# Connecting SailPoint and Oracle E-Business Suite To connect SailPoint with Oracle E-Business Suite, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. > [!NOTE] > > You must add a source owner at the same time as you add a Source Name and Source Description. ### Connector Files > [!NOTE] > > **Screenshot** > > [![Connector Files]()]() 1. Select **Upload Files** to upload the .jar file used for the source. The .jar file in this case, is the `ojdbc8.jar` file obtained from [Oracle Database 12.2.0.1 JDBC Driver & UCP Downloads](). > **Warning** > > Ensure that the file you upload is not vulnerable or malicious. > **Note** > > - You must download the library from a trusted source and validate the authenticity of the download location via inspection of valid SSL/TLS certificates. You must also validate the authenticity of the library by inspecting digital signatures or validating checksums when that information is made available. > - Any .jar uploaded must be compatible with JDK8. 2. Select **Save**. ## Connection Settings > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() > > [![Connection Settings]()]() 1. Select **Connection Settings** from the menu. 2. Enter the Oracle E-Business Service Account into the **User Name** field. 3. Enter the associated **Password** of the Service Account. The Oracle E-Business source does not add a space to the description field on password change. 4. Enter the Oracle database URL into the **Database URL** field. The default value is `jdbc:oracle:thin:@::` where: - `` is the host name or IP address of the Oracle database server that is used for Oracle E-Business, - `` is port number of the Oracle server that is used for Oracle E-Business, and - `` is the System ID of the database (used for the Oracle E-Business), that you are connecting to. 5. Enter the **Driver Class** of the .jar file used for the source. ### Additional Connection Parameters The Oracle E-Business source supports the network encryption and data integrity feature for the Oracle Database managed target system. This setting is recommended by the Oracle server as a part of a standard security feature. It is used to specify the additional connection parameters and their values that must be passed in key value pair format. 1. Enter parameters in key value pair format into the **Additional Connection Parameters** field. If multiple parameters need to be specified, they should be entered in a new line. For example: ```text oracle.net.encryption_client=ACCEPTED oracle.net.encryption_types_client=AES256 ``` 2. Select **Save**. ## Aggregation Settings For more information about aggregation, refer to [Loading Account Data](). > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() > > [![Aggregation Settings]()]() The Oracle E-Business source supports the account aggregation with filters for employees, contractors, both employees and contractors, and all users from FND\_USER. For the new Oracle E-Business sources, you must make changes if you want to provide the effective date for aggregating the terminated or inactive accounts. The effective date is the date on or after which a person or user accounts are aggregated. If no effective date is provided, the default date is the current date on the system. This date is set only on the first aggregation. The same date is used in subsequent aggregations. 1. Select **Aggregation Settings** from the menu. 2. Select one of the following from **Account Aggregation Filters**: - **Aggregate only employees** - aggregates Oracle E-Business users that are associated with Employee records of the Oracle HRMS system. - **Aggregate only contractors** - aggregates Oracle E-Business users that are associated with valid Contractor records of the Oracle HRMS system. - **Aggregate employees and contractors** - aggregates Oracle E-Business users that are associated with valid Employee and Contractor records of the Oracle HRMS system. - **Aggregate all users from the FND\_USER table in Oracle E-Business** - aggregates Oracle E-Business users that are there in the FND\_USER table. 3. In **HRMS Person Records Effective From**, enter the date on or after which you want to aggregate a person's record or the user accounts. The Oracle E-Business source can aggregate employees and contractors that will be hired in the future. > **Note** > > For new Oracle E-Business sources, the default value for the `skipFutureAssignedGroups` attribute is false by default and it aggregates the future assigned roles and responsibilities of a user. The count of aggregated groups might increase because the source will also get future dated records. 4. In **Custom Schema Attributes**, enter the names of the attributes that are not standard and not a part of the out-of-the-box schema. Add `` to the source with the build-map rule that initiates a query of the required table and fetches the custom columns. 5. Set the **Page Size** value to define the number of records fetched in a single page for the aggregation operation. For example, you may set 1000 as a page size value. 6. Set up the **Responsibility and Application Separator** to separate the Responsibility\_ID and Application\_ID. By default, the value is \~ > **Note** > > If you have data in your Oracle E-Business environment where the Responsibility\_ID is not unique, SailPoint recommends that you create a new source. 7. Select **Save**. ## Additional Settings > [!NOTE] > > **Screenshot** > > [![Additional Settings]()]() 1. Select **Additional Settings** from the menu. 2. Enter the **Audit User Name**. This is the Oracle E-Business User for audit purposes. This user must be created in the Oracle E-Business Suite Portal in the `fnd_user` table and not the `dba_users` table. Audit records will be created/updated with this user for all provisioning operations for Oracle E-Business through SailPoint. If not provided, an error will be displayed on Oracle E-Business Portal when the user tries to view Record History for any user and their assigned entitlements. 3. Select **Disable Entitlements on Account Disable** to disable a user's roles and responsibilities when that account is disabled. When creating a new (employee/contractor) record for an applicant at your organization, the Oracle E-Business source checks if there is an active or existing account for that user based on the Employee\_ID attribute. If there are existing accounts in the FND\_USER table, then they are linked to the same person in the Oracle HRMS system. The Oracle E-Business source can disable such existing active FND accounts linked to the same person. The responsibilities and roles of the disabled account can also be ended. The date that is used to end the responsibilities and role assignments is the system date. 4. Select **Save**. ## Additional Configuration Information ### Future Entitlement Assignment For a user that has a responsibility/role assignment starting in the future, while revoking such assignments, the Oracle E-Business source will set the end-date based on the system date through a new Oracle API: `FND_USER_RESP_GROUPS_API` For the existing sources, you must download the wrapper packages if the new API the source is using is configured with invoker rights. Also, additional permissions need to be provided for the new API to be used. ### Disable Pre-Existing Account When creating a new (employee/contractor) record for an applicant at your organization, the Oracle E-Business source checks if there is an active or existing account for that user based on the Employee\_ID attribute. If there are such existing accounts in the FND\_USER table, then they are linked to the same person in the Oracle HRMS system. The Oracle E-Business source can now disable such existing active FND accounts linked to the same person. The responsibilities and roles of the disabled account can also be ended. The date that is used to end the responsibilities and role assignments is the system date. To use this functionality, the value of the new parameter 'disableOldFNDAccounts' needs to be set to true. This change does not affect existing sources. > [!NOTE] > > Disabling any pre-existing active FND accounts linked to the same person, is supported only in the case of the Create User operation. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. To disable account, use - Key - `connector_disableOldFNDAccounts` - Value - True ### User Editions One of the prerequisites of setting up the Oracle E-Business Accounts is to create a DB user. The following is required for the Oracle instance having Oracle databases that allow the Edition-Based Redefinition: When you create a new DB user, you must also enable editions on that user to prevent an error while creating the synonyms. Use the following command in the DB: `alter user enable editions;` > [!NOTE] > > You can use this command for Database version 11g R2 and later since the editioning was introduced from this version onward. For more information on service account/ create user, refer to the [Administrator Permissions]() section. ### Last Updated by Attribute The Oracle E-Business source updates the WHO columns (created\_by/last\_updated\_by) based on the following conditions: - It only updates the WHO columns when the `disableInitializeSession` attribute is set to false. By default, the value of this attribute is false. - If the user selects self-service change password, the WHO columns will be updated with a value of the self user, irrespective of whether "E-Business Proxy User" is configured or not. - For any other provisioning operations performed by a service account user: - If "E-Business Proxy User" is configured , the WHO columns will be updated with a value of the E-Business Proxy User. - If "E-Business Proxy User" is not configured , the WHO columns will be updated with a value of the service account user. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation.