. DAP lowers integration overhead, saves engineering time, and improves application security.

Architecture

The solution has the following components:

• Okta : The Okta cloud-based identity and access management service, which helps users sign in and access external and internal resources.
• Datawiza Access Proxy (DAP): A lightweight container-based reverse-proxy that implements OpenID Connect (OIDC), OAuth, or Security Assertion Markup Language (SAML) for user sign-in flow. It transparently passes identity to applications through HTTP headers.
• Datawiza Cloud Management Console (DCMC): A centralized console to manage DAP. DCMC has UI and RESTful APIs for administrators to configure Datawiza Access Proxy and access control policies.
• Oracle Hyperion application : Legacy application going to be protected by Okta and DAP.

Prerequisites

Ensure the following prerequisites are met:

• An Okta subscription. If you don't have one, you can get an Okta free account.
• Install Docker and Docker Compose.
• An account with Okta and the Application administrator role.
  • See, Standard administrator roles and permissions.
• An Oracle Hyperion environment. Supported versions include: v11.2.8.0 or later.
• (Optional) An SSL web certificate to publish services over HTTPS. You can also use default Datawiza self-signed certs for testing.

Getting started with DAP

To integrate Oracle Hyperion with the Okta:

1. Sign in to Datawiza Cloud Management Console.

2. The Welcome page appears.

3. Select the orange Getting started button.

4. In the Name and Description fields, enter the relevant information.

5. Select Next.

6. On the Add Application dialog, use the following values:

   Property	Value
   App Type	Web
   Name	Enter a unique application name.
   Application URL	For example: https://hyperion-external.example.com. For testing, you can use localhost DNS. If you aren't deploying DAP behind a load balancer, use the Public Domain with the port.
   Listen Port	The port that DAP listens on.
   Upstream Servers	The Oracle Hyperion implementation URL and port to be protected.

7. Select Next.

8. On the Configure IdP dialog, enter the relevant information.

9. Input the IdP name. Select OIDC as Protocol and Okta as Identity Provider. Populate the fields of the form with the keys/values obtained from IdP Configuration Guide: Okta.

10. Select Create.

11. The DAP deployment page appears.

12. Make a note of the deployment Docker Compose file. The file includes the DAP image, also the Provisioning Key and Secret, which pulls the latest configuration and policies from DCMC.

SSO and HTTP headers

The DAP gets user attributes from IdP and passes them to the upstream application via header or cookie.

For the Oracle Hyperion application to recognize the user correctly, there's another configuration step. Using a certain name, it instructs DAP to pass the values from the IdP to the application through the HTTP header.

Such configuration will be done in the Applications tab on the left panel and go to Attribute Pass sub-tab. For Oracle Hyperion, please refer to the screenshot below to configure the attribute pass:

Property	Value
Field	Username
Expected	HYPLOGIN
Type	Header

Info

This configuration uses the Okta name as the sign in username used by Oracle Hyperion. Please make sure that the name is as same as the name in Hyperion user directories. To use another user identity, go to the Mappings tab.

SSL Configuration

1. Select the Advanced tab.

2. Select Enable SSL.

3. From the Cert Type dropdown, select a type.

4. For testing purposes, we'll be providing a self-signed certificate.

   Info

   You have the option to upload a certificate from a file.

5. Click Save.

Login and Logout Redirect URI

1. Click Advanced Options.
2. Input /workspace/index.jsp in both Login Redirect URI and Logout Redirect URI
3. Click Save.

(Optional) Enable Okta Multi-Factor Authentication

To provide an extra level of security for sign-ins, enforce multifactor authentication (MFA) for user sign-in. One way to achieve this is to Enable MFA on the Okta portal.

Enable SSO in the Oracle Hyperion Console

To enable SSO in the Oracle Hyperion environment:

1. Log into to Hyperion Shared Service Console http://{your-hyperion-fqdn}:19000/workspace/index.jsp as a System Administrator.

Enable SSO

1. Select Navigate, and then Shared Services Console.
2. Select Adminstration, and then Configure User Directories.
3. Click Security Options.
4. In the Single Sign-On Configuration section:
   1. Select the Enable SSO check box.
   2. From SSO Provider or Security Agent drop-down list, select Other.
   3. From SSO Mechanism drop-down list, select Custom HTTP Header and then specify the name of the header that the security agent passes to EPM System, which is HYPLOGIN.
5. Click OK.

Update Post Logoff URL setting in EPM Workspace

1. Select Navigate, then Workspace Settings, and then Server Settings.
2. In Workspace Server Settings, change POST Logoff URL to the URL of the web page that you want users to see when they log out of EPM System, which is /datawiza/ab-logout.
3. Click OK.

Test an Oracle Hyperion application

To confirm Oracle Hyperion application access occurs correctly, a prompt appears to use an IdP account for sign-in. Credentials are checked and the Oracle Hyerion appears.

Note

To improve security, organizations using this model may also consider blocking all direct access to the application, thus forcing the use of a strict path through the Datawiza Access Proxy.