Integrating SailPoint with Oracle HCM Cloud

Connecting SailPoint to your Oracle HCM system allows you to seamlessly automate your Joiner, Mover, and Leaver functions. This guide provides the information you need to configure the Oracle HCM Cloud connector in SailPoint as a source of identity data.

Supported Features

SailPoint's Oracle HCM Cloud supports the following features:

• Full Account Aggregation
• Single Account Aggregation
• Delta Aggregation
• Discover Schema
• Update Account

Update Account Operation

The Update Account operation is only supported for the following attributes:

• USER_NAME
• WORK_EMAIL

Supported Use Cases

Prerequisites

• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.

To connect SailPoint to your Oracle HCM system for aggregation, you need to export the HCM data in three separate files. For more information, refer to the following:

Create HCM Export Files for Account Aggregation

To support proper account aggregation with the Oracle HCM source, you must first export the account data into three CSV files. These files should then be saved into an FTP server that both the source and the connector can access. These files and the FTP server they reside in serve as the middleware required for entitlement management in the Oracle HCM system.

The data in these three files enables the connector to differentiate between new hires and rehires. It also enables the source to populate data points which enable it to trigger the Joiner, Mover, and Leaver workflows more effectively.

For more information, refer to Fusion Cloud HCM Integration with External Entitlement Management Systems in the Oracle documentation.

You need to export HCM account data into the following three files, depending on the account type:

• Active Workers File - Includes an export of all the active person details from the HCM system.
• Terminated Workers File - Includes terminated person details that are within the Past Termination Offset setting. For more information, refer to Aggregation Settings.
• Future Workers File - Includes an export of all the future hires and active person future employment details that are within the Future Offset setting. For more information, refer to Aggregation Settings.

Export File Requirements

This section lists specific requirements that each generated aggregation file must meet to support account aggregation operations. If any of the requirements aren't met, you may experience unexpected results during account aggregation or the aggregation process may fail.

• All three generated files must be in CSV format with a comma delimiter (,).
• If a value in any of the three CSV files is a special character, such as a comma (,), enclose it with double quotes (").
• All three files must be PGP encrypted and signed using a separate public and private key. SailPoint recommends that you have FIPS compliant algorithms enabled on an SFTP server.
• All three files must use UTF-8 encoding.

• All three files must include the following attributes listed as headers.

  Caution

  The following schema attributes are case-sensitive, and must contain only capital letters. Lower-case letters are not accepted.

  Warning

  Do not edit or delete any of the default schema attributes listed below from any file. Removing or editing these fields will cause aggregation processes to fail.

  Sr. No	Schema Attribute Name
  1	PERSON_NUMBER
  2	HIRE_DATE
  3	TERMINATION_DATE
  4	PERIOD_OF_SERVICE_ID
  5	WORKER_TYPE
  6	WORKRELATIONSHIP_PRIMARY_FLAG
  7	ASSIGNMENT_ACTION_CODE
  8	ASSIGNMENT_EFFECTIVE_START_DATE
  9	ASSIGNMENT_EFFECTIVE_END_DATE
  10	ASSIGNMENT_PRIMARY_FLAG
  11	ASSIGNMENT_STATUS
  12	WORK_EMAIL

  Additionally, the WORKER_TYPE attribute must be mapped to include the following possible values:

  Caution

  The configured attribute value is case-sensitive, and it must use capital letters. Lower-case letter values are not accepted.

  Attribute Value	Definition
  E	Employees
  P	Pending Workers
  C	Contingent Workers
  N	Non-workers

  For example:

  WORKER_TYPE="E"
  

Example Use Cases

These examples are used to describe how additional attributes are fetched by the connector. For more information on additional attributes, refer to Additional Account Attributes.

Case 1

File content - The Terminated Workers File will include the entry of current employment information, and the Future Workers File will include the entry of future employment information.

Aggregation behavior - The person will be aggregated as a terminated contractor with the following additional attributes:

Case 2

A worker is active, but their employment is scheduled to terminate in the future.

File content - The Active Workers File will include current active employment information, and the Future Workers File will include the contract end date.

Aggregation behavior - The person will be aggregated as an active employee with the following additional attributes:

Delta Aggregation via Worker CSV Extractor

If you use the Worker CSV Extractor for delta aggregation, you must prepare three separate delta extract files (Active, Future, and Terminated) that contain only the records that changed since the last run. These files follow the same schema requirements as the full aggregation files.

In Oracle, configure the HCM Extract in change-only mode by enabling Include Changes from Last Successful Run. For configuration steps, refer to Configuring HCM Extract with change only mode.

Configuration for Delta Aggregation

The following steps must be followed in the Oracle Fusion HCM system to enable the ATOM feeds API:

1. Go to Setup and Maintenance > Manage HCM Atom Feeds.

   1. Select the Person's Assignment Changed Atom feed.
   2. Click the Other Events tab.
   3. Review and select the events “Trigger on New Hire Event”.
   4. Save the changes.

2. Go to Setup and Maintenance > Manage Administrator Profile Value.

   1. Search for the ORA_HRC_ATOM_OTHER_EVENTS_IN_ASG profile option using the profile option code.
   2. Set the profile value to "Y" to make the configuration effective.
   3. Save the changes.

Configuring HCM Extract with Change Only Mode

HCM Extracts

The HCM Extracts feature generates data files and reports. It provides a dedicated interface where you can specify the exact records and attributes to extract.

By using this feature, you can:

• Identify records for extraction by using complex selection criteria.
• Define data elements in an HCM extract by using fast formula database items and rules.

You can configure the HCM Extract in change-only mode. In this mode, the system compares the current data status with baseline data from previous runs to identify new or modified records.

Steps to configure HCM Extract with change only mode

1. When you create the extract, go to the Additional Details section and select Yes for Changes Only. Selecting Yes automatically applies the Include Changes from Last Successful Run parameter, which calculates the delta result by comparing the current data with the last successful run and returning only the changed records.
2. Specify the Threading Database Item as a unique database item. If you use views that combine multiple tables, verify that this key has a Primary Key and Foreign Key relationship with all underlying tables.
3. Verify that the attribute used as the Threading Database Item is configured as a Key Attribute and set to Always Display in the HCM Extract.
4. Complete the remaining standard configuration steps. For more information, refer to Oracle HCM Cloud Export File Guide.
5. Submit the extract based on the run type:
   1. First extract run: Select All attributes. This creates a data baseline for future delta runs.
   2. Subsequent runs: Select Changed attributes for all future scheduled runs.

Important Considerations

The queries defined for the changed extracts should respect the Future and Termination offsets specified in the application.

Required Permissions

The following minimum permissions are required to access the SFTP server:

Select an approach to view the minimum permissions required to perform operations:

Approach 1 - Role-Based Configuration

The following minimum permissions are required to perform operations

Step 1: Create an HCM Duty Role

1. Go to Tools > Security Console > Roles > Create Role.
2. Set the Role Category to HCM - Duty Roles.

3. Under Function Security Policies, add the permissions listed in the following table:

   Operation	Required Permission
   Single Account Aggregation	Use REST Service - Collective Agreements List of Values Use REST Service - Identity Integration Use REST Service - Workers View Person View User Accounts
   Update Account	Use REST Service - Workers Use REST Service - Collective Agreements List of Values View User Account Use REST Service - Identity Integration
   Delta Aggregation	Use Atom Feed - Employees Workspace

Step 2: Create an HCM Job Role

1. Go to Tools > Security Console > Roles > Create Role.
2. Set the Role Category to HCM - Job Roles.
3. Under Data Security Policies, create the policies listed in the following table:

4. Under Role Hierarchy, include the HCM Duty Role you created in step 1.
5. Select Next, then Submit.
6. Go to Tools > Scheduled Processes > Retrieve Latest LDAP Changes and Send Pending LDAP Requests to execute the processes.

Step 3: Create an HCM Data Role

1. Go to My Client Groups > Workforce Structures > Data Roles and Security Profiles.
2. Select Create, and assign a name as required.
3. In Inherited Job Role, select the HCM Job Role you created in step 2.

4. Set the following:

   • Country Security Profile: View All Countries
   • Organization Security Profile: View All Organizations
   • Position Security Profile: View All Positions
   • Person Security Profile: View All People
   • Public Person Security Profile: View All People

5. Select Submit.

6. Go to Tools > Scheduled Processes > Retrieve Latest LDAP Changes and Send Pending LDAP Requests to execute the processes.

Step 4: Create a User and Assign the HCM Data Role

1. Go to Tools > Security Console > Users > Add User Account, then enter the user information.
2. Select Add Role, and assign the HCM Data Role you created.
3. Go to Tools > Scheduled Processes > Retrieve Latest LDAP Changes and Send Pending LDAP Requests to execute the processes.

Approach 2 - Using the Integration Specialist Role

Create a service account with the following required permissions:

1. Go to the Security Console, search for the Human Capital Management Integration Specialist job role and use Copy Role to create a custom job role.

2. In the Function Security Policies tab, assign the following policies:

   • Use REST Service - Workers
   • Use ATOM Feed - Employees Workspace
   • Use REST Service - Identity Integration (ASE_REST_SERVICE_ACCESS_IDENTITY_INTEGRATION_PRIV)
   • View User Account (ASE_VIEW_USER_ACCOUNT_PRIV)

   Note

   The last two permissions are required only for the Get and Update functionality of the User Name and Email.

3. In the Data Security Policies section, select Create Data Security Policy to add data security policies to the role.

4. Add the following data policy attributes:

   • Name: Choose Person
   • Database Resource: Person Detail
   • Start Date: System date
   • Data Set: Select by instance set
   • Condition Name: Access the person for the PER_ALL_PEOPLE_F table for people in the Person and Assignment Security profile.
   • Actions: Choose Person

5. Select OK.

6. In Create Data Security Policy add the following data policy attributes:

   • Name: Choose Application Reference Territory
   • Database Resource: FND_TERRITORIES_B
   • Start Date: System date
   • Data Set: Select by instance set
   • Condition Name: Access the application reference territory for table FND_TERRITORIES_B for countries in the country security profile.
   • Actions: Choose Application Reference Territory

7. Select OK, and confirm that the newly created data policies have been assigned to the application role.

8. On the Summary and Impact Report section, select Save and Close.
9. Execute the Retrieve Latest LDAP Changes process.
10. Create a new Data Role from the Manage Data Role and Security Profiles page, which holds only the new custom Job role. Add the security policies as needed.
11. Go to View > Security Profiles > View All to view security criteria and set it as per your requirement.
12. Repeat the steps for the rest of the security criteria. Select Next, and then Submit.
13. Create the user account and assign the newly created role to this user account.
14. Execute the Retrieve Latest LDAP Changes and Send Pending LDAP Requests processes.
15. For a new user, assign the new Data Role that has been created.
16. Re-execute the Retrieve Latest LDAP Changes and Send Pending LDAP Requests processes.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.