The ins & outs of mobile applications for Oracle EBSPublished on: Author: Richard Velden Category: Oracle
In this article we will discuss the mobile applications from Oracle, currently available for Oracle E-Business Suite (EBS). We will provide an overview on the technical architecture, distribution and security of these mobile applications. How can these apps be secured, who is allowed access, how are apps distributed, how to keep control?
1st of October 2014: Oracle announced 14 smartphone applications for Oracle E-Business Suite.
“These new applications provide simple, actionable, on-the-go access to horizontal functions such as approvals, expenses, timecards, and employee requisitions as well as…” They are available at no additional cost, for versions Oracle E-Business Suite 12.1.3 and 12.2.
These applications have been built with Oracle Mobile Application Framework (MAF). This framework simplifies mobile development with the ability to build once and deploy to multiple platforms .
How does this work technically?
Basically we have:
- An application providing REST services
- A mobile app consuming these REST services
For some more detail we’ll first discuss the Oracle Mobile Application Framework architecture itself.
Oracle Mobile Application Framework Architecture
Oracle’s own Mobile Application Framework (MAF) has been introduced (in its current form) in 2014.
Various other components such as a Java VM and a SQLite database complete this, providing a platform for developers to quickly assemble mobile applications. For integration purposes the Java VM enables the framework to consume SOAP and REST services .
On the other side we have the server backend, Oracle E-Business Suite.
EBS Integration Architecture
Oracle EBS is a database application, with both a Forms and a web-based (OAF) frontend. Integration has been implemented using the ‘Integrated SOA Gateway’ (ISG). It enables other applications to communicate with Oracle EBS using SOAP or REST protocols.
Using the ISG, many of the standard PL/SQL APIs have been service-enabled .
Bringing both architectures together and we’ll get the EBS Mobile Architecture.
EBS Mobile Architecture
“Oracle E-Business Suite mobile apps interact with the middle tier through REST-based data services and security services.”
When a user opens the mobile app, the security services are invoked for authentication. Once the login is successful the user can use the app, and the other Oracle E-Business Suite REST data services (see fig 7) .
These services are exposed using the SOA Integrated Gateway. Conceptually they are divided between Data and Security services.
Security Services are displayed in a separate category through the Integration Repository (see figure 8). They are predefined, pre-deployed REST services. Unlike other services these are by default granted to all users. With security services the mobile apps can authenticate user credentials and initialize application sessions [8, 9].
EBS Mobile Security
Authorization: who is allowed to use which mobile applications?
Each mobile app (except for the Approvals app) requires users to be assigned an ‘app specific’ role in Oracle User Management (UMX). Without the appropriate role, a user has no access to the mobile app.
- Mobile Time Entry UMX|HXC_MBL_TIME_ENTRY
- OLM Learner Mobile Application Role UMX|MBL|OTA_LRNR_MOB_ACC
- Access Role for Person Directory Mobile App UMX|MBL|PERSON_DIRECTORY_APP_ACCES
- iProcurement Mobile App Enquiry Role UMX|ICX_MBL_REQ_ENQUIRY
- Purchasing Mobile App Role UMX|PO_MOBILE_APP_ROLE
For some apps additional setup is also required before the mobile application will function properly. More on that can be found on the website of My Oracle Support (Doc ID: 1641772.1)
Authentication: verify user identity
Users are authenticated using the authentication REST services as discussed in the previous section on EBS Mobile Architecture. Basically there are two authentication types available: HTTP Basic and Web SSO.
Oracle Mobile supports both types. Be aware that SSO is not really a single sign-on for all your EBS mobile apps. Separate authentication per app is still needed. For Web SSO additional setup is needed.
More information can be found on https://docs.oracle.com/cd/E18727_01/doc.121/e64384/T656045T656049.htm#mobile_eag. Or you can check the ‘Oracle® E-Business Suite Mobile Apps Administrator's Guide’ .
EBS Mobile Network Security
Securing EBS functionality is one, and can be arranged using Oracle EBS user management (UMX). As mentioned above, securing who can access which specific mobile application is also managed from UMX by means of granting a separate ‘mobile role’ for each mobile application.
Network access to EBS however always (except for some modules) happens within the company firewall. Having actual physical access to the network on which Oracle EBS is running, is a separate concern for mobile devices.
In the following diagram (see figure 9) we showcase three network security options:
- Option 1: setup VPN on smartphone, and access EBS
- Option 2: setup EBS with DMZ and connect using external access point
- Option 3: setup Oracle Mobile Security Suite’s Mobile Security Access Server (MSAS) on the DMZ and containerize EBS apps.
In which for option 3 all Oracle EBS mobile apps are being run within a container application. This container manages authentication and secure connection to the backend (see figure 10) .
EBS Mobile Distribution
Distribution of mobile apps can be pretty straightforward. One can go into the commercially available app stores, download the app and use it. For corporate apps this can be applied, just as for ordinary consumer apps.
- Are we in control, which versions do we support?
- Do we need to create our own corporate branded version?
- Once downloaded, users need to add the EBS endpoint URL
- Users might need to set up a VPN
- How to keep private and corporate data separately?
From Oracle E-Business Suite Mobile Foundation Release 4.0 it is possible to distribute Oracle’s apps internally. Oracle provides Mobile Application Archive (MAA) files for each of the mobile applications. These files allow distribution of the apps from the enterprise’s own site.
Apart from separate distribution, these MAA files also allow customization of Oracle’s mobile apps. Albeit limited to adding own corporate branding, and changing some links. You could always customize more, but one loses the guarantee it will work after patches or updates [9, 10].
Oracle Mobile Security Suite
Oracle offers a comprehensive Mobile Security Suite for managing and deploying mobile apps. It is a separate product providing:
- An app catalog
- App containerization: apps are run within a separate secure container
- Secure workspace: embedded encryption to isolate and secure corporate, from personal data
- App tunnel: no need for separate VPN solution
Oracle EBS mobile apps can also be distributed using Oracle Mobile Security Suite (see figure 11). Enabling true single-sign on capabilities, without the need for setting up a separate VPN tunnel on the mobile device [11, 12].
In our next article we will discuss how to set up and enable one of the Oracle EBS mobile apps. Upcoming articles will focus on customization of these mobile applications and creating entirely new mobile apps for Oracle E-Business Suite.
 Oracle E-Business Suite Powers the Mobile Workforce with 14 Smartphone Applications, https://www.oracle.com/corporate/pressrelease/e-business-suite-100114.html
 Mobile App for Approvals for EBS 1.2.0 on iOS and Android, https://blogs.oracle.com/fusionmiddleware/entry/mobile_app_for_approvals_for
 Procurement for EBS, https://play.google.com/store/apps/details?id=com.oracle.ebs.prc.po.procurement&hl=en
 Introduction to Oracle Mobile Application Framework, http://docs.oracle.com/middleware/mobile200/mobile/develop-oepe/oepe-maf-about.htm
 Oracle Integrated SOA Gateway Architecture, http://www.slideshare.net/Berryclemens/con9437-ebs-mobile-apps-adf
 Oracle® E-Business Suite Mobile Apps Administrator's Guide, https://docs.oracle.com/cd/E18727_01/doc.121/e64384.pdf
 Oracle Mobile Security, http://www.oracle.com/us/products/middleware/identity-management/mobile-security/overview/index.html
 Timecards for EBS, https://play.google.com/store/apps/details?id=com.oracle.ebs.hr.hxc.timecards&hl=en_GB
 New Technology Features in EBS Mobile Apps Release 4.0, https://blogs.oracle.com/stevenChan/entry/oracle_e_business_suite_mobile
 Oracle® E-Business Suite Mobile Foundation Developer's Guide, http://docs.oracle.com/cd/E18727_01/doc.121/e69284.pdf
 Mobile Application Management (MAM) Support with Oracle Mobile Security Suite, https://docs.oracle.com/cd/E18727_01/doc.121/e64384/T656045T656052.htm
 Oracle Mobile Security Suite, http://www.oracle.com/technetwork/middleware/id-mgmt/overview/default-2099033.html