Attempt to log in to a second Okta Access Gateway(OAG), the Oracle E-Business Suite (EBS) application fails with the following error message: 

 EBS Access Service is Not Available" and "Invalid sessionId found

Error message in logs:

ACCESS_GATEWAY EBS_SSOAGENT handleExceptions
      java.lang.IllegalArgumentException Invalid sessionId found
      at oracle.apps.fnd.util.PreCondition.assertTrue(PreCondition.java:68)
      at oracle.apps.fnd.util.PreCondition.assertTrue(PreCondition.java:53)
      at oracle.apps.fnd.ext.common.AppsSession.getAppsSessionStatus(AppsSession.java:468)
      at oracle.apps.fnd.ext.common.AppsSession.getAppsSessionStatus(AppsSession.java:460)
      at oracle.apps.fnd.ext.common.AppsRequestWrapper.getICXCookieStatus(AppsRequestWrapper.java:536)
      at oracle.apps.fnd.ext.common.AppsRequestWrapper.getAppsSession(AppsRequestWrapper.java:553)
      at oracle.apps.fnd.ext.common.AppsRequestWrapper.<init>(AppsRequestWrapper.java:196)
      at org.codehaus.groovy.vmplugin.v8.IndyInterface.fromCache(IndyInterface.java:321)
      at com.icsynergy.ebs.web.EBSAppSessionController.getEbsSessionInfo(EBSAppSessionController.groovy:219)

• Okta Access Gateway (OAG)
• Oracle E-Business Suite (EBS)

This happens when the EBS session cookie has the same name across multiple EBS instances that have the same domain (even if they are behind different OAGs).  Because the cookie scope is Domain, the browser will attempt to reuse the same cookie in the second session, resulting in the invalid sessionId found error.

OAG documentation states that the SERVICE_NAME value in the DBC file becomes the cookie name for the EBS app, so this must be unique across OAG EBS applications. This should be verified.

However, this assumes that the SESSION_COOKIE_NAME value in the EBS database is NULL.  If this is set to a value (for example, ICX_SESSION_ID), that value will be used instead and can be seen in the browser's cookie store.

1. Verify that the SERVICE_NAME value is unique across all OAG EBS app DBC files.
2. Check the cookies in the browser's dev tools Application tab to verify whether it is reused in the second app and whether the name matches the SERVICE_NAME value.

NOTE: The EBS session cookie value is typically 27 characters long and alphanumeric. Other expected EBS cookies have names EBSAuthCookie, JSESSIONID, and oracle.uix.

3. The EBS DB admin should check the value of the SESSION_COOKIE_NAME in the ICX_PARAMETERS table. If this is set to a value, it will be returned in the output, and it should either be made unique or set to NULL to use the SERVICE_NAME value from the DBC file.

   select SESSION_COOKIE_NAME from ICX_PARAMETERS;

4. If the OAG version is below 2023.7.2, plan to upgrade OAG for unrelated improvements in session handling.