Oracle HCM Fusion as a web services - OAuth2.0 connection issue

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

We are integrating Oracle HCM Fusion as web services connector, we are changing the authentication type to OAuth2.0 client credentials grant type.

We are encountring this error :
Exception occurred in Test Connection. Error: Exception occurred while generating access token: Unable to generate access token.

The above exception is generated in Sailpoint for OAuth token call towards Fusion Cloud HCM, even though it’s successful in Postman.

We tried to configure the OAuth authentication as custom authentication but we are still getting errors .

access token url: https://idcs-1.identity.oraclecloud.com/oauth2/v1/token
client_id: ************
client secret: ***********
grant_type: client_credentials
scope: https://* customer:all/

2

Hello Safae,

The ISC Test Connection error looks like the generic Web Services connector wrapper around the OAuth token call. The important part is the actual Oracle IDCS/Fusion response, such as invalid_scope, invalid_client, or unauthorized_client.

Capture the exact token response from the connector debug logs first. That will tell you whether this is a scope issue, client credential issue, or client authentication format issue.

3

Hello Harish

When we switched to custom authentication, we 've got this error :

{“level”:“ERROR”,“AppType”:“Web Services SaaS”,“timestamp”:“2026-05-11T12:21:44.999Z”,“err”:{“type”:“ConnectorError”,“message”:"Error: Error: HttpClientWrapper.ts Response status :415 doesn’t match to allowed success codes : 2**,2**,2** \n response : : HttpClientWrapper.ts Response status :415 doesn’t match to allowed success codes : 2**,2**,2** \n response : ",“stack”:"ConnectorError: Error\n at convertToConnectorError… (/app/webpack:/saas-conn-webservices/src/connectors/webservice-handlers.ts:35:1…\ncaused by: WebServicesSdkException: Error\n at CustomAuthenticationProvider.authenticate (/app/webpack:/saas-conn-webservices/src/sdk/auth/custom-authentication-provider.ts:34:1)\n at process.token

It seems like content format is not supported but we have tried many content-type values and it’s still failing.

4

Thanks, this 415 error is a useful clue. In HTTP, 415 is “Unsupported Media Type”. It means the server is refusing the request because the content is in a format not supported by that endpoint. Ref: 415 Unsupported Media Type

image
image1580×292 38.2 KB

For Oracle IDCS /oauth2/v1/token, Oracle’s client credentials example uses:

Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Authorization: Basic <base64(client_id:client_secret)>

with body:

grant_type=client_credentials&scope=<scope value>

Ref: Oracle IDCS Token API - Client Credentials Grant Type

So I would check that the Custom Authentication operation is actually sending the body as form-urlencoded key/value data, not JSON/raw body with only the Content-Type header changed.

That said, since this is a standard OAuth2 Client Credentials flow, I would prefer using Authentication Type = OAuth 2.0 and Grant Type = Client Credentials in the Web Services source, unless custom authentication is needed for another reason.

SailPoint’s Web Services OAuth2 Client Credentials configuration supports OAuth request parameters and includes the Basic Authorization header by default unless excluded. Ref: SailPoint Web Services - OAuth2 Client Credentials

If OAuth2 mode still fails with “Unable to generate access token,” the connector/debug log should show the real Oracle OAuth error, such as invalid_scope or invalid_client. I would also validate the exact scope value against what is configured in Oracle.

5

The 415 clue is key. Adding a few more specifics to help narrow it down faster.

The core issue with Custom Auth in Web Services for Oracle IDCS: The Web Services connector’s Custom Authentication operation needs to be configured precisely for Oracle’s token endpoint. Specifically:

Header:

Content-Type: application/x-www-form-urlencoded
Authorization: Basic <base64(clientId:clientSecret)>

Body must be form-urlencoded key-value pairs, not JSON:

grant_type=client_credentials
scope=<your_oracle_scope>

If the connector is sending the body as raw/JSON with just the Content-Type header changed, Oracle will still reject it with 415 — the actual payload format must match.

Strongly recommend switching to native OAuth 2.0 mode instead: Go to Web Services source → Authentication → OAuth 2.0 → Client Credentials. This handles the form-urlencoded body and Basic auth header automatically and is far less error-prone than Custom Auth.

If OAuth 2.0 mode still fails with “Unable to generate access token”: Check these in order:

  1. Scope value — Oracle IDCS scopes are case-sensitive and tenant-specific. Validate the exact scope string in your Oracle IDCS application config.

  2. Token URL — Should be https://<your-idcs-tenant>.identity.oraclecloud.com/oauth2/v1/token

  3. Client credentials — Confirm Client ID and Secret are from the IDCS Confidential Application, not Oracle HCM directly.

  4. Enable debug logging on the connector — the raw Oracle OAuth error (invalid_scope, invalid_client, etc.) will appear there and pinpoint the exact failure.

We’ve successfully connected Oracle Fusion HCM via this pattern — once the token endpoint, scope, and content-type are aligned, Test Connection passes cleanly.

Thanks,

@SivaLankapalli