Skip to content

Integrating SailPoint with Oracle EPM Cloud

Integration

This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

Oracle Enterprise Performance Management (EPM) Cloud integration with SailPoint helps in the governance of accounts, roles & groups. End-to-end account management capabilities provide deep governance and visibility into the organization's health.

  • The Oracle EPM Cloud connector uses the Oracle REST APIs.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Oracle EPM Cloud connector supports the following features:

Note

Before you can use any of the following items marked with an asterisk (*), SailPoint must activate the feature for your site.

  • Aggregation

    • Aggregate users
    • Aggregate Roles & Groups as Entitlement
      • The PredefinedRole, ApplicationRole, Group, and IDCSGroup are the group objects.

    Note

    • The system supports aggregation of directly & indirectly (via IDCS groups) assigned predefined roles.
    • To use Interop REST-based roles/groups aggregation, enable Aggregate All EPM Entitlements in the application configuration. If disabled, legacy/report-based catalogs are used.

  • *Provision the accounts

    • Create, Update, Delete

    Note

    • To create an EPM account, it is mandatory to assign predefined roles and/or IDCS Groups to a user.
    • The system supports the Update account attributes operation only for First Name, Last Name, and Email.

  • Add / Remove Entitlement

  • *Access Certifications (certification of entitlements connected to accounts)

For more information on features, refer to Source Features.

Supported Managed Systems

The Oracle EPM Cloud connector supports the following versions and modules:

Version

  • Oracle Identity Cloud Service - 23.2.92-2301160723 and later
  • Enterprise Performance Management Cloud - 23.02.85 and later

Modules

  • Planning
  • Financial Consolidation and Close (FCCS)
  • Account Reconciliation (AR)
  • Narrative Reporting (NR)

Prerequisites

  • Configure at least one virtual appliance (VA) cluster and successfully test the connection.

  • It is mandatory to create a Service User with the following roles assigned:

    • Identity Domain Administrator - to access Oracle Identity Cloud Service (IDCS) APIs.
    • Service Administrator - to access Enterprise Performance Management (EPM) module specific APIs.

    Note

    Assign the Service Administrator role of the desired EPM modules.

  • You must set up an IDCS Client application to establish Oracle integration with SailPoint and perform all the operations.

  • You must add the Signing Certificate as Trusted Partner Certificate and also import the same into the IDCS Client Application.

Create a Service User in Oracle Identity Cloud Service (IDCS)

The Oracle EPM Cloud system requires a service user with a specifically configured service role to connect with SailPoint.

Create Service User

  1. Go to the Users menu in Identity Cloud Service portal.
  2. Select Add (+) to add service user details.
    1. Enter the user's First Name (optional) and mandatory fields Last Name and User Name/Email.
    2. Alternatively, you may choose to use the separate User Name and Email fields.
  3. Select Finish to create the user.

Assign Identity Domain Administrator Role to Service User

  1. Go to the Security menu in Identity Cloud Service portal.
  2. Select the Administrators submenu, and then select the Identity Domain Administrator option.
  3. Select Add (+) and search for the Service User name which was created above to add as an Identity Domain Administrator.

Assign Service Administrator Role to Service User

  1. Go to the Oracle Cloud Services menu in Identity Cloud Service portal.
  2. Select your EPM cloud service instance(s).
  3. Select the Application Roles menu and ensure the Service Administrator role is listed.
  4. In the Service Administrator role, select the hamburger icon to Assign Users.
  5. Search for and select the created service user. Select OK to assign Service Administrator role of the selected EPM Service instance to the service user.

Note

  • The Service Administrator role of multiple EPM Services can be assigned to the Service User by repeating the same steps mentioned above.
  • The created service user in IDCS must login, at minimum, to applicable EPM service accounts in order to enable the access to the specific service related REST APIs.

Create Signing Certificate and Keys

  1. Pre-requisites: Java JDK8 or later must be preinstalled.
  2. Open the terminal / command prompt on the machine (/local) and navigate to the directory where you wish to create the Private/Public keys.

  3. Run the following commands one by one (use appropriate pass-codes and pass-phrases where necessary):

    1. To generate self-signed key pair:

      keytool -genkey -keyalg RSA -alias assert3 -keystore sampleKeystore.jks -storepass Sailpoint@123 -validity 365 -keysize 2048

      Input the appropriate information:

      What is your first and last name?
  [Unknown]:  Test User
What is the name of your organizational unit?
  [Unknown]:  Sailpoint
What is the name of your organization?
  [Unknown]:  Sailpoint
What is the name of your City or Locality?
  [Unknown]:  Pune
What is the name of your State or Province?
  [Unknown]:  Maharashtra
What is the two-letter country code for this unit?
  [Unknown]:  IN
Is CN=Test User, OU=Sailpoint, O=Sailpoint, L=Pune, ST=Maharashtra, C=IN correct?
  [no]:  yes

Enter key password for <assert3> Sailpoint@123
  (RETURN if same as keystore password):  
Re-enter new password: Sailpoint@123

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore sampleKeystore.jks -destkeystore sampleKeystore.jks -deststoretype pkcs12".

      This command will create a unique keystore on the machine, for example sampleKeystore.jks

    2. To export the public key for signing the JWT assertion:

      keytool -exportcert -alias assert3 -file assert3.cer -keystore sampleKeystore.jks -storepass Sailpoint@123

      This command will create a public key on the machine, for example assert3.cer

    3. To convert the keystore to P12 format:

      keytool -importkeystore -srckeystore sampleKeystore.jks -srcstorepass Sailpoint@123 -srckeypass Sailpoint@123 -srcalias assert3 -destalias assert3 -destkeystore assert3.p12 -deststoretype PKCS12 -deststorepass Sailpoint@123 -destkeypass Sailpoint@123

      This will create the pkcs12 encoded public key, for example assert3.p12

    4. To export the private key from the P12 keystore:

      openssl pkcs12 -in assert3.p12 -nodes -nocerts -out private3_key.pem

      This command will create the private key using P12 formatted keystore, for example private3_key.pem

      Enter Import Password: Sailpoint@123
MAC verified OK

    5. To extract the private key & public key in a single text file:

      openssl pkcs12 -in assert3.p12 -out keys_out.txt -nodes

      This command will extract the private and public key in text file, for example key_out.txt

      Enter Import Password: Sailpoint@123
MAC verified OK
Enter PEM pass phrase: Sailpoint@123
Verifying - Enter PEM pass phrase: Sailpoint@123

Add the Certificate as the Trusted Partner Certificate

  1. In the Identity Domain Cloud Service (IDCS), expand the Navigation Drawer, select Settings, and then Partner Settings to open the Trusted Partner Certificates page.
  2. On the Trusted Partner Certificates page in the Partner Certificates section, select Import.

  3. On the Import window add the Alias (name) of the certificate and select Browse to import it from the local machine.

    Note

    It is recommended to keep the alias of the certificate in IDCS the same as the alias used while creating the certificate on the local machine.

  4. Select Import and confirm the certificate is imported successfully with the correct Alias, showing both the SHA-1 Thumbprint and SHA-256 Thumbprint, the Certificate Start Date, and the Certificate End Date.

Create IDCS Client Application

Prerequisites:

  • You must have the Cloud Service Platform Identity Domain Cloud Service (IDCS).
  • You must have the Role of Identity Domain Administrator.
  • Enable the Is Refresh Token Allowed option for Oracle Identity Cloud Service.
  • Specify the Primary Audience, Secondary Audience, and associated scope for the target EPM Cloud Service tenant (instance).

Configure OAuth for the EPM Cloud Service Tenant

Go to Oracle Cloud > Identity & Security > Domains > [domain] {OracleIdentityCloudService} > Oracle cloud services > [EPM Cloud Service Tenant] > OAuth configuration.

  1. Select Edit on the OAuth configuration page.
  2. Configure application APIs that require OAuth protection and set the desired Access token expiration (seconds) value.
  3. Select the Allow token refresh toggle and set Refresh token expiration in seconds.

  4. Set Primary audience to:

    urn:opc:serviceInstanceID=<serviceInstanceId>

  5. Select the Add secondary audience toggle.

  6. In Secondary audience, enter the EPM application base URL only. For example:

    https://<tenant>.epm.us-ashburn-1.ocs.oraclecloud.com

  7. Add scope as the mandatory and only value:

    urn:opc:resource:consumer::all

  8. Under Client Configuration, in Allowed grant types, select Client credentials.

  9. Set Client type to Confidential.
  10. Under Token issuance policy, set Authorized resources to Specific.
  11. Verify App roles include the following:
    • Identity Domain Administrator
    • User Administrator
    • Me
    • Cloud Gate
    • User Viewer

Create the Integrated Application

  1. Go to Oracle Cloud > Identity & Security > Domains > [domain] {OracleIdentityCloudService} > Integrated applications.
  2. Select Add application.
  3. Select Confidential Application, and then select Launch workflow.
  4. Enter the Name and Description for the confidential application, and then select Submit.
  5. Under Integrated applications, open the application you created.
  6. On the OAuth configuration page under Resource server configuration, select Edit OAuth configuration.

  7. Configure the APIs to protect with OAuth and set the desired Access token expiration (seconds) value.

    1. Select the Allow token refresh toggle and set Refresh token expiration in seconds.

    2. Set Primary audience to the EPM tenant base URL only. For example:

      https://<tenant>.epm.us-ashburn-1.ocs.oraclecloud.com

  8. Under Client Configuration, select Configure this application as a client now. In Allowed grant types, select Client credentials and JWT assertion.

    1. Set Client type to Confidential.
    2. Upload the valid certificate and its alias with Allowed operations set to On behalf of and Client IP address set to Anywhere.
    3. Under Token issuance policy, set Authorized resources to Specific. Select the Add resources toggle.

    4. Add the mandatory scope for your tenant. The value must match the following format:

      urn:opc:serviceInstanceID=<serviceInstanceId>urn:opc:resource:consumer::all

    5. Verify App roles include the following:

      • Identity Domain Administrator
      • Service Administrator
      • Me

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.