Integrated Application

The ServiceInstanceID used in the Dodeca PBCS/EPM Cloud Connector configuration and referred to in this document is obtained from the Oracle EPM cloud service defined in the Oracle Identity Cloud Service (IDCS) console. An "Integrated Application" (OAuth application) must be created in order to connect to the Oracle EPM cloud service, and that integrated application is used to obtain the ClientID and TenantID for the Dodeca Oracle Authorization Connector. The steps below assume an Oracle EPM cloud service already exists.

As of the July 2026 Oracle EPM Cloud release, Oracle requires two OAuth 2 configuration changes covered below. Integrated applications created before this change must be updated, or OAuth authentication will fail. See Further Reading for more info.

  1. Configuring the secondary audience on the target cloud service (see Configuring the Secondary Audience).

  2. Ensuring the EPM Cloud resources/scopes are included in the integrated application’s Token Issuance policy (see Create a new Mobile Application).

Create a new Mobile Application

  1. Log in to the Oracle Identity Cloud Service (IDCS) Admin Console for the tenant containing your Oracle cloud service, then go to Identity → Domains → (compartment) → OracleIdentityCloudService domain → Integrated Applications tab.

  2. Choose New Application, select Mobile App, choose Launch Workflow, give it a name, and Submit.

  3. On the OAuth configuration tab, choose Edit OAuth configuration.

  4. In the Authorization section, enable Refresh token and Authorization code (and Device code, if the connection using this integrated application will use the Device_Code grant type), and disable Undo Implicit.

  5. Add a redirect URL of https://sso.appliedolap.com/oauth/nativeclient. Only one redirect URL is required; a different HTTPS URL may be substituted if preferred (for example https://sso.companyname.com), but the multiple http://localhost:<port>; entries sometimes seen in other OAuth guides are not needed. Leave Allow non-HTTPS URLs disabled — it is not needed as long as the redirect URL uses HTTPS.

  6. In the Token Issuance policy section, set Client IP address to Anywhere and enable Add resources.

  7. Click Add Scope, find the cloud service, check it, expand it, and enable the Select scope checkbox, then confirm the selection. This adds the cloud service as an accessible resource of the Integrated Application (see Locating the ServiceInstanceID for where to find its ServiceInstanceID).

  8. Click Submit.

  9. Back on the Integrated Applications tab, select the checkbox for the new application, then use the ellipsis menu to Activate it.

Locating the ServiceInstanceID

The ServiceInstanceID belongs to the Oracle Cloud Service itself (for example, the EPM instance), not to the integrated application. It is found in the Primary Audience field on the cloud service’s own OAuth Configuration tab, in the form urn:opc:serviceInstanceID=<number> (for example, urn:opc:serviceInstanceID=687065601):

  1. Go to Identity → Domains → (compartment) → OracleIdentityCloudService domain → Oracle Cloud Services → the cloud service in question.

  2. On the OAuth configuration tab, the Primary Audience field shows the ServiceInstanceID in the form above.

The same value also appears in the Scope column of an integrated application’s Resources table, but only because that cloud service has been added as a resource to the application. An integrated application can have multiple resources, each with a different ServiceInstanceID, so the cloud service’s own Primary Audience value — not the integrated application’s Resources table — is the correct place to confirm which ServiceInstanceID belongs to the cloud service the connector is connecting to.

Configuring the Secondary Audience

This step is required (see the July 2026 mandatory-update note above). In addition to the integrated application above, the target Oracle Cloud Service (for example, the EPM instance) must have its own OAuth configuration updated to accept tokens issued for this integrated application. This is a one-time setup step performed after the integrated application has been configured, on the cloud service itself rather than on the integrated application:

  1. Go to Identity → Domains → (compartment) → OracleIdentityCloudService domain → Oracle Cloud Services → the cloud service in question.

  2. On the OAuth configuration tab, choose Edit OAuth configuration.

  3. Enable Add secondary audience, then add the URL of the cloud service, for example:

    https://appliedolapepm-test-appliedolapepm.epm.us-phoenix-1.ocs.oraclecloud.com
https://epbcs1-test-xxxxxxx.epm.us-ashburn-1.ocs.oraclecloud.com

  4. Ensure Allow token refresh is enabled for the cloud service; enable it if it is not already.

  5. Save the changes.

Assigning Users

Users must be granted access to the cloud service under Identity → Domains → (compartment) → OracleIdentityCloudService domain → Oracle Cloud Services → the cloud service in question → Users and/or Groups.

Further Reading