The Passwordless Playbook, Part 2: Wire OIC’s FTP Adapter for SSH Key Authentication

A shared password on a scheduled integration is a ticking clock — someone will rotate it, forget to update the connection, and break the batch job at the worst possible moment. SSH key authentication removes the clock entirely.

Enterprise file-transfer integrations are moving away from password-based logins for a simple reason: passwords don’t survive contact with automation. Rotation policies break unattended jobs, shared secrets get copy-pasted into one too many places, and every managed SFTP provider now expects key-based auth as the default, not the exception.

This guide walks the complete outbound flow: generating an SSH key pair on Windows with PuTTYgen, registering the public key on the target SFTP server, and configuring Oracle Integration’s FTP Adapter to authenticate every connection with the private key — no password, no shared secret, no 2 a.m. rotation fire drill.

This guide covers:

• 1. Why SSH key authentication is the default choice for automated file transfer

• 2. How the public/private key handshake actually works

• 3. Generating and exporting the right key format in PuTTYgen (the #1 cause of failed OIC connections lives here)

• 4. Registering the key on the server and wiring the FTP Adapter’s Public Key Authentication policy

• 5. The troubleshooting fixes for the five most common failure points

Companion post: Part 1 — Lock Down Your OIC File Server with SSH Key Authentication covers the reverse direction, where OIC is the SFTP host.

Why SSH Key Authentication?

• 1. No passwords on the wire. Authentication is proven with a cryptographic signature, not a shared secret — nothing to sniff, nothing to brute-force.

• 2. Built for automation. Keys live in files, so scheduled OIC integrations run unattended without a human re-entering a password.

• 3. Rotation-resilient. Server-side password-expiry policies no longer have the power to break your integrations overnight.

• 4. Auditable and revocable. Each key ties to a specific service account and can be revoked independently, without resetting anyone else’s access.

How It Works

Public-key authentication uses a mathematically linked key pair. OIC holds the private key (kept secret); the SFTP server holds the matching public key in the user’s authorized_keys file. OIC proves its identity by signing a server challenge — the private key itself never leaves OIC.

What You’ll Need

• 1. A Windows machine with PuTTY / PuTTYgen installed (bundled in the PuTTY MSI installer).

• 2. Access to the target SFTP server (or its administrator) to place the public key in the account’s ~/.ssh/authorized_keys file.

• 3. An OIC user with permission to create and test Connections.

• 4. The SFTP host address, port (usually 22), and the username for the service account.

• Part 1 - Generate SSH Keys with PuTTYgen (Windows)

•  

  PuTTYgen creates the key pair. The single most important thing to get right is the private-key format you export for OIC — that’s Step 1.6, and it’s the step most failed connections trace back to.

  1.1 Choose the key type. Open PuTTYgen (Start → PuTTY → PuTTYgen). Set Type of key to generate to RSA and Number of bits to 2048 (or 4096 for stronger keys) — RSA gives the widest compatibility across OIC and SFTP servers.

  

  PuTTYgen with RSA/4096 selected, ready to generate.

  1.2 Generate the key pair. Click Generate, then move the mouse randomly over the blank area — that movement seeds the randomness used to build the key.

• 

  Moving the mouse to generate the key pair.

  1.3 Add a passphrase (recommended). Enter and confirm a Key passphrase to encrypt the private key at rest; you’ll supply the same passphrase in the OIC connection. Leave it blank only if your security policy allows an unprotected key.

•   

Generated key showing the public key text and passphrase fields.

1.4 Save the public key for safekeeping (e.g. oic_sftp.pub) — note this file is in PuTTY’s native SSH-2 format, so for most SFTP servers you’ll actually paste the OpenSSH text from Step 1.7 instead.

1.5 Save the private key (.ppk) as your master backup. OIC can’t use .ppk directly — the next step produces the file OIC actually needs.

1.6 Export the private key in OpenSSH format for OIC. From the menu, choose Conversions → Export OpenSSH key and save it (e.g. oic_sftp_openssh.key). This produces a classic PEM-style file beginning -----BEGIN RSA PRIVATE KEY----- — the file you upload to OIC.

Conversions → Export OpenSSH key (use the classic option).

The #1 cause of failed OIC SFTP connections. Do not use “Export OpenSSH key (force new file format).” That writes the newer OpenSSH container (-----BEGIN OPENSSH PRIVATE KEY-----), which the OIC FTP Adapter often rejects. Always export the classic “Export OpenSSH key” option, so the header reads -----BEGIN RSA PRIVATE KEY-----.

1.7 Copy the public key text for the server. In PuTTYgen, copy the block labeled Public key for pasting into OpenSSH authorized_keys file — a single line starting ssh-rsa AAAA.... This text, not the saved .pub file, is what goes on the SFTP server.

The OpenSSH authorized_keys public key text, ready to copy.

Part 2 - Register the Public Key on the SFTP Server

Hand the public key from Step 1.7 to the SFTP server administrator, or add it yourself if you have shell access. It goes into the service account’s authorized_keys file:

# On the SFTP server, as the SFTP service account
mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "ssh-rsa AAAAB3Nza...your-public-key... comment" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Public key appended to the SFTP account’s authorized_keys file.

Permissions matter. SSH silently refuses keys when permissions are too open. Keep .ssh at 700 and authorized_keys at 600, both owned by the SFTP user. On a managed SFTP service, upload the public key through its console instead.

Part 3 - Configure the FTP Connection in OIC

3.1 Create a new FTP Adapter connection. In OIC, go to Design → Connections (Integrations → Connections in Gen 3), click Create, and select the FTP Adapter. Name it, set Role to Invoke (or Trigger + Invoke if needed), and click Create.

Creating a connection from the FTP Adapter.

3.2 Set the connection properties. In Properties, enter the server details and enable SFTP:

Host, port, and SFTP Connection = Yes.

3.3 Choose the Public Key Authentication security policy. In Security, set Security Policy to FTP Public Key Authentication, then complete:

• 1. Username — the SFTP service account.
• 2. Private Key — upload the OpenSSH file exported in Step 1.6 (the -----BEGIN RSA PRIVATE KEY----- one).
• 3. Private Key Passphrase — the passphrase from Step 1.3 (leave blank if none was set).

Use FTP Multi-Level Authentication only if the server requires both a password and a key.

FTP Public Key Authentication with the private key uploaded.

3.4 Attach an agent group if the server is private. If the SFTP server sits behind a firewall, attach the appropriate Connectivity Agent group under Access Type. Public-internet servers need no agent.

3.5 Save and test. Click Test. A successful result confirms the connection, then Save. If it fails, use Diagnose & Test to check network reachability — it can take several minutes and can’t be cancelled once started.

Connection tested successfully in OIC.

Troubleshooting Common Issues

Key Takeaways

• 1. Generate RSA keys in PuTTYgen; always export the private key with the classic “Export OpenSSH key” option for OIC.

• 2. Put the OpenSSH authorized_keys text (not the saved .pub file) on the server, with strict file permissions.

• 3. In OIC, use the FTP Public Key Authentication policy — username, private key, optional passphrase — and always Test before saving.

• 4. Once configured, the connection is reusable across every integration that reads from or writes to that SFTP server. No passwords to rotate, no manual intervention.

Ready to take passwords out of every scheduled file transfer? Book a free OIC Security & Integration Readiness Consultation with Mastek’s Oracle Integration experts.