# Integrating SailPoint with Oracle EPM Cloud - AR SaaS

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

The Oracle Cloud Enterprise Performance Management Account Reconciliation (Oracle EPM Cloud AR) integration helps with the governance of accounts and groups. Its end-to-end account management capabilities provide deep identity governance.

- The Oracle EPM Cloud connector uses the Oracle REST APIs.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Oracle EPM Cloud - AR SaaS connector supports the following features:

> [!NOTE]
>
> Before you can use any of the following items marked with an asterisk (\*), SailPoint must activate the feature for your site.

- Aggregation

  - Aggregate users
  - Aggregate Roles &amp; Groups as Entitlement

    - The PredefinedRole, ApplicationRole, Group, and IDCSGroup are the group objects.

  > **Note**
  >
  > - The system supports aggregation of directly &amp; indirectly (via IDCS groups) assigned predefined roles.
  > - To use Interop REST-based roles/groups aggregation, enable **Aggregate All EPM Entitlements** in the application configuration. If disabled, legacy/report-based catalogs are used.
- \*Provision the accounts

  - Create, Update, Delete

  > **Note**
  >
  > - To create an EPM account, it is mandatory to assign predefined roles and/or IDCS Groups to a user.
  > - The system supports the **Update** account attributes operation only for First Name, Last Name, and Email.
- Add / Remove Entitlement
- \*Access Certifications (certification of entitlements connected to accounts)

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

## Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

> [!NOTE]
>
> **Example**
>
> [![Recommended Privilege Level - High](<https://documentation.sailpoint.com/connectors/oracle/epm_ar/saas/help/img/privilege_level_high.png>)](<https://documentation.sailpoint.com/connectors/oracle/epm_ar/saas/help/img/privilege_level_high.png>)
>
> [![Recommended Privilege Level - Medium](<https://documentation.sailpoint.com/connectors/oracle/epm_ar/saas/help/img/privilege_level_medium.png>)](<https://documentation.sailpoint.com/connectors/oracle/epm_ar/saas/help/img/privilege_level_medium.png>)
>
> [![Recommended Privilege Level - Low](<https://documentation.sailpoint.com/connectors/oracle/epm_ar/saas/help/img/privilege_level_low.png>)](<https://documentation.sailpoint.com/connectors/oracle/epm_ar/saas/help/img/privilege_level_low.png>)

## Supported Managed Systems

The Oracle EPM Cloud - AR SaaS connector supports the following versions and modules:

**Version**

- Oracle Identity Cloud Service - 23.2.92-2301160723 and later
- Enterprise Performance Management Cloud - 23.02.85 and later

## Prerequisites

- It is mandatory to create a Service User with the following roles assigned:

  - Identity Domain Administrator - to access Oracle Identity Cloud Service (IDCS) APIs.
  - Service Administrator - to access Enterprise Performance Management (EPM) module specific APIs.

  > **Note**
  >
  > Assign the Service Administrator role of the desired EPM modules.
- You must set up an IDCS Client application to establish Oracle integration with SailPoint and perform all the operations.
- You must add the Signing Certificate as Trusted Partner Certificate and also import the same into the IDCS Client Application.

### Create a Service User in Oracle Identity Cloud Service (IDCS)

The Oracle EPM Cloud system requires a service user with a specifically configured service role to connect with SailPoint.

**Create Service User**

1. Go to the **Users** menu in Identity Cloud Service portal.
2. Select **Add (+)** to add service user details.

   1. Enter the user's **First Name** (optional) and mandatory fields **Last Name** and **User Name/Email**.
   2. Alternatively, you may choose to use the separate **User Name** and **Email fields**.
3. Select **Finish** to create the user.

**Assign Identity Domain Administrator Role to Service User**

1. Go to the **Security** menu in Identity Cloud Service portal.
2. Select the **Administrators** submenu, and then select the **Identity Domain Administrator** option.
3. Select **Add (+)** and search for the Service User name which was created above to add as an Identity Domain Administrator.

**Assign Service Administrator Role to Service User**

1. Go to the **Oracle Cloud Services** menu in Identity Cloud Service portal.
2. Select your EPM cloud service instance(s).
3. Select the **Application Roles** menu and ensure the Service Administrator role is listed.
4. In the **Service Administrator** role, select the hamburger icon to **Assign Users**.
5. Search for and select the created service user. Select **OK** to assign Service Administrator role of the selected EPM Service instance to the service user.

> [!NOTE]
>
> - The **Service Administrator** role of multiple EPM Services can be assigned to the Service User by repeating the same steps mentioned above.
> - The created service user in IDCS must login, at minimum, to applicable EPM service accounts in order to enable the access to the specific service related REST APIs.

### Create Signing Certificate and Keys

1. **Pre-requisites**: Java JDK8 or later must be preinstalled.
2. Open the terminal / command prompt on the machine (/local) and navigate to the directory where you wish to create the Private/Public keys.
3. Run the following commands one by one (use appropriate pass-codes and pass-phrases where necessary):

   1. **To generate self-signed key pair**:

      ```text
      keytool -genkey -keyalg RSA -alias assert3 -keystore sampleKeystore.jks -storepass Sailpoint@123 -validity 365 -keysize 2048
      ```

      Input the appropriate information:

      ```text
      What is your first and last name?
        [Unknown]:  Test User
      What is the name of your organizational unit?
        [Unknown]:  Sailpoint
      What is the name of your organization?
        [Unknown]:  Sailpoint
      What is the name of your City or Locality?
        [Unknown]:  Pune
      What is the name of your State or Province?
        [Unknown]:  Maharashtra
      What is the two-letter country code for this unit?
        [Unknown]:  IN
      Is CN=Test User, OU=Sailpoint, O=Sailpoint, L=Pune, ST=Maharashtra, C=IN correct?
        [no]:  yes

      Enter key password for <assert3> Sailpoint@123
        (RETURN if same as keystore password):  
      Re-enter new password: Sailpoint@123

      Warning:
      The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore sampleKeystore.jks -destkeystore sampleKeystore.jks -deststoretype pkcs12".
      ```

      This command will create a unique keystore on the machine, for example *sampleKeystore.jks*
   2. **To export the public key for signing the JWT assertion**:

      ```text
      keytool -exportcert -alias assert3 -file assert3.cer -keystore sampleKeystore.jks -storepass Sailpoint@123
      ```

      This command will create a public key on the machine, for example *assert3.cer*
   3. **To convert the keystore to P12 format**:

      ```text
      keytool -importkeystore -srckeystore sampleKeystore.jks -srcstorepass Sailpoint@123 -srckeypass Sailpoint@123 -srcalias assert3 -destalias assert3 -destkeystore assert3.p12 -deststoretype PKCS12 -deststorepass Sailpoint@123 -destkeypass Sailpoint@123
      ```

      This will create the pkcs12 encoded public key, for example *assert3.p12*
   4. **To export the private key from the P12 keystore**:

      ```text
      openssl pkcs12 -in assert3.p12 -nodes -nocerts -out private3_key.pem
      ```

      This command will create the private key using P12 formatted keystore, for example *private3\_key.pem*

      ```text
      Enter Import Password: Sailpoint@123
      MAC verified OK
      ```
   5. **To extract the private key &amp; public key in a single text file**:

      ```text
      openssl pkcs12 -in assert3.p12 -out keys_out.txt -nodes
      ```

      This command will extract the private and public key in text file, for example *key\_out.txt*

      ```text
      Enter Import Password: Sailpoint@123
      MAC verified OK
      Enter PEM pass phrase: Sailpoint@123
      Verifying - Enter PEM pass phrase: Sailpoint@123
      ```

### Add the Certificate as the Trusted Partner Certificate

1. In the Identity Domain Cloud Service (IDCS), expand the **Navigation Drawer**, select **Settings**, and then **Partner Settings** to open the **Trusted Partner Certificates** page.
2. On the **Trusted Partner Certificates** page in the **Partner Certificates** section, select **Import**.
3. On the **Import** window add the **Alias** (name) of the certificate and select **Browse** to import it from the local machine.

   > **Note**
   >
   > It is recommended to keep the alias of the certificate in IDCS the same as the alias used while creating the certificate on the local machine.
4. Select **Import** and confirm the certificate is imported successfully with the correct **Alias**, showing both the **SHA-1 Thumbprint** and **SHA-256 Thumbprint**, the **Certificate Start Date**, and the **Certificate End Date**.

### Create IDCS Client Application

**Prerequisites**:

- You must have the **Cloud Service Platform** Identity Domain Cloud Service (IDCS).
- You must have the **Role** of Identity Domain Administrator.
- Enable the **Is Refresh Token Allowed** option for Oracle Identity Cloud Service.
- Specify the **Primary Audience**, **Secondary Audience**, and associated scope for the target EPM Cloud Service tenant (instance).

**Configure OAuth for the EPM Cloud Service Tenant**

Go to **Oracle Cloud \> Identity &amp; Security \> Domains \> \[domain\] {OracleIdentityCloudService} \> Oracle cloud services \> \[EPM Cloud Service Tenant\] \> OAuth configuration**.

1. Select **Edit** on the **OAuth configuration** page.
2. Configure application APIs that require OAuth protection and set the desired **Access token expiration (seconds)** value.
3. Select the **Allow token refresh** toggle and set **Refresh token expiration in seconds**.
4. Set **Primary audience** to:

   ```text
   urn:opc:serviceInstanceID=<serviceInstanceId>
   ```
5. Select the **Add secondary audience** toggle.
6. In **Secondary audience**, enter the EPM application base URL only. For example:

   ```text
   https://<tenant>.epm.us-ashburn-1.ocs.oraclecloud.com
   ```
7. Add scope as the mandatory and only value:

   ```text
   urn:opc:resource:consumer::all
   ```
8. Under **Client Configuration**, in **Allowed grant types**, select **Client credentials**.
9. Set **Client type** to **Confidential**.
10. Under **Token issuance policy**, set **Authorized resources** to **Specific**.
11. Verify **App roles** include the following:

    - Identity Domain Administrator
    - User Administrator
    - Me
    - Cloud Gate
    - User Viewer

**Create the Integrated Application**

1. Go to **Oracle Cloud \> Identity &amp; Security \> Domains \> \[domain\] {OracleIdentityCloudService} \> Integrated applications**.
2. Select **Add application**.
3. Select **Confidential Application**, and then select **Launch workflow**.
4. Enter the **Name** and **Description** for the confidential application, and then select **Submit**.
5. Under **Integrated applications**, open the application you created.
6. On the **OAuth configuration** page under **Resource server configuration**, select **Edit OAuth configuration**.
7. Configure the APIs to protect with OAuth and set the desired **Access token expiration (seconds)** value.

   1. Select the **Allow token refresh** toggle and set **Refresh token expiration in seconds**.
   2. Set **Primary audience** to the EPM tenant base URL only. For example:

      ```text
      https://<tenant>.epm.us-ashburn-1.ocs.oraclecloud.com
      ```
8. Under **Client Configuration**, select **Configure this application as a client now**. In **Allowed grant types**, select **Client credentials** and **JWT assertion**.

   1. Set **Client type** to **Confidential**.
   2. Upload the valid certificate and its alias with **Allowed operations** set to **On behalf of** and **Client IP address** set to **Anywhere**.
   3. Under **Token issuance policy**, set **Authorized resources** to **Specific**. Select the **Add resources** toggle.
   4. Add the mandatory scope for your tenant. The value must match the following format:

      ```text
      urn:opc:serviceInstanceID=<serviceInstanceId>urn:opc:resource:consumer::all
      ```
   5. Verify **App roles** include the following:

      - Identity Domain Administrator
      - Service Administrator
      - Me