Business / Technical Brief
Access PaaS data from a cloud
application using web services
From your Oracle Fusion Applications Cloud
Service application, secure REST or SOAP API calls
to your Oracle PaaS web services with OAuth by
using Oracle Identity Cloud Service
Copyright ©
Public
,
Oracle and/or its affiliates
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public
Purpose statement
This document presents content originally published on the Oracle Architecture Center. It is
reproduced here for customers that implemented the patterns described in the solution
playbook, for the purpose of maintaining their deployments. These procedures are no
longer considered best practices by Oracle, and should not be followed for configuring new
deployments.
Disclaimer
This document in any form, software or printed matter, contains proprietary information
that is the exclusive property of Oracle. Your access to and use of this confidential material is
subject to the terms and conditions of your Oracle software license and service agreement,
which has been executed and with which you agree to comply. This document and
information contained herein may not be disclosed, copied, reproduced or distributed to
anyone outside Oracle without prior written consent of Oracle. This document is not part of
your license agreement nor can it be incorporated into any contractual agreement with
Oracle or its subsidiaries or affiliates.
This document is for informational purposes only and is intended solely to assist you in
planning for the implementation and upgrade of the product features described. It is not a
commitment to deliver any material, code, or functionality, and should not be relied upon in
making purchasing decisions. The development, release, and timing of any features or
functionality described in this document remains at the sole discretion of Oracle. Due to the
nature of the product architecture, it may not be possible to safely include all features
described in this document without risking significant destabilization of the code.
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public
Table of contents
Purpose statement
Disclaimer
Learn About Accessing PaaS Data from a Cloud Application Using Web
Services
Architecture
Considerations for Configuring the Web Service Integration
Before You Begin
Configure Your Integration for Web Services Invocation
Create a New Application in Oracle Identity Cloud Service
Grant WSIdentityPermission for the Target Web Service Application
Invoke Web Services from Oracle Fusion Applications Cloud Service
Invoke a RESTful Web Service
Invoke a SOAP Web Service
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public
Learn About Accessing PaaS Data from a Cloud Application Using Web
Services
You may have a requirement to access data exposed by web services on an Oracle PaaS
application from your Oracle Fusion Applications Cloud Service user interface. You can make
REST or SOAP API calls from Oracle Fusion Applications Cloud Service to an Oracle PaaS API,
such as a custom web service running on Oracle Java Cloud Service, secured with OAuth by
the Oracle Identity Cloud Service instance of your Oracle PaaS account.
Architecture
This architecture shows how a REST or SOAP web service call from Oracle Fusion
Applications Cloud Service can be securely passed to an API running on a federated Oracle
PaaS instance.
When your Oracle Fusion Applications Cloud Service is federated with Oracle Identity Cloud
Service, you can, with some configuration, secure a web services call by using OWSM OAuth
policies.
Web service calls and responses are made from Oracle PaaS services, handled by Oracle Identity Cloud Service
OAuth, into the internal identity management component of Oracle Fusion-based cloud services.
This architecture supports the following components:

One Oracle Fusion Applications Cloud Service instance

One Oracle Cloud account, consisting of an Oracle Identity Cloud Service and one or
more Oracle PaaS services
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public
Get Started
Your Oracle Fusion Applications Cloud Service needs to be federated with Oracle Identity
Cloud Service, with OAuth trust and user and role synchronization configured. Either Oracle
Fusion Applications Cloud Service or Oracle Identity Cloud Service can be configured as the
identity provider (IDP), with the other component acting as a service provider (SP).
Considerations for Configuring the Web Service Integration
You will need to consider the following important requirements and options, in order to
decide whether and how to set up your services for web services calls.
This solution requires that your Oracle Fusion Applications Cloud Service instance is already
federated with an Oracle Identity Cloud Service instance in an Oracle Cloud account.
Some Oracle PaaS services expose web services, which you can access using the
configuration described in this solution. Or, you could develop and deploy your own custom
REST or SOAP web service running on an Oracle PaaS service such as Oracle Java Cloud
Service.
When developing and deploying your own RESTful web service on Oracle Java Cloud
Service, keep these restrictions in mind:

In Oracle Fusion Applications Cloud Service, Application Composer consumes only
JSON or XML MediaType Responses, so use
the application/json or application/xml media type in your REST service.

Deploy your application to Oracle Java Cloud Service using an unprotected app for
root context. That is, do not prefix the root context with the __protected prefix.
Similarly, when developing and deploying your own SOAP web service on Oracle Java Cloud
Service keep the WSDL unprotected.
As part of the configuration for accessing web services on your Oracle PaaS service, you will
need to create a new trusted client app in your Oracle Identity Cloud Service, as described in
this solution. When deployed in your Oracle Cloud account, PaaS services like Oracle Java
Cloud Service are already configured with Oracle Identity Cloud Service, including an
application in Oracle Identity Cloud Service for OAuth trust and scope. That app has a client
and resource, but the client is for Oracle Java Cloud Service only, so it can't be used
by Oracle Fusion Applications Cloud Service.
Consequently, you need a new OAuth client application for Oracle Fusion Applications Cloud
Service, with the scope set to the Oracle PaaS service's web service endpoints. This will be a
client app only, and there we will select the scopes.
Oracle Fusion Applications Cloud Service now provides a Switch Identity feature in
Application Composer, which allows you to switch the precedence of user IDs to be used
when requesting a token from Oracle Identity Cloud Service. That is, you can configure your
web service call to use either the logged in user's ID, or, a different user ID specified in the
credential key. In Application Composer:

Subject Precedence check box: When checked, the logged in user's ID will be used
to create the JWT token. When not checked, the user ID specified in the Credential
Key will be used to create the JWT token. If no value is set for Credential Key, then
the Client Credential Key is used.
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public

Credential key: Specifies a name for the secret key that is used to access the web
service. This key is used when Subject Precedence is not checked. This key name
along with the username and password is stored in the credential store.
You should consider whether you want to use a single user ID for all web service calls from a
given page, or if you want to use the logged-in user's ID. This in turn affects which users you
will need to synchronize with your Oracle PaaS identity management. The user ID used to
request a token needs to exist, and have appropriate privileges, on the Oracle Identity Cloud
Service instance.
About Required Services and Roles
This solution requires the following services and roles:

Oracle Fusion Applications Cloud Service: For example, Oracle Engagement
Cloud, Oracle Global Human Resources Cloud, or Oracle Enterprise Resource
Planning Cloud.

Oracle PaaS services: For example, Oracle Java Cloud Service, Oracle Visual
Builder, or Oracle SOA Cloud Service.

Oracle Identity Cloud Service: The identity management service included with
your Oracle Cloud account.
These are the roles needed for each service.
SERVICE NAME: ROLE
REQUIRED TO...
Oracle Fusion Applications Cloud
Create a sandbox, and customize the visibility of user
Service: Application Implementation Consultant
interface components.
Oracle Identity Cloud Service: Identity Domain
Configure the trusted client application in Oracle Identity
Administrator
Cloud Service
Oracle PaaS: service administrator. For example,
Create or deploy REST or SOAP APIs, administer load
for Oracle Java Cloud Service: Java administrator.
balancers, and monitor and manage service usage. You
You may also need WebLogic Administrator.
may also need to access and use the WebLogic Server
Administration Console, configure identity providers, and
deploy and undeploy applications.
See Learn how to get Oracle Cloud services for Oracle Solutions to get the cloud services you
need.
Before You Begin
Before you begin accessing PaaS data from a cloud application using web services:

Learn about the federated single sign-on options for Oracle Cloud services

You must set up the required federation, OAuth-based trust, and user and role
synchronization by following the steps in the Integrate solution Integrate an Oracle
SaaS application with Oracle PaaS.
You should also be familiar with the use of OWSM policies, as described in Securing Web
Services and Managing Policies with Oracle Web Services Manager.
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public
Configure Your Integration for Web Services Invocation
First, add a new trusted client application and configure it to handle the web service calls
between Oracle Fusion Applications Cloud Service and your PaaS services. Then, if you are
hosting your own web service on Oracle Java Cloud Service, configure the
WSIdentityPermission for your deployed application.
Create a New Application in Oracle Identity Cloud Service
Create a new trusted client application in Oracle Identity Cloud Service to handle your web
service calls to your Oracle PaaS services.
To create and configure the client application:
.
In the Oracle Identity Cloud Service console, select the Application tab, click Add,
and then in the Add Application window, select Confidential Application.
.
On the Details page of the Add Trusted Application wizard, give the new application
a name. If you want, set other values such as description and tags. Click Next.
.
On the Client page, select Configure this application as a client now.
Additional options appear on the page. Set the following values:
.

Allowed Grant Types: Client Credentials and JWT Assertion.

Client Type: Select the Trusted option, and import the Oracle Fusion
Applications Cloud Service OWSM signed certificate you received from
Oracle Support when you set up federation.
Click Next, and on the Authorization page, click Finish to save the application.
An “Application Added” notification is shown. Make a copy of the Client ID and
Client Secret. If you need them later, the Client ID and Client Secret also appear on
the Configuration tab in the Details section for the application.
.
With the app created and saved, select the Configuration tab, and expand
the Client Configuration section. In the Accessing APIs from Other
Applications section, under Allowed Scopes, click Add. In the Add Scope dialog, add
one or more Resources for each of your Oracle PaaS applications that you will
access. You can check the box for a resource to add all of its scopes, or click the
right arrow for a given resource to select individual scopes. You can check the box
for the whole app to add all resources. Click the Add button. Click Save to save your
changes.
As you add scopes, they are listed by application and allowed scope in the Allowed
Scopes area. You can select a scope in this area and click the Remove button to
remove it.
.
Click Next, and on the Authorization page, click Finish to save the changes to the
application.
.
To activate the application, from the Oracle Identity Cloud Service console,
select Applications, and select the application. Click the Activate button to the right
of the application name.
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public
Configure
Grant WSIdentityPermission for the Target Web Service Application
You may be connecting to a custom web service hosted on Oracle Java Cloud Service. If so,
the web service application to which the OWSM policy is attached must have
the oracle.wsm.security.WSIdentityPermission permission enabled.
.
Using an API such as Oracle JDeveloper, develop your REST or SOAP web service
for deployment on Oracle Java Cloud Service.
For REST services:
o
Protect the service by using the OAuth Server Policy.
o
Deploy your application to Oracle Java Cloud Service using an unprotected
app for root context. That is, do not prefix the root context with
the __protected prefix.
o
The Application Composer on Oracle Fusion Applications Cloud
Service consumes only JSON or XML MediaType Response, so
use application/json or application/xml mediatype in your service.
For SOAP services:
.
o
Protect the service by using the OAuth Server Policy.
o
Keep the WSDL unprotected.
Grant the WSIdentityPermission for applications deployed on Oracle Java Cloud
Service. Execute the following WSLT commands by connecting to the Oracle Java
Cloud Service AdminServer. Use the application name of your deployed application
for the resource:
grantPermission(codeBaseURL='file:${common.components.home}/modules/oracle.
wsm.common/wsm-agent-core.jar',
permClass='oracle.wsm.security.WSIdentityPermission',
permTarget='resource=your application name',
permActions='assert')
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public
Invoke Web Services from Oracle Fusion Applications Cloud Service
With the configuration complete, you can invoke a web service from an Oracle Fusion
Applications Cloud Service application page.
For example, in Oracle Engagement Cloud, you can use Application Composer to invoke a
RESTful or SOAP web service.
Invoke a RESTful Web Service
To invoke a RESTful web service using Application Composer:
.
Log in to Oracle Fusion Applications Cloud Service with a user that exists and is
configured for SSO on both Oracle Fusion Applications Cloud Service and your
Oracle PaaS cloud account.
.
Create a new sandbox or navigate to an existing sandbox.
.
In the Navigator, select Config, Application Composer, and then Web Services,
and create a Web Service with the REST option.
.
Enter a Name and provide the REST endpoint URL of the application.
.
Select the Authentication Scheme Call using IDCS OAUTH.
.
In the fields under Call using IDCS OAUTH, enter the Oracle Identity Cloud
Service client key and secret as the Client Credential Key, enter the Credential
Key if needed, enter the Token URI, and enter the scope for the REST application as
the Scope, for example the external scope for a custom Oracle Java Cloud
Service application. This is the value you used in the client application as AllowedScope.
The Credential Key corresponds to the secret key (user name and credentials) of
the user to be used when Subject Precedence is not checked. This key name along
with the username and password is stored in the credential store and corresponds
to the csf-key property.
The user ID used to request a token needs to exist, and have appropriate privileges,
on the Oracle Identity Cloud Service instance.
.
Select the Subject Precedence check box to use the logged-in user as the subject,
or, leave the check-box empty to use a user ID specified in the credential key as the
subject.
.
In the Select and configure Methods against the Resource section, select
the Method Name and Format (JSON or XML) appropriate for your web service
calls, and set Request Payload and Response Payload as needed. If you set them
to Code Sample, provide sample JSON or XML request and response payloads.
.
Customize your UI by using Standard Objects with any of the objects. For example,
using Accounts:
a.
Create a server script by selecting the REST Web Service and select the
method.
b.
Create the Actions and Link and select the server script created in previous
step.
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public
c.
Create a Layout under Pages and include the Action and Link created in
previous step.
. Access the REST web service by creating a Sales Account. Open the account and
click on the Action button created as a result of adding Action and Link in layout.
. Before invoking the REST endpoint, enable the Run Time Messages Log for the
logged-in session. Monitor the Run Time Messages for the expected REST service
output.
Invoke a SOAP Web Service
To invoke a SOAP web service using Application Composer:
.
Log in to Oracle Fusion Applications Cloud Service with a user that exists and is
configured for SSO on both Oracle Fusion Applications Cloud Service and your
Oracle PaaS cloud account.
.
Create a new sandbox or navigate to an existing sandbox.
.
In the Navigator, select Config, Application Composer, and then Web Services,
and create a Web Service with the SOAP option.
.
Enter a Name and provide the SOAP endpoint WSDL URL of the application.
.
Click Read WSDL, and the system will automatically fetch and populate the values
for Service and Port.
.
Do not select the Use Certificate from WSDL check box.
.
In the Security section, set the Security Scheme to Call using IDCS OAUTH.
.
In the fields under Call using IDCS OAUTH, enter the Oracle Identity Cloud
Service client key and secret as the Client Credential Key, enter the Credential
Key if needed, enter the Token URI, and enter the scope for the SOAP application
as the Scope, for example the external scope for a custom Oracle Java Cloud
Service application. This is the value you used in the client application as AllowedScope.
The Credential Key corresponds to the secret key (user name and credentials) of
the user to be used when Subject Precedence is not checked. This key name along
with the username and password is stored in the credential store and corresponds
to the csf-key property.
The user ID used to request a token needs to exist, and have appropriate privileges,
on the Oracle Identity Cloud Service instance.
.
Select the Subject Precedence check box to use the logged-in user as the subject,
or, leave the check-box empty to use a user ID specified in the credential key as the
subject.
. Customize your UI by using Standard Objects with any of the objects. For example,
using Accounts:
a.
Create a server script by selecting the SOAP Web Service and select the
method exposed by the WSDL.
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public
b.
Create the Actions and Link and select the server script created in previous
step.
c.
Create a Layout under Pages and include the Action and Link created in
previous step.
. Access the SOAP web service by creating a Sales Account. Open the account and
click on the Action button created as a result of adding Action and Link in layout.
. Before invoking the SOAP endpoint, enable the Run Time Messages Log for the
logged-in session. Monitor the Run Time Messages for the expected SOAP service
output.
Connect with us
Call + .
.ORACLE or visit oracle.com. Outside North America, find your local office at: oracle.com/contact.
blogs.oracle.com
facebook.com/oracle
Copyright ©
,
, Oracle and/or its affiliates. All rights reserved. This document
is provided for information purposes only, and the contents hereof are subject to
change without notice. This document is not warranted to be error-free, nor subject to
any other warranties or conditions, whether expressed orally or implied in law, including
implied warranties and conditions of merchantability or fitness for a particular purpose.
We specifically disclaim any liability with respect to this document, and no contractual
obligations are formed either directly or indirectly by this document. This document
may not be reproduced or transmitted in any form or by any means, electronic or
mechanical, for any purpose, without our prior written permission.
This device has not been authorized as required by the rules of the Federal
Communications Commission. This device is not, and may not be, offered for sale or
lease, or sold or leased, until authorization is obtained.
twitter.com/oracle
Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be
trademarks of their respective owners.
Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC
trademarks are used under license and are trademarks or registered trademarks of SPARC
International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or
registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open
Group.
Disclaimer: If you are unsure whether your data sheet needs a disclaimer, read the revenue
recognition policy. If you have further questions about your content and the disclaimer
requirements, e-mail REVREC_US@oracle.com.
Solution Playbook / Access PaaS data from a cloud application using web services
Copyright ©
,
, Oracle and/or its affiliates / Public