If you have systems integrating with Oracle Fusion, there’s an important change on the horizon.
Oracle is deprecating password-based authentication for affected Fusion REST and SOAP services. Customers need to identify affected integrations and migrate them to a supported token-based authentication method before 31 March 2027.
On the face of it, that sounds like a fairly technical change. But I think the most important question for Fusion customers right now is actually much simpler: Do you know which of your integrations are affected?
What is Oracle changing?
Integrations allow other systems, applications and automated processes to connect with Oracle Fusion and exchange information.
Some of those connections authenticate using a username and password. Oracle is moving affected REST and SOAP integrations away from this approach and requiring them to use a supported token-based authentication method instead.
The change will affect REST requests using HTTP Basic Authentication, as well as SOAP requests that authenticate using a username and password, such as BI Publisher SOAP services.
Oracle has given customers a deadline of 31 March 2027 to complete the migration.
Why is Oracle making the change?
Oracle describes the change as part of strengthening the security of customer integrations.
In simple terms, it’s a change in how one system proves its identity when connecting to Fusion. Instead of relying on credentials based around a username and password, affected integrations will need to use a supported token-based authentication method.
For customers, however, the significant question isn’t just why Oracle is making the change.
It’s where password-based authentication is still being used today.
Which Oracle Fusion customers could be affected?
This is an important distinction because it’s easy to assume that this is specifically an Oracle Integration Cloud (OIC) issue.
It isn’t.
Oracle says you may be affected if you have custom integrations, scripts, scheduled jobs, agents, applications or third-party tools connecting to Fusion using the affected password-based authentication methods.
Depending on your integration landscape, that could include platforms such as OIC, SnapLogic, GlassFish, Boomi, JustTransform or a custom-built integration. The key factor is whether the integration is using Basic Authentication to connect to Fusion
So I wouldn’t start by asking:
“Are we using OIC?”
I’d start with:
“What is connected to Fusion, and how are those connections authenticating today?”
What happens if an affected integration isn’t changed?
This is the part of Oracle’s announcement that customers shouldn’t overlook.
Oracle says that once enforcement begins, integrations that continue to use password-based authentication may no longer authenticate successfully. REST or SOAP requests may not complete, potentially interrupting integration flows or scheduled processing.
Put more simply, an affected integration that works today could stop connecting successfully once Oracle enforces the change.
The impact of that will vary depending on what each integration is doing and which business processes rely on it.
My advice: don’t leave the question unanswered
You may find that you have very little to do. You may find that there’s more work involved than expected.
Either way, with a fixed deadline of 31 March 2027, I’d want to know.
If you’re unsure whether your Fusion integrations are affected, get in touch with the Namos team. We can help you through the whole process, from identifying connections that still use a username and password to updating them to meet Oracle’s new requirements.
Namos. With you for every step of your journey.
