Oracle APEX, Security
Enabling Microsoft Azure SSO in Oracle APEX
Single Sign-On improves user experience by providing seamless access across applications with one login. Integrating Oracle APEX with Microsoft Entra ID (Azure AD) centralizes identity management, strengthens security, and simplifies user access. This guide outlines an OpenID Connect configuration for Oracle APEX.
Prerequisites
- An Oracle APEX environment—version 20.x or later is recommended.
- Administrator access to the Microsoft Entra or Azure portal.
- Accurate time-zone and UTC settings in the APEX environment, because incorrect time can cause token-validation failures.
- The final HTTPS URL for the APEX environment.
Step 1: Register Oracle APEX in Microsoft Entra ID
Open App Registrations
Sign in to the Microsoft Entra admin center, go to Identity → Applications → App registrations, and select New registration.
Register the APEX Application
Enter an application name, choose the supported account type required by your organization, and add the APEX authentication callback as the Web redirect URI.
Record the Identifiers
After registration, copy the Application (client) ID and Directory (tenant) ID. Open Endpoints and copy the OpenID Connect metadata document URL.
Create a Client Secret
Under Certificates & secrets, create a new client secret. Copy its value immediately and store it securely because it will not be displayed again.
APEX Redirect URI
https://<your-apex-domain>/ords/apex_authentication.callbackStep 2: Create OAuth2 Credentials in Oracle APEX
- Open the Oracle APEX application.
- Navigate to Shared Components → Credentials and select Create.
- Choose OAuth2 Client Credentials as the authentication type.
- Use the Azure Application (client) ID as the Client ID or Username.
- Use the client secret value as the Client Secret or Password.
- Create the credential so APEX stores the sensitive values securely.
Step 3: Create the Authentication Scheme
In Oracle APEX, open Shared Components → Authentication Schemes, select Create, and choose From Scratch. Configure the scheme with the following values:
Step 4: Activate and Test the Scheme
- Open Authentication Schemes and select the newly created Microsoft SSO scheme.
- Select Make Current Scheme.
- Apply the changes, launch the application, and verify the complete sign-in and sign-out flow.
Security Checklist
- Never place the client secret in source code, screenshots, or browser-delivered configuration.
- Use HTTPS for the APEX environment and require an exact redirect-URI match.
- Apply least-privilege Microsoft Entra permissions and rotate client secrets before expiration.
- Validate the email or identity claims used to map Microsoft users to application authorization roles.
Final Thoughts
Integrating Microsoft Entra ID with Oracle APEX improves security, convenience, and IT efficiency. Using OpenID Connect with securely stored credentials and correctly configured claims provides a standards-based authentication flow that supports enterprise identity policies.