Integrating SailPoint with Oracle HCM Cloud SaaS

Connecting SailPoint to your Oracle HCM system allows you to seamlessly automate your Joiner, Mover, and Leaver functions. This guide provides the information you need to configure the Oracle HCM Cloud SaaS connector in SailPoint as a source of identity data.

Supported Features

SailPoint's Oracle HCM Cloud SaaS supports the following features:

• Full Account Aggregation
• Single Account Aggregation
• Delta Aggregation
• Discover Schema
• Update Account

Update Account Operation

The Update Account operation is only supported for the following attributes:

• USER_NAME
• WORK_EMAIL

Supported Use Cases

Prerequisites

To connect SailPoint to your Oracle HCM system for aggregation, you need to export the HCM data in three separate files. For more information, refer to the following:

Create HCM Export Files for Account Aggregation

To support proper account aggregation with the Oracle HCM source, you must first export the account data into three CSV files. These files should then be saved into an FTP server that both the source and the connector can access. These files and the FTP server they reside in serve as the middleware required for entitlement management in the Oracle HCM system.

The data in these three files enables the connector to differentiate between new hires and rehires. It also enables the source to populate data points which enable it to trigger the Joiner, Mover, and Leaver workflows more effectively.

For more information, refer to Fusion Cloud HCM Integration with External Entitlement Management Systems in the Oracle documentation.

You need to export HCM account data into the following three files, depending on the account type:

• Active Workers File - Includes an export of all the active person details from the HCM system.
• Terminated Workers File - Includes terminated person details that are within the Past Termination Offset setting. For more information, refer to Aggregation Settings.
• Future Workers File - Includes an export of all the future hires and active person future employment details that are within the Future Offset setting. For more information, refer to Aggregation Settings.

Export File Requirements

This section lists specific requirements that each generated aggregation file must meet to support account aggregation operations. If any of the requirements aren't met, you may experience unexpected results during account aggregation or the aggregation process may fail.

• All three generated files must be in CSV format with a comma delimiter (,).
• If a value in any of the three CSV files is a special character, such as a comma (,), enclose it with double quotes (").
• All three files must be PGP encrypted and signed using a separate public and private key. SailPoint recommends that you have FIPS compliant algorithms enabled on an SFTP server.
• All three files must use UTF-8 encoding.

• All three files must include the following attributes listed as headers.

  Caution

  The following schema attributes are case-sensitive, and must contain only capital letters. Lower-case letters are not accepted.

  Warning

  Do not edit or delete any of the default schema attributes listed below from any file. Removing or editing these fields will cause aggregation processes to fail.

  Sr. No	Schema Attribute Name
  1	PERSON_NUMBER
  2	HIRE_DATE
  3	TERMINATION_DATE
  4	PERIOD_OF_SERVICE_ID
  5	WORKER_TYPE
  6	WORKRELATIONSHIP_PRIMARY_FLAG
  7	ASSIGNMENT_ACTION_CODE
  8	ASSIGNMENT_EFFECTIVE_START_DATE
  9	ASSIGNMENT_EFFECTIVE_END_DATE
  10	ASSIGNMENT_PRIMARY_FLAG
  11	ASSIGNMENT_STATUS
  12	WORK_EMAIL

  Additionally, the WORKER_TYPE attribute must be mapped to include the following possible values:

  Caution

  The configured attribute value is case-sensitive, and it must use capital letters. Lower-case letter values are not accepted.

  Attribute Value	Definition
  E	Employees
  P	Pending Workers
  C	Contingent Workers
  N	Non-workers

  For example:

  WORKER_TYPE="E"
  

Example Use Cases

These examples are used to describe how additional attributes are fetched by the connector. For more information on additional attributes, refer to Additional Account Attributes.

Case 1

File content - The Terminated Workers File will include the entry of current employment information, and the Future Workers File will include the entry of future employment information.

Aggregation behavior - The person will be aggregated as a terminated contractor with the following additional attributes:

Case 2

A worker is active, but their employment is scheduled to terminate in the future.

File content - The Active Workers File will include current active employment information, and the Future Workers File will include the contract end date.

Aggregation behavior - The person will be aggregated as an active employee with the following additional attributes:

Configuration for Delta Aggregation

The following steps must be followed in the Oracle Fusion HCM system to enable the ATOM feeds API:

1. Go to Setup and Maintenance > Manage HCM Atom Feeds.

   1. Select the Person's Assignment Changed Atom feed.
   2. Click the Other Events tab.
   3. Review and select the events “Trigger on New Hire Event”.
   4. Save the changes.

2. Go to Setup and Maintenance > Manage Administrator Profile Value.

   1. Search for the ORA_HRC_ATOM_OTHER_EVENTS_IN_ASG profile option using the profile option code.
   2. Set the profile value to "Y" to make the configuration effective.
   3. Save the changes.

Required Permissions

The following minimum permissions are required to access the SFTP server:

Select an approach to view the minimum permissions required to perform operations:

Approach 1 - Role-Based Configuration

The following minimum permissions are required to perform operations

Step 1: Create an HCM Duty Role

1. Go to Tools > Security Console > Roles > Create Role.
2. Set the Role Category to HCM - Duty Roles.

3. Under Function Security Policies, add the permissions listed in the following table:

   Operation	Required Permission
   Single Account Aggregation	Use REST Service - Collective Agreements List of Values Use REST Service - Identity Integration Use REST Service - Workers View Person View User Accounts
   Update Account	Use REST Service - Workers Use REST Service - Collective Agreements List of Values View User Account Use REST Service - Identity Integration
   Delta Aggregation	Use Atom Feed - Employees Workspace

Step 2: Create an HCM Job Role

1. Go to Tools > Security Console > Roles > Create Role.
2. Set the Role Category to HCM - Job Roles.
3. Under Data Security Policies, create the policies listed in the following table:

4. Under Role Hierarchy, include the HCM Duty Role you created in step 1.
5. Select Next, then Submit.
6. Go to Tools > Scheduled Processes > Retrieve Latest LDAP Changes and Send Pending LDAP Requests to execute the processes.

Step 3: Create an HCM Data Role

1. Go to My Client Groups > Workforce Structures > Data Roles and Security Profiles.
2. Select Create, and assign a name as required.
3. In Inherited Job Role, select the HCM Job Role you created in step 2.

4. Set the following:

   • Country Security Profile: View All Countries
   • Organization Security Profile: View All Organizations
   • Position Security Profile: View All Positions
   • Person Security Profile: View All People
   • Public Person Security Profile: View All People

5. Select Submit.

6. Go to Tools > Scheduled Processes > Retrieve Latest LDAP Changes and Send Pending LDAP Requests to execute the processes.

Step 4: Create a User and Assign the HCM Data Role

1. Go to Tools > Security Console > Users > Add User Account, then enter the user information.
2. Select Add Role, and assign the HCM Data Role you created.
3. Go to Tools > Scheduled Processes > Retrieve Latest LDAP Changes and Send Pending LDAP Requests to execute the processes.

Approach 2 - Using the Integration Specialist Role

Create a service account with the following required permissions:

1. Go to the Security Console, search for the Human Capital Management Integration Specialist job role and use Copy Role to create a custom job role.

2. In the Function Security Policies tab, assign the following policies:

   • Use REST Service - Workers
   • Use ATOM Feed - Employees Workspace
   • Use REST Service - Identity Integration (ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV)
   • View User Account (ASE_VIEW_USER_ACCOUNT_PRIV)

   Note

   The last two permissions are required only for the Get and Update functionality of the User Name and Email.

3. In the Data Security Policies section, select Create Data Security Policy to add data security policies to the role.

4. Add the following data policy attributes:

   • Name: Choose Person
   • Database Resource: Person Detail
   • Start Date: System date
   • Data Set: Select by instance set
   • Condition Name: Access the person for the PER_ALL_PEOPLE_F table for people in the Person and Assignment Security profile.
   • Actions: Choose Person

5. Select OK.

6. In Create Data Security Policy add the following data policy attributes:

   • Name: Choose Application Reference Territory
   • Database Resource: FND_TERRITORIES_B
   • Start Date: System date
   • Data Set: Select by instance set
   • Condition Name: Access the application reference territory for table FND_TERRITORIES_B for countries in the country security profile.
   • Actions: Choose Application Reference Territory

7. Select OK, and confirm that the newly created data policies have been assigned to the application role.

8. On the Summary and Impact Report section, select Save and Close.
9. Execute the Retrieve Latest LDAP Changes process.
10. Create a new Data Role from the Manage Data Role and Security Profiles page, which holds only the new custom Job role. Add the security policies as needed.
11. Go to View > Security Profiles > View All to view security criteria and set it as per your requirement.
12. Repeat the steps for the rest of the security criteria. Select Next, and then Submit.
13. Create the user account and assign the newly created role to this user account.
14. Execute the Retrieve Latest LDAP Changes and Send Pending LDAP Requests processes.
15. For a new user, assign the new Data Role that has been created.
16. Re-execute the Retrieve Latest LDAP Changes and Send Pending LDAP Requests processes.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.