Configure a Cantara Environment for JD Edwards EnterpriseOne Authentication

Overview

Use this guide to configure a Cantara environment and define how authenticated users connect to JD Edwards EnterpriseOne (JDE). As part of that flow, select the Security Provider used for the environment, complete any provider-specific settings, then configure the JDE authentication method and access settings required for the environment.

Before you begin

Confirm the following details are available before you start:

Identity Provider (IdP) access: You have the required access or information to complete the configuration for your selected Security Provider, such as OAuth 2.0 or SAML.
JDE Environment details: You have the required JDE environment information.
Authentication strategy: Decide how users should access JDE after they sign in. Choose whether users will use a shared service account, their own individual JDE accounts, or a mixed setup where Cantara falls back to a service account when an individual username is not available.

Procedure

To configure an environment:

In Cantara, navigate to Environments.
Click + Add Environment.

Complete the following required fields:

Field Name	Description
Name	Unique name for the environment.
Security Provider	Select the authentication provider used for this environment, such as OAuth 2.0 or SAML.
Description (optional)	Add a description for the environment.
Component Version (optional)	Specify the component version.
Email From Address (optional)	Set the default sender email address for notifications.
Time Zone	Set to the time zone where the JDE servers are hosted.
Default Date Format	Select the date format used by the environment.
BSFN Access Method	Select the access method used for Business Function calls in this environment.
Data Access Method	Select the access method used for data requests in this environment.
Report Access Method	Select the access method used for report requests in this environment.
JDE Authentication	Select JWT for Single Sign-On (SSO) via OAuth 2.0 or SAML. T For other security providers, select the authentication method required by your specific environment.
Token Timeout (seconds) (optional)	The duration in seconds before the token expires. Default is 3,600 (1 hour).
Long Usernames	Enable this unless the environment does not support long usernames.
JDE Environment Name	Enter the JDE environment name.

JWT Authentication

Complete the following fields:

Field Name	Description
Node Name	JDE node name created during setup.
Node Password	Password for the node.
Certificate Name	Select the certificate used for secure communication.

Security Provider Setup

For specific configuration steps, see the appropriate guide:

OAuth 2.0: See the Configure OAuth 2.0
SAML: See Configure SAML

Service Account

Use the Service Account section to define how Cantara authenticates users into JDE after they successfully sign in through the IdP.

Field	Description
Default Username	The JDE username for the shared service account. Use this when all users connect to JDE through the same service account. Enter a valid JDE service account user ID or long username, if enabled.
Default Password	The password for the default JDE service account. Note: Only required if JDE Authentication is set to Password. This field is not used for JWT/SSO configurations.
Username Claim	The name of the Identity Provider claim that contains the JDE username, for example `preferred_username` or a custom claim such as `jde_username`. Cantara reads the value in this claim to log the user in. Leave blank to use the Default Username for everyone.
Address Book Number Claim	JDE address book number for the logged-in user. Supports traceability when using a shared service account.

Note: For one-to-one mapping, leave the Service Account fields blank. Cantara uses the standard Security Provider configuration, such as the OAuth 2.0 Username Attribute, to map the signed-in user to their JDE account. The Username Attribute is typically set to email or preferred_username.

Service Account Configuration Scenarios

Scenario 1: Shared Service Account

Use this when you want all users to log in to JDE using a single, shared service account.

Field	Configuration
Default Username	Enter the JDE service account username.
Default Password	Leave blank when JDE Authentication is set to JWT. Enter the service account password only when JDE Authentication is set to Password.
Username Claim	Leave blank. Cantara will ignore individual username claims and use the default username for everyone.
Address Book Number Claim	Optional. Enter a claim such as `employee_id` to maintain individual traceability. If left blank defaults to the address book number of the service account.

Result:

Every user who signs in via SSO is logged in to JDE as the shared service account.

Scenario 2: Shared Service Account by Group

Use this when every user has their own unique JDE account that matches, or can be mapped from, their Identity Provider.

Field	Configuration
Default Username	Leave blank.
Default Password	Leave blank.
Username Claim	Enter the claim name that contains the JDE username, for example `jde_username`.
Address Book Number Claim	Optional. Enter the claim containing the user's JDE Address Book number if required for traceability. If left blank defaults to the address book number of the user returned from the user claim.

Result:

Cantara logs each user in to JDE using the unique username returned by the Identity Provider claim.

Scenario 3: Mixed Mode (Fallback)

Use this when some users have unique JDE accounts, but others should fall back to a shared service account.

Field	Configuration
Default Username	Enter the shared JDE username.
Default Password	Leave blank when JDE Authentication is set to JWT. Enter the service account password only when JDE Authentication is set to Password.
Username Claim	Enter the claim name that contains the JDE username, for example `preferred_username` or a custom claim such as `jde_username`.
Address Book Number Claim	Optional. Enter the claim containing the user's JDE Address Book number if you need individual traceability, including when users fall back to the shared account.

Result:

Cantara first looks for a unique username in the configured claim. If the claim is missing or empty for a user, Cantara logs that user in using the fallback shared JDE username.

How it works

Authentication: The user authenticates through the Identity Provider, and Cantara reads the configured username, display name, and address book number claims.
Trust establishment: Cantara uses the configured JDE SSO certificate and node details to establish trust with the AIS server.
Token exchange: The AIS server validates the certificate-based trust request and returns a trusted token.
JDE login: Cantara uses the trusted token to create the JDE session. To determine the JDE username, Cantara first checks the configured Username Claim. If that claim does not return a valid value, Cantara uses the Default Username. If no default username is provided, Cantara falls back to the Username Attribute from the Security Provider.
Traceability: The Address Book Number Claim can be used to associate activity with the signed-in user, even when a shared service account is used.