Creating a Custom OAuth Application

Oracle Fusion Cloud HCM Cloud uses the OAuth authentication standard, which requires the authenticating user to interact with Oracle Fusion Cloud HCM Cloud via the browser. The provider facilitates the OAuth exchange in various ways, as described in "Connecting to Oracle Fusion Cloud HCM Cloud".

To create an app linked to your Oracle Fusion Cloud HCM Cloud account: Follow the procedure below to obtain the OAuthClientId and OAuthClientSecret connection properties.

1. Log in to the Oracle Cloud Infrastructure Console and navigate to Identity & Security > Domains.
2. Select the domain associated with your Oracle Fusion Cloud HCM Cloud instance.
3. In the left menu, click Applications, then click Add Application.
4. Select Confidential Application and click Launch workflow.
5. Enter a name and optional description for your application, then click Next.
6. Under Client configuration, select Configure this application as a client now. This step is applicable when AuthScheme is set to OAuthClient.
7. Under Allowed grant types, select Resource owner (required for OAuthClientId/OAuthClientSecret authentication) and Client credentials (for service account authentication).
8. Under Token issuance policy, click Add scope to configure the scopes your application requires access to. At a minimum, add the scopes for the Oracle Fusion Cloud HCM Cloud REST API resources you intend to access (for example, urn:opc:resource:faaas:fa:<instance-id>).
9. Set the CallbackURL:
   • For desktop applications and headless machines, use http://localhost:33333 or another port number of your choice. When you connect, you must set the CallbackURL to this exact value.
   • For web applications, set the callback URL to a trusted redirect URL. This is the location the user returns to with the token that verifies that your application access has been granted.
10. Click Next, configure resource access as needed for your Oracle Fusion Cloud HCM Cloud instance, then click Finish.
11. Once the application is created, click Activate to enable it.
12. Under the General Information tab, note the Client ID (OAuthClientId) and Client Secret (OAuthClientSecret) values.

Additional Steps for OAuthClient Authentication

When AuthScheme is set to OAuthClient, you must also create a corresponding user in Oracle Fusion Cloud HCM Cloud and assign the appropriate roles to it.

1. In your Oracle Fusion Cloud HCM Cloud instance, navigate to Tools > Security Console > Users.
2. Create a new user with the username set to exactly your OAuth Client ID (OAuthClientId).
3. Assign the appropriate roles to the user based on the resources your application needs to access.