Oracle is deprecating password-based authentication for Oracle Fusion Applications REST and SOAP services. Oracle Integration customers with affected connections must migrate to a supported OAuth token-based authentication method before March 31, 2027 to avoid disruption.

Who is affected?

This change affects Oracle Integration customers using password-based authentication for Invoke or Trigger connections to Oracle Fusion Applications through:            

  • Oracle ERP Cloud Adapter using Username Password Token or Username Password Token With PGP Key Support.
  • Oracle HCM Cloud Adapter using Username Password Token or Username Password Token With PGP Key Support.
  • Oracle CX Sales and B2B Service Adapter using Username Password Token.
  • The REST Adapter using HTTP Basic Authentication to connect to Oracle Fusion Applications instances.
  • The SOAP Adapter using HTTP Basic Authentication, Username Password Token, or other password-based authentication policies to connect to Oracle Fusion Applications instances.                                

Review the authentication configuration of each connection used to access Fusion Applications to determine whether action is required.

What is changing?

Oracle Fusion Applications is transitioning from password-based authentication to OAuth token-based authentication for its REST and SOAP services. Affected Oracle Integration connections must use a supported OAuth token-based authentication method appropriate to the adapter and Fusion Applications service.

What is the impact on existing integrations?

After enforcement begins, requests that continue to use password-based authentication may fail to authenticate. These failures could interrupt integration flows or scheduled processing that depends on Fusion Applications REST or SOAP services.

The availability of alternative security policies does not automatically migrate existing connections. Customers must update affected connections and validate their dependent integrations.

What are my required actions?

Complete the following actions before March 31, 2027:

  1. Identify all invoke and trigger connections that use password-based authentication to access Fusion Applications.
  2. Review the following supported OAuth token-based authentication policies for each applicable adapter and service.
    1. Authorization Code Credentials
    2. JWT User Assertion
  3. Replace the password-based authentication policy on each affected trigger and invoke connection with a supported OAuth token-based authentication policy, and configure the required OAuth credentials.                   
  4. Test, Save the updated connections, activate, and validate dependent integrations before March 31, 2027.