# SailPoint Oracle E-Business Suite Connector Documentation

> Oracle E-Business Suite Connector Documentation

# Documentation

# Additional Information

This section describes the additional information related to Oracle E-Business Suite.

## Support for AD\_ZD.GRANT\_PRIVS Package

The SailPoint Oracle E-Business Suite Connector supports the service account permissions provided through the `AD_ZD.GRANT_PRIVS` API from Oracle E-Business Suite version 12.2.4 and later.

The following is the syntax for granting permissions through `AD_ZD.GRANT_PRIVS`:

```text
EXECUTE APPS.AD_ZD.GRANT_PRIVS( X_PERMISSIONS in VARCHAR2, X_OBJECT_NAME in VARCHAR2,X_GRANTEE in VARCHAR2, X_OPTIONS in VARCHAR2 default NULL);
```

For example,

```text
EXECUTE APPS.AD_ZD.GRANT_PRIVS('SELECT','FND_USER','<some role>');
```

This is equivalent to `grant select on APPS.FND_USER to ${some role};` provided in [Administrator Permissions](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/index.html#required-permissions>).

> [!NOTE]
>
> The following permissions cannot be granted through the `AD_ZD.GRANT_PRIVS` API as the objects mentioned are owned by the SYSTEM:
>
> - `grant select on SYS.DBA_USERS to ${new role};`
> - `grant select on DUAL to ${new role};`

# Connecting SailPoint and Oracle E-Business Suite

To connect SailPoint with Oracle E-Business Suite, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Configure**.
5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
8. Under **Connection Type**, select **Direct Connection** or **Flat File**.

   - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
   - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.
9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source.
10. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
8. Select **Save**.

> [!NOTE]
>
> You must add a source owner at the same time as you add a Source Name and Source Description.

### Connector Files

> [!NOTE]
>
> **Screenshot**
>
> [![Connector Files](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_base2.png>)](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_base2.png>)

1. Select **Upload Files** to upload the .jar file used for the source. The .jar file in this case, is the `ojdbc8.jar` file obtained from [Oracle Database 12.2.0.1 JDBC Driver &amp; UCP Downloads](<https://www.oracle.com/database/technologies/appdev/jdbc-ucp-183-downloads.html>).

   > **Warning**
   >
   > Ensure that the file you upload is not vulnerable or malicious.

   > **Note**
   >
   > - You must download the library from a trusted source and validate the authenticity of the download location via inspection of valid SSL/TLS certificates. You must also validate the authenticity of the library by inspecting digital signatures or validating checksums when that information is made available.
   > - Any .jar uploaded must be compatible with JDK8.
2. Select **Save**.

## Connection Settings

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_conn1.png>)](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_conn1.png>)
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_conn2.png>)](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_conn2.png>)

1. Select **Connection Settings** from the menu.
2. Enter the Oracle E-Business Service Account into the **User Name** field.
3. Enter the associated **Password** of the Service Account. The Oracle E-Business source does not add a space to the description field on password change.
4. Enter the Oracle database URL into the **Database URL** field. The default value is `jdbc:oracle:thin:@<HOST>:<PORT>:<SID>` where:

   - `<HOST>` is the host name or IP address of the Oracle database server that is used for Oracle E-Business,
   - `<PORT>` is port number of the Oracle server that is used for Oracle E-Business, and
   - `<SID>` is the System ID of the database (used for the Oracle E-Business), that you are connecting to.
5. Enter the **Driver Class** of the .jar file used for the source.

### Additional Connection Parameters

The Oracle E-Business source supports the network encryption and data integrity feature for the Oracle Database managed target system. This setting is recommended by the Oracle server as a part of a standard security feature. It is used to specify the additional connection parameters and their values that must be passed in key value pair format.

1. Enter parameters in key value pair format into the **Additional Connection Parameters** field. If multiple parameters need to be specified, they should be entered in a new line. For example:

   ```text
   oracle.net.encryption_client=ACCEPTED
   oracle.net.encryption_types_client=AES256
   ```
2. Select **Save**.

## Aggregation Settings

For more information about aggregation, refer to [Loading Account Data](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html>).

> [!NOTE]
>
> **Screenshot**
>
> [![Aggregation Settings](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_agg1.png>)](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_agg1.png>)
>
> [![Aggregation Settings](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_agg2.png>)](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_agg2.png>)

The Oracle E-Business source supports the account aggregation with filters for employees, contractors, both employees and contractors, and all users from FND\_USER.

For the new Oracle E-Business sources, you must make changes if you want to provide the effective date for aggregating the terminated or inactive accounts. The effective date is the date on or after which a person or user accounts are aggregated. If no effective date is provided, the default date is the current date on the system. This date is set only on the first aggregation. The same date is used in subsequent aggregations.

1. Select **Aggregation Settings** from the menu.
2. Select one of the following from **Account Aggregation Filters**:

   - **Aggregate only employees** - aggregates Oracle E-Business users that are associated with Employee records of the Oracle HRMS system.
   - **Aggregate only contractors** - aggregates Oracle E-Business users that are associated with valid Contractor records of the Oracle HRMS system.
   - **Aggregate employees and contractors** - aggregates Oracle E-Business users that are associated with valid Employee and Contractor records of the Oracle HRMS system.
   - **Aggregate all users from the FND\_USER table in Oracle E-Business** - aggregates Oracle E-Business users that are there in the FND\_USER table.
3. In **HRMS Person Records Effective From**, enter the date on or after which you want to aggregate a person's record or the user accounts. The Oracle E-Business source can aggregate employees and contractors that will be hired in the future.

   > **Note**
   >
   > For new Oracle E-Business sources, the default value for the `skipFutureAssignedGroups` attribute is false by default and it aggregates the future assigned roles and responsibilities of a user. The count of aggregated groups might increase because the source will also get future dated records.
4. In **Custom Schema Attributes**, enter the names of the attributes that are not standard and not a part of the out-of-the-box schema. Add `<entry key="jdbcbuildMapRule" value="Your BuildMap Rule Name"/>` to the source with the build-map rule that initiates a query of the required table and fetches the custom columns.
5. Set the **Page Size** value to define the number of records fetched in a single page for the aggregation operation. For example, you may set 1000 as a page size value.
6. Set up the **Responsibility and Application Separator** to separate the Responsibility\_ID and Application\_ID. By default, the value is \~

   > **Note**
   >
   > If you have data in your Oracle E-Business environment where the Responsibility\_ID is not unique, SailPoint recommends that you create a new source.
7. Select **Save**.

## Additional Settings

> [!NOTE]
>
> **Screenshot**
>
> [![Additional Settings](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_add.png>)](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/oracle_eb_add.png>)

1. Select **Additional Settings** from the menu.
2. Enter the **Audit User Name**. This is the Oracle E-Business User for audit purposes. This user must be created in the Oracle E-Business Suite Portal in the `fnd_user` table and not the `dba_users` table. Audit records will be created/updated with this user for all provisioning operations for Oracle E-Business through SailPoint. If not provided, an error will be displayed on Oracle E-Business Portal when the user tries to view Record History for any user and their assigned entitlements.
3. Select **Disable Entitlements on Account Disable** to disable a user's roles and responsibilities when that account is disabled. When creating a new (employee/contractor) record for an applicant at your organization, the Oracle E-Business source checks if there is an active or existing account for that user based on the Employee\_ID attribute. If there are existing accounts in the FND\_USER table, then they are linked to the same person in the Oracle HRMS system. The Oracle E-Business source can disable such existing active FND accounts linked to the same person. The responsibilities and roles of the disabled account can also be ended. The date that is used to end the responsibilities and role assignments is the system date.
4. Select **Save**.

## Additional Configuration Information

### Future Entitlement Assignment

For a user that has a responsibility/role assignment starting in the future, while revoking such assignments, the Oracle E-Business source will set the end-date based on the system date through a new Oracle API: `FND_USER_RESP_GROUPS_API`

For the existing sources, you must download the wrapper packages if the new API the source is using is configured with invoker rights. Also, additional permissions need to be provided for the new API to be used.

### Disable Pre-Existing Account

When creating a new (employee/contractor) record for an applicant at your organization, the Oracle E-Business source checks if there is an active or existing account for that user based on the Employee\_ID attribute. If there are such existing accounts in the FND\_USER table, then they are linked to the same person in the Oracle HRMS system.

The Oracle E-Business source can now disable such existing active FND accounts linked to the same person. The responsibilities and roles of the disabled account can also be ended. The date that is used to end the responsibilities and role assignments is the system date.

To use this functionality, the value of the new parameter 'disableOldFNDAccounts' needs to be set to true.

This change does not affect existing sources.

> [!NOTE]
>
> Disabling any pre-existing active FND accounts linked to the same person, is supported only in the case of the Create User operation.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

To disable account, use

- Key - `connector_disableOldFNDAccounts`
- Value - True

### User Editions

One of the prerequisites of setting up the Oracle E-Business Accounts is to create a DB user. The following is required for the Oracle instance having Oracle databases that allow the Edition-Based Redefinition:

When you create a new DB user, you must also enable editions on that user to prevent an error while creating the synonyms.

Use the following command in the DB:

`alter user <User_Created> enable editions;`

> [!NOTE]
>
> You can use this command for Database version 11g R2 and later since the editioning was introduced from this version onward.

For more information on service account/ create user, refer to the [Administrator Permissions](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/index.html#required-permissions>) section.

### Last Updated by Attribute

The Oracle E-Business source updates the WHO columns (created\_by/last\_updated\_by) based on the following conditions:

- It only updates the WHO columns when the `disableInitializeSession` attribute is set to false. By default, the value of this attribute is false.
- If the user selects self-service change password, the WHO columns will be updated with a value of the self user, irrespective of whether "E-Business Proxy User" is configured or not.
- For any other provisioning operations performed by a service account user:

  - If "E-Business Proxy User" is configured , the WHO columns will be updated with a value of the E-Business Proxy User.
  - If "E-Business Proxy User" is not configured , the WHO columns will be updated with a value of the service account user.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Integrating SailPoint with Oracle E-Business Suite

> [!IMPORTANT]
>
> The Oracle E-Business Suite connector has only been certified for on-premises versions of the target system.

The Oracle E-Business connector provides a complete solution to manage Oracle E-Business accounts data, passwords, and access.

This guide has information on loading and provisioning Oracle E-Business accounts, responsibilities, and roles along with the password management features.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Oracle E-Business connector supports the following features:

- Load and \*Provision

  - Oracle E-Business accounts
  - Responsibilities
  - Roles
- \*Access Certifications (certification of entitlements connected to accounts)
- \*Password management

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

> [!NOTE]
>
> Before you can use any item above marked with an asterisk (\*), SailPoint must activate the feature for your site.

The Oracle E-Business source supports the following multiple group and entitlement objects:

| Source Objects | Supported Operation |
| --- | --- |
| RESPONSIBILITY as RESPONSIBILITY object | Read |
| ROLE as ROLE object | Read |
| ROLE and RESPONSIBILITY as entitlement objects | Add / Remove entitlement |

The following ROLE schema attributes are supported:

- NAME
- DISPLAY\_NAME
- DESCRIPTION
- START\_DATE
- EXPIRATION\_DATE
- APPLICATION\_NAME
- STATUS
- SUBORDINATE\_ROLES

The following RESPONSIBILITY schema attributes are supported:

- RESPONSIBILITY\_NAME
- APPLICATION\_NAME
- RESPONSIBILITY\_ID
- RESPONSIBILITY\_KEY
- START\_DATE
- END\_DATE
- DESCRIPTION
- STATUS
- VERSION
- WEB\_HOST\_NAME
- WEB\_AGENT\_NAME
- DATA\_GROUP\_APPL\_NAME
- REQUEST\_GROUP\_APPL\_NAME
- DATA\_GROUP\_ID
- DATA\_GROUP\_NAME
- MENU\_NAME
- REQUEST\_GROUP\_NAME

### Using Multiple Group Objects for Pre-Existing Sources

1. Use [createSchema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) API to create new group schema for your source.
2. Update Account Schema with the following steps:

   1. Get account schema using [getSchema](<https://developer.sailpoint.com/docs/api/get-source-schema-v-1/>) API.
   2. Copy the schema to a file and search for the attribute corresponding to the group schema that is added in the previous step. Add/update the below two properties for the attribute found in the previous step `"isGroup": true, "schema": {"type": "CONNECTOR_SCHEMA","id": "<Schema_ID_From_Step1>","name": "<Name_Of_Schema_Created_In_Step1>"}`
   3. Add the modified schema to the payload to update the account schema in the source using [replaceSchema](<https://developer.sailpoint.com/docs/api/put-source-schema-v-1/>) API

> [!NOTE]
>
> **Example to Add ROLE Schema**
>
> **ROLE Hierarchy**
>
> The ROLE schema has the SUBORDINATE\_ROLES attribute that holds the `hierarchy` of ROLE. The hierarchy attribute can be defined and `childHierarchy` can be used to set the correct parent-child relationship. To display the child hierarchy of the Role, you must remove the `convertListToCSV` configuration attribute (related to the list) to the CSV from the source template.
>
> API to add new ROLE schema
>
> **Details**
>
> Method: POST
>
> URL: `beta/sources/<source-id>/schemas`
>
> JSON Payload example:
>
> ```json
> {
> "nativeObjectType": "ROLE",
> "identityAttribute": "NAME",
> "displayAttribute": "DISPLAY_NAME",
> "hierarchyAttribute": "SUBORDINATE_ROLES",
> "includePermissions": false,
> "features": [],
> "configuration": {
> "childHierarchy": "true"
> },
> "attributes": [
> {
> "name": "NAME",
> "type": "STRING",
> "schema": null,
> "description": "An internal name for the role",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> {
> "name": "DISPLAY_NAME",
> "type": "STRING",
> "schema": null,
> "description": "The display name of the role",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> {
> "name": "DESCRIPTION",
> "type": "STRING",
> "schema": null,
> "description": "DESCRIPTION",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> {
> "name": "START_DATE",
> "type": "STRING",
> "schema": null,
> "description": "The date at which the role becomes valid",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> {
> "name": "EXPIRATION_DATE",
> "type": "STRING",
> "schema": null,
> "description": "The date at which the role is no longer
> valid in the directory service",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> {
> "name": "APPLICATION_NAME",
> "type": "STRING",
> "schema": null,
> "description": "Application that owns the information for the role",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> {
> "name": "STATUS",
> "type": "STRING",
> "schema": null,
> "description": "The availability of the
> Role to participate in a workflow process",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> {
> "name": "SUBORDINATE_ROLES",
> "type": "STRING",
> "schema": null,
> "description": "Subordinate roles for a role",
> "isMulti": true,
> "isEntitlement": true,
> "isGroup": false
> }
> ],
> "id": "2c91808f79180d49017918643cb60153",
> "name": "ROLE",
> "created": "2021-01-25T12:07:25.596Z",
> "modified": null
> }
> ```

> [!NOTE]
>
> **Example to Add MENU Schema (Must Be Added Manually) - Optional Step**
>
> API to add new MENU schema
>
> **Details**
>
> Method: POST
>
> URL: `beta/sources/<source-id>/schemas`
>
> JSON Payload example:
>
> ```json
> {
> "nativeObjectType": "MENU",
> "identityAttribute": "MENU_ID",
> "displayAttribute": "MENU_NAME",
> "hierarchyAttribute": "SUB_MENU",
> "includePermissions": false,
> "features": [],
> "configuration": {
> "childHierarchy": "true"
> },
> "attributes": [
> {
> "name": "MENU_ID",
> "type": "STRING",
> "schema": null,
> "description": "An internal ID for the menu",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> {
> "name": "MENU_NAME",
> "type": "STRING",
> "schema": null,
> "description": "The name of the menu",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> {
> "name": "TYPE",
> "type": "STRING",
> "schema": null,
> "description": "The type of menu",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> {
> "name": "SUB_MENU",
> "type": "STRING",
> "schema": null,
> "description": "The list of sub-menus",
> "isMulti": true,
> "isEntitlement": true,
> "isGroup": false
> },
> {
> "name": "FUNCTION_NAME",
> "type": "STRING",
> "schema": null,
> "description": "The functions assigned to a menu",
> "isMulti": false,
> "isEntitlement": false,
> "isGroup": false
> },
> "id": "2c91808f79180d49017918643cb60153",
> "name": "MENU",
> "created": "2021-01-25T12:07:25.596Z",
> "modified": null
> }
> ```

### Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

> [!NOTE]
>
> **Example**
>
> [![Recommended Privilege Level - High](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/privilege_level_high.png>)](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/privilege_level_high.png>)
>
> [![Recommended Privilege Level - Medium](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/privilege_level_medium.png>)](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/privilege_level_medium.png>)
>
> [![Recommended Privilege Level - Low](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/privilege_level_low.png>)](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/privilege_level_low.png>)

### Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Create a service account on the Oracle E-Business instance with the required permissions.

## Supported Managed Systems

Oracle E-Business Suite 12.2.1 to 12.2.12

## Required Permissions

SailPoint's Oracle E-Business Suite Connector supports the service account permissions provided through the AD\_ZD.GRANT\_PRIVS API from Oracle E-Business Suite version 12.2.4 and later versions. For more information on these versions, refer to [Support for AD\_ZD.GRANT\_PRIVS Package](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/additional_information.html#support-for-ad_zdgrant_privs-package>).

For previous versions:

1. Log in to the Oracle database as database administrator for creating the Service Account (Minimum privileges user for the configured application) using `SQL*Plus` as follows:

   ```sql
   create role ${new role};
   create user ${new user} identified by ${password};
   grant create session to ${new user};
   grant create synonym to ${new user};
   alter user ${new user} enable editions;
   grant ${new role} to ${new user};
   ```
2. Grant SELECT permissions to the new role created in the above step (${new role}):

   ```sql
   grant select on APPS.FND_PRODUCT_GROUPS to ${new role};
   grant select on APPS.FND_USER to ${new role};
   grant select on SYS.DBA_USERS to ${new role}; -- Only required if the proxy user is not provided.
   grant select on APPS.FND_RESPONSIBILITY_VL to ${new role};
   grant select on APPS.FND_APPLICATION_VL to ${new role};
   grant select on APPS.FND_DATA_GROUPS to ${new role};
   grant select on APPS.FND_USER_RESP_GROUPS_ALL to ${new role};
   grant select on DUAL to ${new role};
   grant select on APPS.PER_ALL_PEOPLE_F to ${new role};
   grant select on APPS.RA_CUSTOMERS to ${new role};
   grant select on APPS.FND_MENUS to ${new role};
   grant select on APPS.FND_REQUEST_GROUPS to ${new role};
   grant select on APPS.FND_APPLICATION to ${new role};
   grant select on APPS.FND_DATA_GROUP_UNITS to ${new role};
   grant select on APPS.FND_APPLICATION_TL to ${new role};
   grant select on APPS.FND_RESPONSIBILITY to ${new role};
   grant select on APPS.WF_ROLES to ${new role};
   grant select on APPS.WF_LOCAL_ROLES to ${new role};
   grant select on APPS.WF_ALL_ROLES_VL to ${new role};
   grant select on APPS.WF_ROLE_HIERARCHIES to ${new role};
   grant select on APPS.FND_REQUEST_GROUP_UNITS to ${new role};
   grant select on APPS.WF_LOCAL_USER_ROLES TO ${new role};
   grant select on APPS.FND_USER_RESP_GROUPS_DIRECT TO ${new role};
   grant select on APPS.PER_PERIODS_OF_PLACEMENT TO ${new role};
   grant select on APPS.PER_PERIODS_OF_SERVICE TO ${new role};
   grant select on APPS.FND_MENUS_VL to ${new role};
   grant select on APPS.FND_MENU_ENTRIES to ${new role};
   grant select on APPS.FND_MENU_ENTRIES_VL to ${new role};
   grant select on APPS.FND_FORM_FUNCTIONS to ${new role};
   grant select on APPS.FND_FORM_FUNCTIONS_VL to ${new role};
   ```
3. Check the Rights present on Oracle E-Business FND packages (INVOKER / DEFINER):

   ```sql
   SELECT dbo.object_name,
   (DECODE(SIGN(bitand(options,16)),1,'INVOKER','DEFINER')) "authid"
   FROM dba_objects dbo, sys.PROCEDURE$ p
   WHERE p.obj# = dbo.object_id
   AND dbo.object_type = 'PACKAGE'
   AND dbo.object_name IN ('FND_USER_PKG','FND_RESPONSIBILITY_PKG', 'WF_LOCAL_SYNCH', 'FND_WEB_SEC', 'FND_GLOBAL','FND_USER_RESP_GROUPS_API')
   AND dbo.owner = 'APPS';
   ```

   > **Note**
   >
   > Remove any new line character inserted in the query.

   Based on the above query result, perform one of the following procedures if the rights present are INVOKER or DEFINER:

   ### For INVOKER Rights

   1. Create Packages:

      1. Copy the package scripts from [http://files.accessiq.sailpoint.com/integrations/OracleEBS/resources.zip](<http://files.accessiq.sailpoint.com/integrations/OracleEBS/resources.zip>) (open link in new window) directory to the `OracleHome\bin` directory and rename the type of scripts from `*.txt` to `*.sql`:
      2. Using **SQL\*Plus**, create one more session to the Oracle database by the APPS user and run the following:

         ```text
         @SP_xxx package
         ```

         For example, if `FND_USER_PKG` has invoker rights, run the `@SP_FND_USER _PKG`
      3. Perform this step for all *xxx* packages, where *xxx* package is `FND_USER_PKG`, `FND_RESPONSIBILITY_PKG`, `WF_LOCAL_SYNCH`, `FND_WEB_SEC`, `FND_GLOBAL`, or `FND_USER_RESP_GROUPS_API`.
      4. After performing the above step, log out from the APPS session.
   2. Grant EXECUTE permissions to the new role created in the above step (${new role}):

      ```sql
      grant execute on APPS.SP_FND_USER_PKG to ${new role};
      grant execute on APPS.SP_FND_RESPONSIBILITY_PKG to ${new role};
      grant execute on APPS.SP_WF_LOCAL_SYNCH to ${new role};
      grant execute on APPS.SP_FND_WEB_SEC to ${new role};
      grant execute on APPS.SP_FND_GLOBAL to ${new role};
      grant execute on APPS.SP_FND_USER_RESP_GROUPS_API to ${new role};
      ```
   3. Sign in to the Service Account ${new user} and create the following synonym:

      > **Note**
      >
      > Ensure that the synonyms are created under the Service Account login. If this is not performed under the Service Account login a failure may occur while performing operations ([Troubleshooting](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/troubleshooting/index.html>)).

      ```sql
      create synonym FND_PRODUCT_GROUPS for APPS.FND_PRODUCT_GROUPS;
      create synonym FND_USER for APPS.FND_USER;
      create synonym DBA_USERS for SYS.DBA_USERS;
      create synonym FND_RESPONSIBILITY_VL for APPS.FND_RESPONSIBILITY_VL;
      create synonym FND_APPLICATION_VL for APPS.FND_APPLICATION_VL;
      create synonym FND_DATA_GROUPS for APPS.FND_DATA_GROUPS;
      create synonym FND_USER_RESP_GROUPS_ALL for APPS.FND_USER_RESP_GROUPS_ALL;
      create synonym PER_ALL_PEOPLE_F for APPS.PER_ALL_PEOPLE_F;
      create synonym RA_CUSTOMERS for APPS.RA_CUSTOMERS;
      create synonym FND_MENUS for APPS.FND_MENUS;
      create synonym FND_REQUEST_GROUPS for APPS.FND_REQUEST_GROUPS;
      create synonym FND_APPLICATION for APPS.FND_APPLICATION;
      create synonym FND_RESPONSIBILITY for APPS.FND_RESPONSIBILITY;
      create synonym FND_APPLICATION_TL for APPS.FND_APPLICATION_TL;
      create or replace synonym FND_DATA_GROUP_UNITS for APPS.FND_DATA_GROUP_UNITS;
      create or replace synonym WF_ROLES for APPS.WF_ROLES;
      create or replace synonym WF_LOCAL_ROLES for APPS.WF_LOCAL_ROLES;
      create or replace synonym WF_ROLE_HIERARCHIES for APPS.WF_ROLE_HIERARCHIES;
      create or replace synonym WF_ALL_ROLES_VL for APPS.WF_ALL_ROLES_VL;
      create synonym FND_REQUEST_GROUP_UNITS for APPS.FND_REQUEST_GROUP_UNITS;
      create synonym PER_PERIODS_OF_SERVICE for APPS.PER_PERIODS_OF_SERVICE;
      create or replace synonym WF_LOCAL_USER_ROLES for APPS.WF_LOCAL_USER_ROLES;
      create or replace synonym FND_USER_RESP_GROUPS_DIRECT for APPS.FND_USER_RESP_GROUPS_DIRECT;
      create synonym PER_PERIODS_OF_PLACEMENT for APPS.PER_PERIODS_OF_PLACEMENT;
      create or replace synonym FND_USER_PKG for APPS.SP_FND_USER_PKG;
      create or replace synonym FND_RESPONSIBILITY_PKG for APPS.SP_FND_RESPONSIBILITY_PKG;
      create or replace synonym WF_LOCAL_SYNCH for APPS.SP_WF_LOCAL_SYNCH;
      create or replace synonym FND_WEB_SEC for APPS.SP_FND_WEB_SEC;
      create or replace synonym FND_GLOBAL for APPS.SP_FND_GLOBAL;
      create or replace synonym FND_USER_RESP_GROUPS_API for APPS.SP_FND_USER_RESP_GROUPS_API;
      create synonym FND_MENUS_VL for APPS.FND_MENUS_VL;
      create synonym FND_MENU_ENTRIES for APPS.FND_MENU_ENTRIES;
      create synonym FND_MENU_ENTRIES_VL for APPS.FND_MENU_ENTRIES_VL;
      create synonym FND_FORM_FUNCTIONS for APPS.FND_FORM_FUNCTIONS;
      create synonym FND_FORM_FUNCTIONS_VL for APPS.FND_FORM_FUNCTIONS_VL;
      ```

   ### For DEFINER Rights

   1. Grant EXECUTE permissions to the new role (${new role}):

      ```sql
      grant execute on APPS.FND_USER_PKG to ${new role};
      grant execute on APPS.FND_RESPONSIBILITY_PKG to ${new role};
      grant execute on APPS.WF_LOCAL_SYNCH to ${new role};
      grant execute on APPS.FND_WEB_SEC to ${new role};
      grant execute on APPS.FND_GLOBAL to ${new role};
      grant execute on APPS.FND_USER_RESP_GROUPS_API to ${new role};
      ```
   2. Sign in to the Service Account ${new user} and create the following synonym:

      > **Note**
      >
      > Ensure that the synonyms are created under the Service Account login. If this is not performed under the Service Account login a failure may occur while performing operations ([Troubleshooting](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/troubleshooting/index.html>)).

      ```sql
      create synonym FND_PRODUCT_GROUPS for APPS.FND_PRODUCT_GROUPS;
      create synonym FND_USER for APPS.FND_USER;
      create synonym DBA_USERS for SYS.DBA_USERS;
      create synonym FND_RESPONSIBILITY_VL for APPS.FND_RESPONSIBILITY_VL;
      create synonym FND_APPLICATION_VL for APPS.FND_APPLICATION_VL;
      create synonym FND_DATA_GROUPS for APPS.FND_DATA_GROUPS;
      create synonym FND_USER_RESP_GROUPS_ALL for APPS.FND_USER_RESP_GROUPS_ALL;
      create synonym PER_ALL_PEOPLE_F for APPS.PER_ALL_PEOPLE_F;
      create synonym RA_CUSTOMERS for APPS.RA_CUSTOMERS;
      create synonym FND_MENUS for APPS.FND_MENUS;
      create synonym FND_REQUEST_GROUPS for APPS.FND_REQUEST_GROUPS;
      create synonym FND_APPLICATION for APPS.FND_APPLICATION;
      create synonym FND_RESPONSIBILITY for APPS.FND_RESPONSIBILITY;
      create synonym FND_APPLICATION_TL for APPS.FND_APPLICATION_TL;
      create or replace synonym FND_DATA_GROUP_UNITS for APPS.FND_DATA_GROUP_UNITS;
      create or replace synonym WF_ROLES for APPS.WF_ROLES;
      create or replace synonym WF_LOCAL_ROLES for APPS.WF_LOCAL_ROLES;
      create or replace synonym WF_ROLE_HIERARCHIES for APPS.WF_ROLE_HIERARCHIES;
      create or replace synonym WF_ALL_ROLES_VL for APPS.WF_ALL_ROLES_VL;
      create synonym FND_REQUEST_GROUP_UNITS for APPS.FND_REQUEST_GROUP_UNITS;
      create synonym PER_PERIODS_OF_SERVICE for APPS.PER_PERIODS_OF_SERVICE;
      create or replace synonym WF_LOCAL_USER_ROLES for APPS.WF_LOCAL_USER_ROLES;
      create or replace synonym FND_USER_RESP_GROUPS_DIRECT for APPS.FND_USER_RESP_GROUPS_DIRECT;
      create synonym PER_PERIODS_OF_PLACEMENT for APPS.PER_PERIODS_OF_PLACEMENT;
      create or replace synonym FND_USER_PKG for APPS.FND_USER_PKG;
      create or replace synonym FND_RESPONSIBILITY_PKG for APPS.FND_RESPONSIBILITY_PKG;
      create or replace synonym WF_LOCAL_SYNCH for APPS.WF_LOCAL_SYNCH;
      create or replace synonym FND_WEB_SEC for APPS.FND_WEB_SEC;
      create or replace synonym FND_GLOBAL for APPS.FND_GLOBAL;
      create or replace synonym FND_USER_RESP_GROUPS_API for APPS.FND_USER_RESP_GROUPS_API;
      create synonym FND_MENUS_VL for APPS.FND_MENUS_VL;
      create synonym FND_MENU_ENTRIES for APPS.FND_MENU_ENTRIES;
      create synonym FND_MENU_ENTRIES_VL for APPS.FND_MENU_ENTRIES_VL;
      create synonym FND_FORM_FUNCTIONS for APPS.FND_FORM_FUNCTIONS;
      create synonym FND_FORM_FUNCTIONS_VL for APPS.FND_FORM_FUNCTIONS_VL;
      ```

      > **Important**
      >
      > In the case of a permission mismatch, validate the Service Account Permissions as mentioned in the [Validating Service Account Permissions on Oracle E-Business](<https://community.sailpoint.com/knowledge/Validating-Service-Account-Permissions-on-Oracle-E-Business>) document.

### Additional Permissions for Menu Group Object

The following permissions are required:

```sql
grant select on APPS.FND_MENUS_VL to ${new role};
grant select on APPS.FND_MENU_ENTRIES to ${new role};
grant select on APPS.FND_MENU_ENTRIES_VL to ${new role};
grant select on APPS.FND_FORM_FUNCTIONS to ${new role};
grant select on APPS.FND_FORM_FUNCTIONS_VL to ${new role};
```

### Service Account Permissions Provided Through the AD\_ZD.GRANT\_PRIVS API

The Oracle E-Business source supports the service account permissions provided through the AD\_ZD.GRANT\_PRIVS API from Oracle E-Business Suite 12.2.4 version onward.

The syntax for granting permissions via AD\_ZD.GRANT\_PRIVS is:

```text
EXECUTE APPS.AD_ZD.GRANT_PRIVS( X_PERMISSIONS in VARCHAR2, X_OBJECT_NAME in VARCHAR2,X_GRANTEE in VARCHAR2, X_OPTIONS in VARCHAR2 default NULL);
```

For example, you can use: `EXECUTE APPS.AD_ZD.GRANT_PRIVS('SELECT','FND_USER','<some user>');`, which is equivalent to `"grant select on APPS.FND_USER to ${some user};"`

The following two permissions cannot be granted using the AD\_ZD.GRANT\_PRIVS API because the objects are owned by SYSTEM:

- `grant select on SYS.DBA_USERS to ${new user};`
- `grant select on DUAL to ${new user};`

# Machine Account Attributes

Machine account attributes are used in provisioning configurations for machine accounts.

After you have [created the required machine account subtypes](<https://documentation.sailpoint.com/saas/help/machine/account_configuration.html#creating-machine-account-subtypes>), you can use the machine account attributes to provision machine accounts in your SailPoint tenant.

Refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html>) for more information.

## Machine Account Provisioning Attributes

# Provisioning

The Oracle E-Business Suite connector supports provisioning, allowing you to create and manage accounts and entitlements in Oracle E-Business Suite directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Default Create Account Attributes

| Account Attribute | Generator | Description |
| --- | --- | --- |
| USER\_NAME | Generator | This field uses a value in the Pattern Used field to generate the user name for the Oracle E-business account. SailPoint recommends that you set up the pattern used for this attribute as $(uid). |
| Password | Generator | This field contains an initial password for the new account that matches the password policy assigned to the associated Oracle E-business source. |
| DESCRIPTION | Static | This field contains the Oracle E-business account's description. |

The following are the additional attributes for creating a profile.

| Account Attribute | Description |
| --- | --- |
| START\_DATE | The date the user becomes active. The format is yyyy/mm/dd. |
| END\_DATE | The date the user becomes inactive. The format is yyyy/mm/dd. |
| PASSWORD\_EXPR | The mode to be set for password expiration, explained in the table below. |
| PASSWORD\_NO\_OF\_DAYS | This denotes either the number of days or the numbers of accesses to be set for the password expiration mode selected above. |
| EMPLOYEE\_ID | The identifier of the employee. By default, this attribute is disabled. It must be mapped to the corresponding PERSON\_ID attribute of the Oracle HRMS Application when you select any of the following three Account Aggregation Filters: Aggregate only employees, Aggregate only contractors, and Aggregate employees and contractors. The value of this EMPLOYEE\_ID attribute must be the same as the PERSON\_ID of the Oracle HRMS account. The mapping is optional for the Aggregate all users from the FND\_USER table in the Oracle E-Business filter. |

The following table has more information on the two password attributes: PASSWORD\_EXPR and PASSWORD\_NO\_OF\_DAYS.

| PASSWORD\_EXPR | PASSWORD\_NO\_OF\_DAYS | Action |
| --- | --- | --- |
| NONE | N. A. | Creates the user account with the password expiration set to none. |
| DAYS | Any Integer | Creates user account with the password expiration set to \\\<integer\> days, after these \\\<integer\> days the user is prompted to change the password. |
| ACCESS | Any Integer | Creates the user account with the password expiration set to \\\<integer\> accesses, after these \\\<integer\> accesses the user is prompted to change the password. |

## Additional Information

The Oracle E-Business source correctly updates the WHO columns while provisioning the entitlement. You can change the type of value mapped to a provisioned attribute. Refer to [Mapping Attributes](<https://documentation.sailpoint.com/saas/help/provisioning/create_profile.html#mapping-attributes>) for more information. You can also [reorder](<https://documentation.sailpoint.com/saas/help/provisioning/create_profile.html#reordering-attributes>) the attributes if needed. For more information on editing the profile on a source, refer to [How can I edit the Create Profile on a source?](<https://documentation.sailpoint.com/saas/help/provisioning/create_profile.html>) You can work with [Services](<https://community.sailpoint.com/knowledge/collection/working-with-services>) to define a Create Profile page specific to the requirements of your organization.

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Oracle E-Business Suite connector uses the following default correlation and object configurations.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| USER\_NAME | Account |
| RESPONSIBILITY\_ID | Responsibility GroupObjectType |
| NAME | Role GroupObjectType |
| MENU\_ID | Menu GroupObjectType |

### Default Account Attributes

The Oracle E-Business Suite connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| USER\_NAME | Application username (what a user types in at the Oracle Applications sign-on screen). This is an Account ID which must not be changed. |
| USER\_ID | The application user identifier. |
| START\_DATE | The date the user name becomes active. |
| END\_DATE | The date the user name becomes inactive. |
| DESCRIPTION | The description. |
| PASSWORD\_DATE | The date the current password was set. |
| PASSWORD\_EXPR | The number of accesses left for the password. |
| PASSWORD\_NO\_OF\_DAYS | The number of accesses allowed for the password. |
| EMAIL\_ADDRESS | The electronic mail address for the user. |
| FAX | The fax number for the user. |
| EMPLOYEE\_ID | The identifier of the employee to whom the application username is assigned. |
| EMPLOYEE\_NUMBER | The unique number of the employee. |
| FULL\_NAME | The full name of the user. |
| CUSTOMER\_ID | The customer contact identifier. If the AOL user is a customer contact, this value is a foreign key to the corresponding customer contact. |
| CUSTOMER\_NAME | The customer name. |
| RESPONSIBILITIES | The responsibilities assigned to a user. |
| ROLES | The roles assigned to a user. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The Oracle E-Business Suite connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute Name | Description |
| --- | --- |
| RESPONSIBILITY\_NAME | The name of the responsibility. |
| APPLICATION\_NAME | The application that owns the information for the responsibility. |
| RESPONSIBILITY\_ID | The responsibility identifier. This is an Account ID which must not be changed. |
| RESPONSIBILITY\_KEY | The internal developer name for responsibility. |
| START\_DATE | The date the responsibility becomes active. |
| END\_DATE | The date the responsibility expires. |
| DESCRIPTION | The description |
| STATUS | Shows the status of the responsibility. |
| VERSION | The version. |
| WEB\_HOST\_NAME | The IP address or alias of the computer where the Webserver is running. Defaults to the last agent. |
| WEB\_AGENT\_NAME | The name of Oracle Web Agent. Defaults to the last agent. |
| DATA\_GROUP\_APPL\_NAME | The name of the data group application. |
| REQUEST\_GROUP\_APPL\_NAME | The request group application name. |
| DATA\_GROUP\_ID | The identifier of the data group. |
| DATA\_GROUP\_NAME | The name of the Data Group. |
| MENU\_NAME | The name of the menu. |
| REQUEST\_GROUP\_NAME | The request group name. |

# Enable Connector Logging

This topic provides the steps needed to enable logging on SailPoint using REST APIs.

> [!NOTE]
>
> This topic only applies to VA-based integrations.

> [!NOTE]
>
> The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector.

This process is broken up into four steps:

1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging.
2. Get the logging configuration for the existing VA cluster.
3. Update the VA cluster to enable logging levels.
4. Observe logging changes to the logging levels.

### Identify the Virtual Appliance Cluster

Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>).

1. Make the following call to the REST API to return a list of available VA clusters:

   GET /v3/managed-clusters

   The REST API returns a response that looks similar to the following:

   ```json
   [
       {
           "id": "2c9180866166b5b0016167c32ef31a66",
           "name": "Development Cluster",
           "description": "Development Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": null
       },
       {
           "id": "2c9180846a93ce60016ab29f039944de",
           "name": "Cloud Cluster",
           "description": "Cloud Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": {
               "clientId": null,
               "durationMinutes": 60,
               "expiration": "2020-12-15T19:13:36.079Z",
               "rootLevel": "DEBUG",
               "logLevels": {
                   "sailpoint.connector.ADLDAPConnector": "DEBUG"
               }
           }
       }
   ]
   ```

   > **Note**
   >
   > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster.
2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute.

### Get the Logging Configuration

Get your selected VA's cluster logging configuration and identify the values you need to update.

1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   GET /v3/managed-clusters/{id}/log-config

   - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response.
   - If the VA has an existing logging configuration, it returns something similar to the following:

     ```json
     {
         "clientId": null,
         "durationMinutes": 60,
         "expiration": "2020-12-15T19:13:36.079Z",
         "rootLevel": "DEBUG",
         "logLevels": {
             "sailpoint.connector.ADLDAPConnector": "DEBUG"
         }
     }
     ```

     You'll need to configure the following information in the response:

     - `durationMinutes` is the number of minutes logging should remain enabled.
     - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
     - `logLevels` is a map object with logging classes as keys and logging levels as values.

       - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
       - For a list of available values, refer to [Logging Levels](<#logging-levels>).

### Update Logging Configuration

Update the VA cluster configuration returned by the REST API to update the logging settings as needed.

1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   PUT /v3/managed-clusters/{id}/log-config
2. Submit your configuration changes to the REST API in a JSON body.

   - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one.
   - If the VA returned a configuration, you can edit it to include the changes.

   The JSON body should be as follows:

   ```json
   {
       "durationMinutes": 60,
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

   Consider the following as you edit the JSON:

   - `durationMinutes` is the number of minutes logging should remain enabled.
   - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
   - `logLevels` is a map object with logging classes as keys and logging levels as values.

     - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
     - For a list of available values, refer to [Logging Levels](<#logging-levels>).

   If the update was successful, the REST API should return a response similar to the following:

   ```json
   {
       "clientId": null,
       "durationMinutes": 60,
       "expiration": "2020-12-15T19:13:36.079Z",
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

### Observe Logging Changes

Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**.

### References

The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file.

#### Logging Levels

| Logging Level | Description |
| --- | --- |
| ERROR | Designates error events that might still allow the connector to continue. |
| WARN | Designates potentially harmful situations. |
| INFO | Designates information messages that highlight process at a coarse-grain level. |
| DEBUG | Very verbose. Fine grain logging levels used for development and debugging. |
| TRACE | Most verbose. Finer grain logging levels than debugging. |

#### Logging Classes

| Connector | Logging Class |
| --- | --- |
| Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector |
| AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector |
| Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT |
| Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector |
| Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector |
| Microsoft Entra ID | sailpoint.connector.AzureADConnector |
| Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter |
| Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter |
| Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT |
| Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter |
| Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter |
| GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter |
| Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter |
| IBM i | openconnector.connector.IBMiConnector |
| Lotus Domino | sailpoint.connector.LotusDomino |
| JDBC | sailpoint.connector.JDBCConnector |
| Sun One LDAP | sailpoint.connector.LDAPConnector |
| Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector |
| Microsoft Office365 | sailpoint.connector.Office365Connector |
| Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 |
| Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT |
| Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector |
| Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector |
| Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter |
| Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector |
| Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector |
| Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector |
| PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter |
| PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector |
| RemedyForce | sailpoint.connector.ForceConnector |
| RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter |
| Salesforce | sailpoint.connector.ForceConnector |
| SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector |
| SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector |
| SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT |
| SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector |
| SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter |
| SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter |
| ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter |
| ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter |
| Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter |
| Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter |
| Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter |
| SuccessFactors | sailpoint.connector.SuccessFactorsConnector |
| Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector |
| Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter |
| Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter |
| Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter |
| Web Services | sailpoint.connector.WebServices |
| XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter |
| Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter |
| Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter |

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## User with same employee id is not fetched in aggregation

**Resolution**: Add following entries in application, update the source, and retest use case:

```xml
<entry key="useEffectiveDate">
<value>
<Boolean>false</Boolean>
</value>
</entry>

<entry key="aggregateActiveAccounts">
<value>
<Boolean>true</Boolean>
</value>
</entry>
```

## Missing or blank responsibilities under user account attributes after account aggregation

**Issue**: Responsibilities aggregate successfully during entitlement aggregation but appear blank or missing under user account attributes after account aggregation, even though the responsibilities are assigned in Oracle EBS.

**Resolution**: Update the source configuration to enable indirect assignments:

1. Contact SailPoint Support or have your authorized administrator execute a PATCH request using the [Update Source API](<https://developer.sailpoint.com/docs/api/v2025/update-source/>) for the target source ID.
2. In the PATCH request, set `disableIndirectAssignment` to false.
3. After updating the configuration, run the following aggregations in order:

   - Entitlement aggregation
   - Account aggregation
4. Verify that the missing responsibilities now appear under account attributes.

   > **Note**
   >
   > The `disableIndirectAssignment` setting is not available in the SailPoint UI. You must update this setting through the API. Contact SailPoint Support or an authorized administrator to make this change.

## ORA-00918: column ambiguously defined

**Issue**: Error occurred during ORA-00918: column ambiguously defined operation.

`sailpoint.connector.ConnectorException: ORA-00918: column ambiguously defined`

**Resolution**: Remove the `PASSWORD_LIFESPAN_ACCESSES` and `PASSWORD_LIFESPAN_DAYS` attributes from the `Account` schema if they were manually or additionally added. Keep all out-of-the-box (OOTB) attributes unchanged.

## FND\_USER\_PKG error during provisioning

**Issue**: Provisioning fails with the error java.sql.SQLException: ORA-06550: line 1, column 7:\\nPLS-00201: identifier 'FND\_USER\_PKG' must be declared\\nORA-06550: line 1, column 7:\\nPL/SQL: Statement ignored

**Resolution**: The following attribute can be added to the source to disable FND\_GLOBAL.APPS\_INITIALIZE: key=disableInitializeSession value=true

## Provisioning fails with a Custom user name validation error

`"<Message key="[ ConnectorException ] &#xA; [ Error details ] Error occurred during Create operation. Please check the logs. Error: ORA-20001: Custom user name validation in subscription to event oracle.fnd.user.name.vali&#xA;date failed.&#xA;ORA-06512: at &quot;APPS.APP_EXCEPTION&quot;, line 72&#xA;ORA-06512: at &quot;APPS.FND_USER_PKG&quot;, line 4207&#xA;ORA-06512: at &quot;APPS.FND_USER_PKG&quot;, line 1328&#xA;ORA-06512: at &quot;APPS.FND_USER_PKG&quot;, line 1599&#xA;ORA-06512: at &quot;APPS.FND_USER_PKG&quot;, line 1718&#xA;ORA-06512: at line 1&#xA;" type="Error"/>."`

**Resolution**: For Oracle E-Business version 12.2.4 and later, ensure the service account has been provided with the permissions using AD\_ZD.GRANT\_PRIVS API only. For more information, refer to [Support for AD\_ZD.GRANT\_PRIVS Package](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/additional_information.html#support-for-ad_zdgrant_privs-package>). All other permissions are as outlined in [Required Permissions](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/index.html#required-permissions>).

## Need to set END\_DATE to NULL value for Modify provisioning operation

Refer to the below sample plan:

```xml
<ProvisioningPlan>
    <AccountRequest op="Modify">
        <AttributeRequest name="END_DATE" op="Set" value="NULL" />
            <Attributes>
                <Map>
                    <entry key="assignment" value="true" />
                </Map>
            </Attributes>
        </AttributeRequest>
    </AccountRequest>
</ProvisioningPlan>
```

The date can also be set to NULL by using the julian date format by passing the END\_DATE value as to\_date('2', 'j').

## Provisioning and Aggregation fails with an error message

```text
sailpoint.connector.InsufficientPermissionException: [ InsufficientPermissionException ] 391 [
Possible suggestions ] Service account does not have sufficient privileges. 392 [ Error details ]
Error occurred while establishing the connection with Oracle EBS Server during Provisioning
operation. ORA-00942: table or view does not exist
```

**Resolution**: Verify the permission mismatch by referring to the [Validating Service Account Permissions on Oracle E-Business](<https://community.sailpoint.com/knowledge/Validating-Service-Account-Permissions-on-Oracle-E-Business>) document.

## RA\_Customers table not found when managing Oracle version 12c

If you are using the SailPoint connector for Oracle ERP - Oracle E-Business Suite to manage Oracle version 12c or later, the Integration Module installation expects a table named `RA_Customers`. This table was renamed to `AR_Customers` in Oracle versions 12c and later.

**Resolution**: Make a synonym for the `AR_Customers` table in Oracle and call it `RA_Customers`.

For example:

```sql
create synonym ra_customers for apps.ar_customers;
```

## A user must be rehired who is disabled in the native system

When a user must be rehired who is disabled in the native system, the following error message appears on the native system:

```text
User already exists
```

**Resolution**: To rehire a user who is disabled in the native system, run an account aggregation. This corrects the account status in SailPoint. Enable the account from SailPoint or the native system.

## A new user with an existing user name on the native system in a disabled state must be newly hired

When a new user must be hired with an old user name that is in a disabled state on the native system, the following error message appears on the native system:

```text
User already exists
```

**Resolution**: The connector does not have the old user details for the account that is disabled on the native system, so the create account request fails. Enter a new name for the new user.

## The create account operation fails with an error

```text
Missing IN or OUT parameter at index
```

**Resolution**: Ensure that all the mandatory fields for create account operations are entered.

## Account aggregation fails with an error

```text
ORA-00980 synonym translation is no longer valid error
```

**Resolution**: Assign new permissions using the following:

```text
alter use ${newuser} enable editions;
```

## Table with columns defined in 'Required Columns' filter is not showing in security extract.

**Resolution**:

- Make sure that the table name with required columns list is also added as table name under the 'Additional Table Filters' section (with or without table filter).
- Also make sure that the Service Account used for connection has right permission to access Additional Tables from database.

> [!NOTE]
>
> **Screenshot**
>
> [![Troubleshooting Additional Table](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/troubleshooting_additional_table_image.png>)](<https://documentation.sailpoint.com/connectors/oracle/ebusiness_suite/va/help/img/troubleshooting_additional_table_image.png>)

## New create and disable users are not fetched in aggregation when Account Aggregation Filters filter set to Aggregate only employees.

**Resolution**: When a user is initially created or disabled there is no responsibility added to it. It is created in fnd\_users table. To aggregate such users set "Account Aggregation Filters" to "Aggregate all users from FND\_USER table in Oracle E-Business".

## Enable Operation Fails with ORA-20001

**Issue**: Enabling the account fails with the following error:

```text
ORA-20001: Description format is incorrect. Correct format is [Position Name]|[GUID].
```

**Resolution**: The enable operation failed because `ebsDescription` was missing the Position Name. Oracle received `|GUID` instead of `Position Name|GUID`.

Update the transform so it populates `ebsDescription` in the format `Position Name|GUID`.

# Timeout Errors and Settings

Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down.

This document is designed to give specific information that can be used to resolve these errors.

Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error.

> [!IMPORTANT]
>
> Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail.

To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### aggregateTimeout

**Description:** This parameter is set for the aggregation timeout, measured in seconds.

**Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds.

For example:

If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/aggregateTimeout",
        "value": 600
    }
]
```

### healthCheckTimeout

**Description:** This parameter is set for the test connection and health check timeout.

**Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again.

For example:

If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/healthCheckTimeout",
        "value": 45
    }
]
```

### provisioningTimeout

**Description:** This parameter is set for provisioning timeout.

**Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds.

For example:

If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/provisioningTimeout",
        "value": 360
    }
]
```

### timeout

**Description:** This parameter is set for pass-through authentication timeout.

**Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again.

For example:

If your current time value is 15 seconds, update the `timeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeout",
        "value": 30
    }
]
```

### apiTimeout

**Description:** This parameter is set for API time tracking; customers can check it using an external tool.

**Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again.

For example:

If your current time value is 60 seconds, update the `apiTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/apiTimeout",
        "value": "75"
    }
]
```

### timeoutInSeconds

**Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests.

For example:

If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeoutInSeconds",
        "value": "15"
    }
]
```