Document 2884072.1 - Workflowmailer
Document 2884072.1 - Workflowmailer
1
Last Login: November 6, 2024 9:24 AM PST Switch to My Oracle Cloud Support pradeep (Available) (0) Contact Us Help
Give Feedback...
Copyright (c) 2025, Oracle. All rights reserved. Oracle Confidential.
Configuring Oracle Workflow for OAuth 2.0 with Microsoft Office 365 Exchange Online in Oracle E-Business Suite To Bottom
Release 12.2 and Release 12.1.3 (Doc ID 2884072.1)
The Oracle Workflow Notification Mailer uses an IMAP mail server for inbound mail processing and an SMTP mail server for
Was this document helpful?
outbound mail processing. This document describes how to configure Oracle Workflow for OAuth-2.0–based connections to
Microsoft Office 365 Exchange Online. Yes
No
The most current version of this document is available in My Oracle Support Knowledge Document 2884072.1. Check the
Change Log to find the latest updates.
Document Details
In This Document
Type:
REFERENCE
This document is divided into the following sections: Status:
PUBLISHED
Last Major
24-May-2024
Section 1: Overview of OAuth-2.0–Based Authentication Update:
10-Dec-2024
Section 2: Prerequisites Last Update:
Section 3: Create a Self-Signed Key Pair (Conditionally Required)
Section 4: Set Up Microsoft Azure
Section 5: Set Up Oracle E-Business Suite Related Products
Oracle Email Center
Oracle Workflow
Section 1: Overview of OAuth-2.0–Based Authentication
By default, the Oracle Workflow Notification Mailer in Oracle E-Business Suite (EBS) supports a basic authentication scheme to Information Centers
authenticate user credentials with mail servers. This type of authentication uses a user name and password to connect to a mail Information Center: Oracle
Interaction Center (Telephony,
server. Email Center, One-to-One
Fulfillment, Scripting, UWQ)
The following diagram shows how the EBS Workflow Notification Mailer connects to the mail server using an email user name [1271155.2]
and password to access a mailbox.
Information Center: E-Business
Suite Oracle Workflow (WF)
Figure 1: Basic Authentication Scheme
[1320509.2]
Document References
No References available for
this document.
Recently Viewed
R12 E-Business Suite
Configuring Workflow Mailer
with TLS for Microsoft
Office365, Gmail, or Cloud
You can choose to implement OAuth-2.0–based authentication instead of basic authentication for connections to the Microsoft Based Email Services for
Office 365 Exchange Online IMAP server and SMTP server. In OAuth-2.0–based authentication, mail servers expect client 12.1.3 and 12.2 [2051827.1]
applications like the Oracle Workflow Notification Mailer to send a valid access token along with the user name to access a Configuring an Oracle
mailbox and perform any operation. Workflow Notification Mailer
with Cloud E-Mail Servers
An access token is provided by an authorization server. When using this type of authentication, the Oracle Workflow Notification [2077434.1]
Mailer requests an access token from Microsoft Entra ID to connect to Microsoft Office 365 Exchange Online and process EBS Workflow Mailer
messages. Oracle Workflow uses the Client Credentials Grant flow with a certificate-based credential. Configuration with OAuth 2.0
Token-Based Authentication
for Cloud-Based Email
The following diagram shows how the EBS Workflow Notification Mailer first requests an access token from the authorization
Services (Gmail, Yahoo,
server and then connects to the mail server using an email user name and the access token to access a mailbox. Office365, etc) [2650084.1]
How to Check If a Purchase
Figure 2: OAuth Authentication using Client Credentials Order (PO) Was Approved
Via Email or Directly
Through Worklist?
[2952305.1]
How To Solve Error "Query
has exceeded 200 rows.
Potentially more rows exist,
please restrict your query "
[1241395.1]
Show More
https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=293075351860426&id=2884072.1&_afrWindowMode=0&_adf.ctrl-state=gvdaay0… 1/9
2/12/25, 10:04 AM Document 2884072.1
Note: For IMAP connections to Microsoft Office 365 Exchange Online, OAuth-2.0–based authentication is available in both
Oracle E-Business Suite Release 12.2 and Release 12.1.3. For SMTP connections to Microsoft Office 365 Exchange Online,
OAuth-2.0–based authentication is available only in Oracle E-Business Suite Release 12.2.
In Oracle E-Business SuiteRelease 12.1.3, SMTP connections to Microsoft Office 365 Exchange Online will continue to use
the basic authentication scheme.
Section 2: Prerequisites
To set up OAuth-2.0–based authentication, you must have the following prerequisites:
Patch 36017088:R12.OWF.C – PROVIDE OAUTH SUPPORT FOR GMAIL AND MICROSOFT IN MAILER OUTBOUND
AND INBOUND. You can apply this one-off patch on Oracle E-Business Suite Release 12.2.3 or later.
All requirements listed in Document 2647635.1, Infrastructure Requirements for Business Critical Fixes and Limited
Updates for Oracle E-Business Suite 12.1.3.
For both Release 12.2 and Release 12.1.3, the JDK version on the Oracle E-Business Suite application tier should be
1.7.0_321 or later.
For both Release 12.2 and Release 12.1.3, you must also have a signing key pair consisting of the following files:
A keystore in PKCS#12 (.p12) format containing a single pair of private and public keys along with any
intermediate certificate authority (CA) certificates.
The corresponding public key certificate in the form of a binary DER-encoded X.509 certificate file (.cer). This
certificate will be uploaded to Oracle E-Business Suite. A chain of intermediate CA certificates, if any, should be
included into a single file.
For testing purposes, you can create a self-signed key pair. See Section 3: Create a Self-Signed Key Pair.
keytool -genkeypair -alias KEY_ALIAS -keyalg "RSA" -keysize "2048" -dname "cn=CNAME, ou=ORGUNIT,
o=ORGANIZATION, c=COUNTRYCODE" -storetype "PKCS12" -keystore P12_FILE -storepass PASSWORD_FOR_KEYSTORE -
validity 365
https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=293075351860426&id=2884072.1&_afrWindowMode=0&_adf.ctrl-state=gvdaay0… 2/9
2/12/25, 10:04 AM Document 2884072.1
For example:
keytool -genkeypair -alias ms -keyalg "RSA" -keysize "2048" -dname "cn=Smith, ou=Development, o=Oracle,
c=US" -storetype "PKCS12" -keystore ms.p12 -storepass PASSWORD_FOR_KEYSTORE -validity 365
2. Export the public key as a binary DER-encoded X.509 certificate file. This certificate will be uploaded to Oracle E-Business
Suite.
keytool -exportcert -alias KEY_ALIAS -keystore P12_FILE -storepass PASSWORD_FOR_KEYSTORE -file CER_FILE -
storetype "PKCS12"
For example:
keytool -exportcert -alias ms -keystore ms.p12 -storepass PASSWORD_FOR_KEYSTORE -file ms.cer -storetype
"PKCS12"
Perform these steps to register the Oracle Workflow application in Oracle E-Business Suite with Microsoft Entra ID:
2. If you have access to multiple tenants, use the Directories + subscriptions filter in the top menu to switch to the
tenant in which you want to register the application.
6. In the Who can use this application option, select Accounts in this organizational directory only.
When registration finishes, the Azure portal displays the app registration's Overview pane.
Figure 3: Azure Portal Showing Application (client) ID and Tenant (directory) ID fields
You will enter these values in the Oracle Workflow notification mailer configuration page in Oracle E-Business Suite.
3. Select the public key certificate file that corresponds to your signing key pair. If you have intermediate CA certificates,
ensure that you have exported the entire certificate chain in a single file and upload that single file.
4. Select Add.
https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=293075351860426&id=2884072.1&_afrWindowMode=0&_adf.ctrl-state=gvdaay0… 3/9
2/12/25, 10:04 AM Document 2884072.1
1. In the Azure portal, in App registrations, select your application.
4. Select the APIs my organization uses tab and search for Office 365 Exchange Online.
You should now have the IMAP and SMTP application permissions added to the application created in Microsoft Entra ID
for the Oracle Workflow application in Oracle E-Business Suite.
To access Microsoft Exchange mailboxes through IMAP and SMTP, the application for Oracle Workflow in Microsoft Entra ID must
be granted tenant admin consent.
After a tenant admin grants consent to the Microsoft Entra ID application, the tenant admin must also register your application's
service principal in Exchange through Exchange Online PowerShell. This registration is enabled by the New-ServicePrincipal
cmdlet.
The New-ServicePrincipal cmdlet requires <APPLICATION_ID> and <OBJECT_ID> as input. You can obtain the
<APPLICATION_ID> and <OBJECT_ID> values from the Microsoft Entra ID application's enterprise application instance on the
tenant. To obtain these values, perform the following steps:
1. In the Azure portal, in Microsoft Entra ID, select Enterprise Applications under the Manage tab.
2. Search for and select the application for Oracle Workflow in Azure.
3. Navigate to the Overview tab in the Properties section, and make a note of the following values:
Application ID
Object ID
https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=293075351860426&id=2884072.1&_afrWindowMode=0&_adf.ctrl-state=gvdaay0… 4/9
2/12/25, 10:04 AM Document 2884072.1
Figure 5: Azure Portal Showing Application ID and Object ID Fields
The OBJECT_ID is the Object ID from the Overview page of the Enterprise Application node (Azure Portal) for the application
registration. It is not the Object ID from the Overview of the App Registrations node. Using the incorrect Object ID will cause an
authentication failure.
The following sample command shows an example of registering a Microsoft Entra ID application's service principal in Exchange:
Next, obtain your registered service principal's identifier using the Get-ServicePrincipal cmdlet. Use the <DISPLAY_NAME>
value that you specified when you ran the New-ServicePrincipal command as the value for the Identity parameter in the
Get-ServicePrincipal command.
The registered service principal's identifier is different than the enterprise application instance identifier in the Azure Portal used
earlier. Make a note of the service principal identifier. You will enter this value in the next step, in Section 4.6: Add Mailbox
Access to Application.
Next, you must add access to a mailbox to the application for Oracle Workflow in Microsoft Entra ID. Use the Add-
MailboxPermission cmdlet to give your application's service principal access to one mailbox:
In this command, replace <SERVICE_PRINCIPAL_ID> with the service principal identifier you obtained in Section 4.5: Register
Service Principal in Exchange Online.
For example:
Keep a note of the following details. You will use these details in Section 5: Set Up Oracle E-Business Suite.
User name – The <MailboxIdParameter> value used in Section 4.6: Add Mailbox Access to Application
Client ID – The Application ID obtained in Section 4.1: Register Application with Microsoft Entra ID
Tenant ID – The Directory ID obtained in Section 4.1: Register Application with Microsoft Entra ID
Private key file – The keystore containing a single pair of private and public keys in PKCS#12 (.p12) format from Section
2: Prerequisites
Private key password – The password required to access the private keystore
https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=293075351860426&id=2884072.1&_afrWindowMode=0&_adf.ctrl-state=gvdaay0… 5/9
2/12/25, 10:04 AM Document 2884072.1
Public key file – The binary DER-encoded X.509 certificate (.cer) file containing the public key certificate from Section 2:
Prerequisites
1. Apply Patch 31042881 to uptake JavaMail 1.6.2 in Oracle E-Business Suite Release 12.2. This patch must be applied on
both the run and patch file system, so you must run fs_clone after the ADOP cutover phase.
2. Apply R12.AD.C.Delta.12 (Patch 30628681) and R12.TXK.C.Delta.12 (Patch 30735865) as prerequisites for OAuth 2.0
support.
3. Apply Patch 36017088:R12.OWF.C to uptake OAuth 2.0 support in the Oracle Workflow Notification Mailer for Release
12.2.
1. Ensure that you have applied all requirements listed in Document 2647635.1, Infrastructure Requirements for Business
Critical Fixes and Limited Updates for Oracle E-Business Suite 12.1.3.
2. Apply Patch 31043260 to uptake JavaMail 1.6.2 in Oracle E-Business Suite Release 12.1.3.
i. Source the $INST_TOP/ora/10.1.3/.env file and then apply Patch 31043260 to the Oracle Application Server
10.1.3.5 Oracle home.
ii. Source the Oracle E-Business Suite environment using $APPL_TOP/APPS<CONTEXT_NAME>.env and run
$ADMIN_SCRIPTS_HOME/adadmin. While running adadmin, specify the following choices when prompted:
iii. Stop and restart all application tier processes for the instance using the adstpall.sh and adstrtal.sh scripts.
3. Apply Patch 34632788:R12.OWF.B to uptake OAuth 2.0 support in the Oracle Workflow Notification Mailer for Release
12.1.3.
5.2 Configure Oracle E-Business Suite for Outbound Connections over TLS 1.2
1. Follow the instructions listed in "Section 5.3.1 Perform the General Required Configuration, Step 1 - Update the
AdminServer and the Managed Server (WLS) Configuration" within "Section 5.3 Configure Loopback and Outbound
Connections" of Document 1367293.1, Enabling TLS in Oracle E-Business Suite Release 12.2. If you are choosing to
configure TLS with backward compatibility, use these instructions in conjunction with "Section 6.1.2 Configure Loopback
and Outbound Connections, Alternate 5.3 Step 1 - Update the AdminServer and the Managed Server (WLS)
Configuration" within "Section 6.1 Configure Latest TLS with Backward Compatibility" of Document 1367293.1, Enabling
TLS in Oracle E-Business Suite Release 12.2.
That is:
For outbound connections over TLS 1.2 only, add the following to the server start arguments: -
DUseSunHttpHandler=true -Dhttps.protocols=TLSv1.2
For outbound connections with backward compatibility, add the following to the server start arguments: -
DUseSunHttpHandler=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2
2. Stop and restart all servers using the adstpall.sh and adstrtal.sh scripts.
1. Follow the instructions listed in "Section 5.3.1 Application Tier Configuration, Step 1 - Configure Protocol" within "Section
5.3 Configure Loopback and Outbound Connections" of Document 376700.1, Enabling TLS in Oracle E-Business Suite
Release 12.1. If you are choosing to configure TLS with backward compatibility, use these instructions in conjunction with
"Section 6.1.2 Configuration for Loopback and Outbound Connections, Step 1 - Configure Protocol" within "Section 6.1
Configure Latest TLS with Backward Compatibility" of Document 376700.1, Enabling TLS in Oracle E-Business Suite
Release 12.1.
That is:
For outbound connections over TLS 1.2 only, add the following to the server start arguments in the OC4J
properties file: https.protocols=TLSv1.2
For outbound connections with backward compatibility, add the following to the server start arguments in the OC4J
properties file: https.protocols=TLSv1,TLSv1.1,TLSv1.2
https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=293075351860426&id=2884072.1&_afrWindowMode=0&_adf.ctrl-state=gvdaay0… 6/9
2/12/25, 10:04 AM Document 2884072.1
2. Stop and restart all servers using the adstpall.sh and adstrtal.sh scripts.
5.3 Define SMTP Configuration for OAuth (Oracle E-Business Suite Release 12.2 only)
1. Log in to Oracle E-Business Suite as a user with workflow administrator privileges. See Setting Global User Preferences,
Oracle Workflow Administrator's Guide.
2. Navigate to Workflow Administrator Web Applications: Oracle Applications Manager > Workflow Manager.
3. Click the Notification Mailers status icon to access the notification mailer configuration wizard.
4. Select and edit an existing notification mailer, or create a new notification mailer. See Notification Mailer Configuration
Wizard, Oracle Workflow Administrator's Guide.
You can define OAuth configuration in the Outbound Email Account region of the Basic Configuration page or the
advanced configuration wizard.
5. In the Outbound Email Account region of the Basic Configuration page, if a proxy server is configured for outbound
connections from Oracle E-Business Suite, then select the Connect through a proxy server checkbox.
7. Enter the OAuth details, using the values you noted in Section 4.7.
In this URL, replace <tenant ID> with the directory tenant ID.
Scope – https://outlook.office365.com/.default
Upload Private Key File – Click Browse, then browse and select the .p12 file for the keystore that contains the
private key.
Private Key Password – Enter the password required to access the keystore.
Upload Public Key File – Click Browse, then browse and select the .cer file for the public key certificate file.
Connection Security – STARTTLS.
The OAuth values are specified correctly as listed in the previous step.
A proxy server is configured, if required for outbound connection from your Oracle E-Business Suite instance to
Microsoft Exchange Online.
Your Oracle E-Business Suite instance has the prerequisite patches required for OAuth.
1. Log in to Oracle E-Business Suite as a user with workflow administrator privileges. See Setting Global User Preferences,
Oracle Workflow Administrator's Guide.
2. Navigate to Workflow Administrator Web Applications: Oracle Applications Manager > Workflow Manager.
3. Click the Notification Mailers status icon to access the notification mailer configuration wizard.
4. Select and edit an existing notification mailer, or create a new notification mailer. See Notification Mailer Configuration
Wizard, Oracle Workflow Administrator's Guide.
You can define OAuth configuration in the Inbound Email Account region of the Basic Configuration page or the
advanced configuration wizard.
5. In the Inbound Email Account region of the Basic Configuration page, select the Inbound Processing checkbox.
7. Enter the OAuth details, using the values you noted in Section 4.7. The following screenshot shows an example of how to
specify these details.
Figure 7: Inbound Email Account Region with OAUTH Authentication Type Selected
https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=293075351860426&id=2884072.1&_afrWindowMode=0&_adf.ctrl-state=gvdaay0… 7/9
2/12/25, 10:04 AM Document 2884072.1
In this URL, replace <tenant ID> with the directory tenant ID.
Scope – https://outlook.office365.com/.default
Upload Private Key File – Click Browse, then browse and select the .p12 file for the keystore that contains the
private key.
Private Key Password – Enter the password required to access the keystore.
Upload Public Key File – Click Browse, then browse and select the .cer file for the public key certificate file.
Connection Security – SSL/TLS
Reply-To Address – Enter the address of the email account that receives incoming messages, to which
notification responses should be sent.
The OAuth values are specified correctly as listed in the previous step.
A proxy server is configured, if required for outbound connection from your Oracle E-Business Suite instance to
Microsoft Exchange Online.
Your Oracle E-Business Suite instance has the prerequisite patches required for OAuth.
Change Log
Date Description
2024-
05-24 Replaced references to Microsoft Azure Active Directory with its new name, Microsoft Entra ID.
Updated Section 4.5 to reflect new syntax for the New-ServicePrincipal and Get-ServicePrincipal cmdlets.
2024-
01-05 Replaced Patch 35814684:R12.OWF.C with Patch 36017088:R12.OWF.C in Section 2 and Section 5.1.
2023-
11-17 Added updates for support for OAuth-2.0–based SMTP connections in Oracle E-Business Suite Release 12.2,
in introduction, Section 1, Section 2, Section 4.3, Section 4.4, and Section 5.1.
Added "Define SMTP Configuration for OAuth (Oracle E-Business Suite Release 12.2 only)" as Section 5.3.
https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=293075351860426&id=2884072.1&_afrWindowMode=0&_adf.ctrl-state=gvdaay0… 8/9
2/12/25, 10:04 AM Document 2884072.1
2022-
10-21 Replaced Patch 34278466:R12.OWF.B with Patch 34632788:R12.OWF.B in Section 2 and Section 5.1.
Added clarification for the Object ID in Section 4.5.
2022-
10-11 Updated minimum JDK version in Section 3.
2022-
10-10 Replaced Patch 34423621:R12.OWF.C with Patch 34565205:R12.OWF.C in Section 2 and Section 5.1.
2022-
09-07 Corrected Get-ServicePrincipal command in Section 4.5.
2022-
09-02 Revised Section 4.5.
Added screenshots in Sections 4.1, 4.3, 4.5, and 4.6.
2022-
08-19 Added information for OAuth 2.0 support in Release 12.1.3.
2022-
08-16 Updated Java version in Section 3.
Updated command and example in Section 3 step 2.
Added Section 5.2 Configure Oracle E-Business Suite for Outbound Connections over TLS 1.2 and moved
Define IMAP Configuration for OAuth to Section 5.3.
2022-
08-08 Replaced Patch 34246039:R12.OWF.C with Patch 34423621:R12.OWF.C in Section 2 and Section 5.1.
Updated Section 5.2 step 7.
2022-
07-22 Initial publication.
Note: In the examples in this document, user, application, object, and service details all represent fictitious samples. Any
similarity to actual persons, living or dead, is purely coincidental and is in no way intentional on the part of Oracle.
REFERENCES
Related
Products
Oracle E-Business Suite > Service > Interaction Center Technology > Oracle Email Center > Administration > Self-Service Administration
Oracle E-Business Suite > Applications Technology > Integration > Oracle Workflow
Back to Top
Copyright (c) 2025, Oracle. All rights reserved. Legal Notices and Terms of Use Privacy Statement
https://support.oracle.com/epmos/faces/DocumentDisplay?_afrLoop=293075351860426&id=2884072.1&_afrWindowMode=0&_adf.ctrl-state=gvdaay0… 9/9