Step 18: Setting Up for Electronic Signatures

Notifications can require that a user's response be signed by a password-based signature or a certificate-based digital signature. Perform the following setup steps to enable users to provide these signatures.

For more information, see: #WF_SIG_POLICY Attribute and Reviewing Electronic Signature Details.

arrow icon   Implementing Password-based Signatures with Single Sign-On:

Oracle Workflow supports password-based signatures for notifications based on Oracle Application Object Library (FND) passwords. If you maintain your directory service based on Oracle Application Object Library users and passwords, no additional setup is required. However, if you have implemented single sign-on functionality for your site through Oracle Directory Services, and you want to use password-based signatures, you must perform the following steps.

  1. Set the Applications SSO Login Types profile option to either Local or Both at user level for all users who need to enter password-based signatures.

  2. Ensure that these users have valid passwords defined in Oracle Application Object Library. See: Users Window.

    For more information, see: Overview of Single Sign-On Integration, Oracle E-Business Suite Security Guide.

arrow icon   Loading Certificates for Digital Signatures:

If a notification requires a certificate-based digital signature, the user must sign the response with a valid X.509 certificate issued by a certificate authority. Before users can sign responses with their certificates, you must load these certificates into your Oracle E-Business Suite database using the Workflow Certificate Loader.

When you load a certificate, you must also specify the Oracle E-Business Suite user to whom that certificate is assigned. Oracle Workflow uses this information to validate that the user attempting to sign with a certain certificate is the same user to whom that certificate is assigned.

A user can have more than one certificate assigned to him or her. However, each certificate can only be assigned to one user. Additionally, after you have loaded a certificate for a user, you cannot delete it from the database or assign it to a different user. If a certificate is incorrectly assigned, the user to whom it belongs must revoke it and obtain a new certificate instead.

You can load several certificates at once by listing the information for all the certificates in a data file for the loader. You can also load a single certificate by specifying the certificate information in the command line for the loader.

Note: If your users access Oracle E-Business Suite with Microsoft Internet Explorer, ensure that you also set the Browser Signing DLL Location global preference in the Workflow Configuration page. See: To Set Global Preferences for Oracle Workflow.

  1. For each certificate, obtain the following information:

    Note: You only need to load the root certificate for a particular certificate authority, and the intermediate certificates for a particular type of certificate, once. If you already loaded the root and intermediate certificates required for a new personal certificate, you can simply load the personal certificate without reloading the others.

  2. If you want to load several certificates at once, create a data file for the Workflow Certificate Loader that specifies the location of the certificates to be loaded and the users to whom they belong. The data file should be a text file containing one entry for each root, intermediate, or personal certificate to be loaded.

    All certificate entries in the file must appear in the order of the certification path, beginning with the root certificate for the certificate authority, followed by any intermediate certificates and then by the personal certificate. However, if the root or intermediate certificates required for a particular personal certificate were loaded previously, you do not need to reload them.

    Each certificate entry must be a single line. For a root or intermediate certificate, use the following format: 

    user=CA; domain=CA; filename=<certificate_file>; crl_url=<URL>

    where <certificate_file> is the full path and file name specifying the location of the certificate file, and <URL> is the location from which the corresponding Certificate Revocation List (CRL) can be downloaded.

    For a personal certificate, use the following format:

    user=<user_name>; domain=U; filename=<certificate_file>

    where <user_name> is the Oracle E-Business Suite user name of the user to whom the certificate belongs, and <certificate_file> is the full path and file name specifying the location of the certificate file.

    You can also include comments in the data file. Start each comment line with a number sign (#).

    The following example shows a sample data file. Note that although the lines may appear to wrap in this document, each certificate entry is a single line in the data file.

    #Root certificate for certificate authority myCA
user=CA; domain=CA; filename=/certs/myCA.cer; 
crl_url=http://example.com/myCA.crl
#
#Personal certificate for user BLEWIS
user=BLEWIS; domain=U; filename=/certs/blewis.cer

  3. To load several certificates at once using a data file, run the Workflow Certificate Loader with the following command:

    java oracle.apps.fnd.wf.DigitalSignature.loader.CertificateLoader 
[-v] <user_name> <password> <connect_string> <data_file>

    You can optionally specify the -v option to run the Workflow Certificate Loader in verbose mode, displaying additional diagnostic information in the output.

    Replace the variables with your parameters as follows:

    For example:

    java oracle.apps.fnd.wf.DigitalSignature.loader.CertificateLoader 
-v apps <password> myserv:4105:mySID myCertData.txt

  4. To load a single certificate without using a data file, run the Workflow Certificate Loader specifying the certificate information in the command line. For a root or intermediate certificate, use the following command:

    java oracle.apps.fnd.wf.DigitalSignature.loader.CertificateLoader 
[-v] -s <user_name> <password> <connect_string> user=CA 
domain=CA filename=<certificate_file> crl_url=<URL>

    For a personal certificate, use the following command:

    java oracle.apps.fnd.wf.DigitalSignature.loader.CertificateLoader 
[-v] -s <user_name> <password> <connect_string> user=<user_name> 
domain=U filename=<certificate_file>

    You can optionally specify the -v option to run the Workflow Certificate Loader in verbose mode, displaying additional diagnostic information in the output.

    Replace the variables with your parameters as follows:

    For example:

    java oracle.apps.fnd.wf.DigitalSignature.loader.CertificateLoader 
-s apps <password> myserv:4105:mySID user=BLEWIS domain=U 
filename=/certs/blewis.cer

    Note: You can display a help message describing the usage of the Workflow Certificate Loader by specifying the -h option with the following command:

    java oracle.apps.fnd.wf.DigitalSignature.loader.CertificateLoader -h

    Troubleshooting the Workflow Certificate Loader

    The following list shows Workflow Certificate Loader error messages and suggested steps to resolve them.