Okta Access Gateway Oracle E-Business Suite Login Fails with an Invalid SessionID Found Error

An Okta Access Gateway (OAG) Oracle E-Business Suite (EBS) application login fails when the EBS session cookie shares the same name across multiple EBS instances on the same domain. Administrators must verify that the service name is unique across all OAG EBS application database connection files and check the session cookie name in the EBS database.

When attempting to log in to a second OAG EBS application, Okta generates the following error messages:

EBS Access Service is Not Available and Invalid sessionId found

Okta generates the following error message in the logs:

ACCESS_GATEWAY EBS_SSOAGENT handleExceptions
      java.lang.IllegalArgumentException Invalid sessionId found
      at oracle.apps.fnd.util.PreCondition.assertTrue(PreCondition.java:68)
      at oracle.apps.fnd.util.PreCondition.assertTrue(PreCondition.java:53)
      at oracle.apps.fnd.ext.common.AppsSession.getAppsSessionStatus(AppsSession.java:468)
      at oracle.apps.fnd.ext.common.AppsSession.getAppsSessionStatus(AppsSession.java:460)
      at oracle.apps.fnd.ext.common.AppsRequestWrapper.getICXCookieStatus(AppsRequestWrapper.java:536)
      at oracle.apps.fnd.ext.common.AppsRequestWrapper.getAppsSession(AppsRequestWrapper.java:553)
      at oracle.apps.fnd.ext.common.AppsRequestWrapper.<init>(AppsRequestWrapper.java:196)
      at org.codehaus.groovy.vmplugin.v8.IndyInterface.fromCache(IndyInterface.java:321)
      at com.icsynergy.ebs.web.EBSAppSessionController.getEbsSessionInfo(EBSAppSessionController.groovy:219)

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)
• Oracle E-Business Suite (EBS)

The EBS session cookie shares the same name across multiple EBS instances that reside on the same domain, even if they operate behind different OAG instances. Because the cookie scope resides at the domain level, the browser attempts to reuse the same cookie in the second session, which results in the invalid session ID error.

The OAG documentation states that the SERVICE_NAME value in the database connection (DBC) file becomes the cookie name for the EBS application, which requires a unique value across OAG EBS applications. This behavior assumes that the SESSION_COOKIE_NAME value in the EBS database contains a NULL value. If the database contains a specific value, such as ICX_SESSION_ID, Okta uses that value instead, and it appears in the browser cookie store.

What steps verify the Oracle E-Business Suite session cookie name?

Verify the service name uniqueness and inspect the browser cookies to confirm the session cookie name matches the service name.

1. Verify that the SERVICE_NAME value contains a unique string across all OAG EBS application DBC files.
2. Check the cookies in the browser developer tools Application tab to verify whether the browser reuses the cookie in the second application and whether the name matches the SERVICE_NAME value.

NOTE: The EBS session cookie value typically contains 27 alphanumeric characters. Other expected EBS cookies have the names EBSAuthCookie, JSESSIONID, and oracle.uix.

Update the session cookie name in the database.

Check the session cookie name value in the database parameters table and update it to a unique value or change it to NULL.

1. Check the value of the SESSION_COOKIE_NAME in the ICX_PARAMETERS table by executing the following command.
   

   select SESSION_COOKIE_NAME from ICX_PARAMETERS;

2. If the command returns a value, update the value to make it unique or change it to NULL to use the SERVICE_NAME value from the DBC file.
3. Upgrade OAG to version 2023.7.2 or later to receive unrelated improvements in session handling.