Oracle Cloud ERP Fusion — OAuth 2.0 Setup Guide

Instructions for an Oracle Cloud ERP (Fusion) administrator on what they must configure in their identity domain, and which values to enter into Clarity.

Overview

The Clarity Oracle Cloud ERP connector reads users and roles — and can provision users and role assignments — through Fusion’s SCIM REST API (/hcmRestApi/scim). Clarity supports two authentication methods, and both remain available side by side:

OAuth is the newer, more secure option: no password is ever stored with Clarity, and you can revoke Clarity’s access at any time by rotating or removing the signing certificate — no password reset required.

Note: the OAuth Client Credentials grant is not supported. Fusion rejects app-identity tokens with a 403 on every API call, since a token without a user subject can never authorize against Fusion role-based security. If your identity domain is only configured with a Client ID and Client Secret, you must also add the signing key and service-account username described below — or use Basic auth instead.

Prerequisites

• Access to create/designate an integration user in Oracle Fusion.

• Administrator access to your Oracle Identity Domain (IDCS) console — the identity domain that fronts your Fusion pod.

• Ability to generate an RSA keypair and X.509 certificate (a self-signed certificate is fine).

Step 1 — Create the Fusion service account

1. In Fusion, create (or designate) an integration user, e.g. CLARITY_INTEGRATION.

2. Grant it the roles your use of the connector requires. Reading users and roles and managing user accounts through the SCIM API is typically covered by an integration role such as Integration Specialist; your security administrator may use a custom role instead.

OAuth doesn’t change this step — API calls are still authorized against this user’s roles, exactly as with Basic auth.

Step 2 — Oracle-side OAuth setup (IDCS)

All of the following happens in your Oracle Identity Domain / IDCS console.

1. Generate a signing keypair. Create an RSA keypair and a matching X.509 certificate, for example:

• openssl req -x509 -newkey rsa:2048 -keyout clarity-signing.key -out clarity-signing.crt -days 730 -nodes

1. Create (or reuse) a confidential application:

   • Enable the client configuration and allow the JWT assertion (urn:ietf:params:oauth:grant-type:jwt-bearer) grant.

   • Mark the client as a Trusted client and import the X.509 certificate (clarity-signing.crt) as the trusted partner certificate. Note the certificate alias — Clarity can send it as the JWT kid header.

   • Under the app’s resources, add the Fusion Applications resource and grant the scope urn:opc:resource:consumer::all.

   • Record the Client ID and Client Secret.

2. Find your IDCS instance ID. Your identity domain URL looks like https://idcs-<idcs-id>.identity.oraclecloud.com. Clarity requests tokens from https://idcs-<idcs-id>.identity.oraclecloud.com/oauth2/v1/token (the full endpoint set is published at /.well-known/idcs-configuration on that host).

3. Build the scope string. Concatenate the Fusion audience and the scope name with no space between them:

• urn:opc:resource:fa:instanceid=<instance-id>urn:opc:resource:consumer::all

• A space between instanceid=<id> and urn:opc:... causes the token endpoint to return invalid_scope. Clarity also closes this specific gap automatically if a space or line break slips in when you paste it.

Step 3 — Enter the credentials in Clarity

In Clarity, add (or edit) the Oracle Cloud ERP integration and select the OAuth authentication method. Fill in:

All four of Client ID, Client Secret, Signing Private Key, and Service Account Username are required for OAuth. If only the Client ID/Secret pair is present, Clarity falls back to Basic auth when a username/password is also configured, and otherwise fails with a message naming the missing fields.

Click Validate to confirm connectivity before the first sync.

Step 4 — Rotating or revoking credentials

• To rotate the signing key: generate a new keypair, import the new certificate on the confidential application, update the private key (and alias, if changed) in Clarity, then remove the old certificate.

• To revoke Clarity’s access: remove the trusted partner certificate (or deactivate the confidential application). No password reset is needed — Clarity never holds the service account’s password under OAuth.

Troubleshooting

Need Help?