Back to blog

Fusion Cloud: Oracle 25B Fusion Changes

Joshua Burton
Blog Enhancement ERP Cloud 25B Updates

Hopefully by now you have heard that Oracle is rolling out a major change to the login process and management thereof for Oracle Cloud. This change is starting will roll out to customers after the 25B quarterly update goes live. Here’s a brief, high-level overview of what this will look like.

What is the change? 

Oracle is merging the Cloud (aka Fusion) sign-in process into its OCI Identity and Access Management solution. This is a good change, and some of the points below show why. 

What does that mean? 

First, this will change how the sign in page for Oracle Cloud looks (assuming you don’t have the chooser page disabled), as the image below shows. Second, this will allow you to have all the extensive functionality of OCI’s IAM Domains directly integrated with your Cloud environment(s). 

  • All external Identity Providers (IDPs) are federated directly with the IAM Domain. 
  • Out-of-box MFA options via IAM Domains 
  • A fully customizable new login experience 
  • Customizable Sign-In Branding 
  • Sign-on and IDP policy support 
  • Adaptive Security and Risk Providers 
  • Network Perimeter/Security 
  • Improved Auditing and Logging Capabilities 
  • And many more features 

When will the change take effect? 

Non-federated   Notification 30-days before upgrade; not in the same month as a quarterly update. 
  1. Verify sign-on works after upgrade.  
  1. No additional action is required. 
Federated SSO   Notification 90-days before upgrade; not in the same month as a quarterly update. 
  1. Required customer actions will be highlighted here. 
  1. Customers must acknowledge completion before Identity Upgrade.  
  1. Verify sign-on works after upgrade and complete post-upgrade steps found here. 

 

How do I know if my environment is “federated”? 

When you sign in to a Fusion Applications environment, if you see the Company’s Single Sign-On button or page, then your environment has federated single sign-on. If you don’t see this, then you aren’t federated. 

  • Upgrade can happen any time after 25B, so it could be between 25B and 25C, 25C and 25D, etc. The process begins after 25B begins going out to customers. 
  • Schedule will also be published in the Oracle Cloud Console. 
  • Identity Upgrade will take up to 3 hours (or longer) of downtime, depending on the number of users. 
  • Lower environments will be converted at the end of the 2nd week of the scheduled month and Production in the 4th week. 
  • URL for Fusion environments does not change. 

How will this change affect me? 

If you are already federated, customers must reestablish the federation as part of the upgrade, according to the steps at the above links.  

SSO configuration will be moving out of the Security Console in Fusion to the OCI Cloud Console. As you can see in the image below, the Single Sign On task is no longer on the left in Security Console to select: 

If you are not federated currently, no additional actions are required. The login page will just look different now. 

No more SSO Bypass for Supplier Portal (or any other external portal), and ALL users log in via Oracle IAM directly. This means that you can require multi-factor authentication for external users and control them using the same controls you use for any native employees in your Identity Provider. 

  • Using MFA is highly recommended and a key control to avoid external users giving unwanted access via things like phishing attacks. 

What is NOT changing: 

There will be no changes to existing provisioning workflows — roles are still handled in Security Console directly in Fusion. 

Continue using all the below as you have previously: 

  • Fusion Applications REST APIs (e.g., employee management) 
  • Fusion Apps pillar UIs (e.g., New Hire, Manage Suppliers) 
  • Bulk loaders (e.g., HDL, CX file loader, FBDI) 

There are no changes to how user attributes (e.g., last name, email) are updated. 

Basic authentication (i.e. the ability to access the system using only a username and password) is NOT going away (yet). 

  • While Oracle has expressed a desire to eliminate Basic Auth in the future, that is not happening at this time. 

What if you need support from Oracle or to ask further questions: 

Oracle Support  

  • Customers can request support using Support Service Request (SR) [see below for details on how to categorize this for best results] 
  • Reach out to your CSMs (Customer Success Manager)  

SR from Oracle Cloud Console – can be used to postpone the upgrade, if valid reason is given. Categorize as below. 

  1. Service Group: Oracle Cloud Applications  
  2. Service: Any Fusion Product  
  3. Service Category: SaaS Console Services(Outage,Provision,P2T/T2T,Resize,Environment and User Management)  
  4. Sub–Category: Fusion Identity Upgrade  

 

Reach out to the product team on Customer Cloud Connect:  

Category: Application Platform, Fusion Applications Administration 

 

Want to talk to us further about this or ask us any questions? 

We would be happy to have a call with you and your team.  Please email us at support@erpra.net.