Connecting SailPoint and Oracle E-Business Suite

To connect SailPoint with Oracle E-Business Suite, perform the following tasks:

Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

To configure a new source:

1. Sign in to SailPoint.
2. Go to Admin > Connections > Sources.
3. Select Create New.
4. Search for the connector by entering the name in the search box, and then select Configure.
5. In the Source Name field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the Description field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the Source Owner field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to Assigning a Source Owner.

8. Under Connection Type, select Direct Connection or Flat File.

   • Direct Connection - A direct connection fetches data from the Virtual Appliance Cluster you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the Virtual Appliance Reference Guide.
   • Flat File - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.

9. If you selected Direct Connection, in Virtual Appliance Cluster, select the virtual appliance cluster that will be used as the application connector for the source.

10. (Optional) Select a governance group to grant its members source or role sub-admin level oversight of the source and its access. For more information, refer to Creating and Managing Governance Groups.
11. If this source represents a primary system containing your organization's personnel records, select the Authoritative Source checkbox. For more information, refer to Creating Identity Profiles.
12. Select Continue. The source is created, and you are navigated to the Source Setup > Base Configuration page. Continue to configure your connected source there.

Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.

2. In the Source Owner dropdown list, select the identity that owns this source.

   • To find a source owner, begin entering their name.

3. In the Virtual Appliance Cluster dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to SailPoint Virtual Appliances.

4. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a credential provider, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

5. Configure the authentication to allow SailPoint to connect to the source. Refer to Connection Settings for more information.

6. (Optional) In the Governance Group for Source Management dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to Associating Governance Groups with a Source.

7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   • Enable Provisioning - Set the toggle to Enabled to allow the source to create, update, and deactivate accounts in the connected source system.

   • Disable Provisioning - Set the toggle to Disabled to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.

8. Select Save.

Connector Files

1. Select Upload Files to upload the .jar file used for the source. The .jar file in this case, is the ojdbc8.jar file obtained from Oracle Database 12.2.0.1 JDBC Driver & UCP Downloads.

   Warning

   Ensure that the file you upload is not vulnerable or malicious.

   Note

   • You must download the library from a trusted source and validate the authenticity of the download location via inspection of valid SSL/TLS certificates. You must also validate the authenticity of the library by inspecting digital signatures or validating checksums when that information is made available.
   • Any .jar uploaded must be compatible with JDK8.

2. Select Save.

Connection Settings

1. Select Connection Settings from the menu.
2. Enter the Oracle E-Business Service Account into the User Name field.
3. Enter the associated Password of the Service Account. The Oracle E-Business source does not add a space to the description field on password change.

4. Enter the Oracle database URL into the Database URL field. The default value is jdbc:oracle:thin:@<HOST>:<PORT>:<SID> where:

   • <HOST> is the host name or IP address of the Oracle database server that is used for Oracle E-Business,
   • <PORT> is port number of the Oracle server that is used for Oracle E-Business, and
   • <SID> is the System ID of the database (used for the Oracle E-Business), that you are connecting to.

5. Enter the Driver Class of the .jar file used for the source.

Additional Connection Parameters

The Oracle E-Business source supports the network encryption and data integrity feature for the Oracle Database managed target system. This setting is recommended by the Oracle server as a part of a standard security feature. It is used to specify the additional connection parameters and their values that must be passed in key value pair format.

1. Enter parameters in key value pair format into the Additional Connection Parameters field. If multiple parameters need to be specified, they should be entered in a new line. For example:

   oracle.net.encryption_client=ACCEPTED
   oracle.net.encryption_types_client=AES256
   

2. Select Save.

Aggregation Settings

For more information about aggregation, refer to Loading Account Data.

The Oracle E-Business source supports the account aggregation with filters for employees, contractors, both employees and contractors, and all users from FND_USER.

For the new Oracle E-Business sources, you must make changes if you want to provide the effective date for aggregating the terminated or inactive accounts. The effective date is the date on or after which a person or user accounts are aggregated. If no effective date is provided, the default date is the current date on the system. This date is set only on the first aggregation. The same date is used in subsequent aggregations.

1. Select Aggregation Settings from the menu.

2. Select one of the following from Account Aggregation Filters:

   • Aggregate only employees - aggregates Oracle E-Business users that are associated with Employee records of the Oracle HRMS system.
   • Aggregate only contractors - aggregates Oracle E-Business users that are associated with valid Contractor records of the Oracle HRMS system.
   • Aggregate employees and contractors - aggregates Oracle E-Business users that are associated with valid Employee and Contractor records of the Oracle HRMS system.
   • Aggregate all users from the FND_USER table in Oracle E-Business - aggregates Oracle E-Business users that are there in the FND_USER table.

3. In HRMS Person Records Effective From, enter the date on or after which you want to aggregate a person's record or the user accounts. The Oracle E-Business source can aggregate employees and contractors that will be hired in the future.

   Note

   For new Oracle E-Business sources, the default value for the skipFutureAssignedGroups attribute is false by default and it aggregates the future assigned roles and responsibilities of a user. The count of aggregated groups might increase because the source will also get future dated records.

4. In Custom Schema Attributes, enter the names of the attributes that are not standard and not a part of the out-of-the-box schema. Add <entry key="jdbcbuildMapRule" value="Your BuildMap Rule Name"/> to the source with the build-map rule that initiates a query of the required table and fetches the custom columns.

5. Set the Page Size value to define the number of records fetched in a single page for the aggregation operation. For example, you may set 1000 as a page size value.

6. Set up the Responsibility and Application Separator to separate the Responsibility_ID and Application_ID. By default, the value is ~

   Note

   If you have data in your Oracle E-Business environment where the Responsibility_ID is not unique, SailPoint recommends that you create a new source.

7. Select Save.

Additional Settings

1. Select Additional Settings from the menu.
2. Enter the Audit User Name. This is the Oracle E-Business User for audit purposes. This user must be created in the Oracle E-Business Suite Portal in the fnd_user table and not the dba_users table. Audit records will be created/updated with this user for all provisioning operations for Oracle E-Business through SailPoint. If not provided, an error will be displayed on Oracle E-Business Portal when the user tries to view Record History for any user and their assigned entitlements.
3. Select Disable Entitlements on Account Disable to disable a user's roles and responsibilities when that account is disabled. When creating a new (employee/contractor) record for an applicant at your organization, the Oracle E-Business source checks if there is an active or existing account for that user based on the Employee_ID attribute. If there are existing accounts in the FND_USER table, then they are linked to the same person in the Oracle HRMS system. The Oracle E-Business source can disable such existing active FND accounts linked to the same person. The responsibilities and roles of the disabled account can also be ended. The date that is used to end the responsibilities and role assignments is the system date.
4. Select Save.

Additional Configuration Information

Future Entitlement Assignment

For a user that has a responsibility/role assignment starting in the future, while revoking such assignments, the Oracle E-Business source will set the end-date based on the system date through a new Oracle API: FND_USER_RESP_GROUPS_API

For the existing sources, you must download the wrapper packages if the new API the source is using is configured with invoker rights. Also, additional permissions need to be provided for the new API to be used.

Disable Pre-Existing Account

When creating a new (employee/contractor) record for an applicant at your organization, the Oracle E-Business source checks if there is an active or existing account for that user based on the Employee_ID attribute. If there are such existing accounts in the FND_USER table, then they are linked to the same person in the Oracle HRMS system.

The Oracle E-Business source can now disable such existing active FND accounts linked to the same person. The responsibilities and roles of the disabled account can also be ended. The date that is used to end the responsibilities and role assignments is the system date.

To use this functionality, the value of the new parameter 'disableOldFNDAccounts' needs to be set to true.

This change does not affect existing sources.

To disable account, use

• Key - connector_disableOldFNDAccounts
• Value - True

User Editions

One of the prerequisites of setting up the Oracle E-Business Accounts is to create a DB user. The following is required for the Oracle instance having Oracle databases that allow the Edition-Based Redefinition:

When you create a new DB user, you must also enable editions on that user to prevent an error while creating the synonyms.

Use the following command in the DB:

alter user <User_Created> enable editions;

For more information on service account/ create user, refer to the Administrator Permissions section.

Last Updated by Attribute

The Oracle E-Business source updates the WHO columns (created_by/last_updated_by) based on the following conditions:

• It only updates the WHO columns when the disableInitializeSession attribute is set to false. By default, the value of this attribute is false.
• If the user selects self-service change password, the WHO columns will be updated with a value of the self user, irrespective of whether "E-Business Proxy User" is configured or not.
• For any other provisioning operations performed by a service account user:
  • If "E-Business Proxy User" is configured , the WHO columns will be updated with a value of the E-Business Proxy User.
  • If "E-Business Proxy User" is not configured , the WHO columns will be updated with a value of the service account user.

Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to Review and Test.

2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.

3. Select Test Connection.

SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to Discovered Applications in the SailPoint user interface.

For more information, refer to Application Onboarding in the SailPoint SaaS documentation.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.