Your users sign in once — through the identity provider you already own, with whatever MFA policy you already enforce — and land directly in JDE. No new infrastructure. No months-long project. No surprises on the invoice.
Why XpreSSO®
Eliminate shared JDE passwords. Enforce MFA on JDE access through the same 2FA policy your users already follow for email and other apps — at no extra cost and with no changes to JDE itself. Close a common audit finding and cut help-desk calls on forgotten credentials.
Connects to the identity provider you already run. Typical deployments go live the same day. Subscription licensing means no capital approval cycles.
No reverse proxy means no extra network hop, no additional TLS termination, and no new component that can take JDE authentication down with it. Authentication traffic stays on the shortest path; JDE keeps working even if the XpreSSO® host is momentarily unavailable.
✓What it is: a modern, right-sized SSO gateway for Oracle JD Edwards. ✗What it isn't: a bulky platform that rewires your network or becomes a single point of failure.
Identity provider support
XpreSSO® speaks both SAML2 and OIDC/PKCE natively, so it connects to virtually any enterprise identity provider — with no custom connectors, no additional licences, and no professional services engagement from the IdP vendor.
Multiple IdPs per deployment supported. Per-environment overrides available for complex enterprise topologies.
For architects & IT managers
XpreSSO® is built on the current best-practice federation flows — not older patterns with known weaknesses. The points below matter when your security team or auditor asks the right questions.
HTTP-Redirect AuthnRequest and
HTTP-POST assertion delivery. AuthnRequests include
Destination, ProtocolBinding, and
NameIDPolicy attributes — required by strict IdPs
such as Oracle IDCS and some Entra configurations.
Assertion signatures are verified against the IdP's published
X.509 signing certificate, with automatic cert-rotation detection
and refresh. Full XML C14N, digest, and RSA-SHA256/512 signature
validation. Multi-tenant deployments are supported:
foreign tenants are held in an admin-controlled approval list,
visible immediately after approval with no service restart.
client_secret
(use the Mobile and Desktop Application registration type
in Entra). The id_token is validated against the
IdP's JWKS, with keys cached in the local configuration file and
refreshed automatically on rotation. Supports all standard user
identifier claims: upn, preferred_username,
email, and sub.
[TENANTS] approval list supports foreign-tenant
SSO in multi-company Shared Service Centre deployments, with
tenant enable/disable effective on the next authentication
attempt (no service restart needed).
/sso) and the assertion
consumer / OIDC callback (/saml and
/oauth). Configuration is a single INI file;
sensitive values (PEM passphrases, secrets) are stored
encrypted. Thread-safe, mutex-protected INI writes prevent
configuration corruption under concurrent load.
What you get
Security posture
XpreSSO® was designed from the ground up around current standards and best practices — not retrofitted onto an older architecture. Every authentication event is logged. Every sensitive configuration value is encrypted at rest.
Brief your CISO →PKCE code flow and SAML HTTP-POST bindings keep tokens and assertions off the URL bar and out of browser history — a material difference from older implicit OAuth flows.
PKCE code verifiers are generated using RtlGenRandom (Windows CNG) and stored server-side per session. Replay and CSRF attacks are structurally prevented.
SAML assertions are verified against the IdP's X.509 signing certificate on every login. When the IdP rotates its signing certificate — a routine event that silently breaks other SSO implementations — XpreSSO® detects the change, fetches the new certificate, and retries the assertion in the same request. Users see no interruption; admins need take no action.
A reverse proxy that handles all authentication becomes a critical dependency: if it slows, JDE slows; if it fails, nobody logs in. XpreSSO® avoids this by design. Authentication traffic takes the shortest path and there is no additional component to patch, monitor, or keep highly available.
Pricing
XpreSSO® was deliberately designed to undercut the pricing of every competing JDE SSO solution — including well-known reverse-proxy-based alternatives — while delivering a more capable and more resilient result. Priced per deployment on an annual subscription sized to your user count, with updates and support included. No capital outlay. No separate maintenance contract. No surprise line items. Most customers recover the cost in reduced help-desk load within the first quarter.
Request a quote — indicate your user count