# SailPoint Oracle HCM Cloud Connector Documentation > Oracle HCM Cloud Connector Documentation # Documentation # Connecting SailPoint and Oracle HCM Cloud To connect SailPoint with Oracle HCM Cloud, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings Use the settings on this page to create a secure, direct connection to the source. These instructions also describe how to configure an export file for use by the Oracle HCM source. > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. Go to **Connection Settings**. 2. In **File Transport**, SFTP mode will be used for accessing the file. 3. Enter the **Host** name where the file is located. 4. Enter the **Port** number that will be used to establish a connection. 5. Enter the **Username** to use during the file transfer. 6. For **Authentication Type**, select **Basic** or **Public Key**. **Basic** is the default. - **Basic** > **Screenshot** > > [![SFTP connection settings with Basic authentication]()]() Enter the **Password** for the user to use during the file transfer. - **Public Key** > **Screenshot** > > [![SFTP connection settings with Public Key authentication]()]() Provide the following details: - **SSH Private Key** - Enter the private key content to use to establish a connection. Paste the full private key in PEM or OpenSSH format. Do not enter a file path. - (Optional) **SSH Private Key Passphrase** - Enter the passphrase for the private key. > **Note** > > The public key that matches this private key must already be installed for the SFTP account. SSH public key authentication is separate from the PGP keys used to sign or decrypt worker files. 7. Provide the fully qualified paths to the Oracle HCM file exports in the FTP server. This enables the connector to differentiate between New Hires and Rehires. It also enables the source to populate data points which enable it to trigger the Joiner, Mover, and Leaver workflows more effectively. For example: ```text /home/sailpoint/File_Export/Details_Active_Encrypted.csv ``` 1. In the **Active Workers File Path** field, enter the fully qualified path of the Active Workers CSV extract file. The first line of the file must contain the column headers. 2. In the **Future Workers File Path** field, enter the fully qualified path of the Future Workers CSV extract file. The first line of the file must contain the column headers. 3. In the **Terminated Workers File Path** field, enter the fully qualified path of the Terminated Workers CSV extract file. The first line of the file must contain the column headers. 8. Select **Disable Integrity Check** to skip the integrity check while establishing the connection to the source. This needs to be done when a PGP public key is not available to sign the file. 9. Enter the **PGP Public Key** generated at the Oracle Fusion HCM system in the same format as shown below: ```text -----BEGIN PGP PUBLIC KEY BLOCK----- Version: BCPG v1.71 lEVFBsA1Iqt4Abh+8dWh3UtTcSuT8KIDYX+OpnVrWAUXMmnKT+JAI7Tk3vtYPiWe7E slg+8m7jXsFfZE5vaJOeFMbMfxC1jVNy+azO/EMg41kKW7pJHCTsGnChrteJ1ocv1iycl NAPf7E==ofag -----END PGP PUBLIC KEY BLOCK----- ``` 10. Enter the **PGP Private Key** generated at the Oracle Fusion HCM system in the same format as shown below: ```text -----BEGIN PGP PRIVATE KEY BLOCK----- Version: BCPG v1.71 lEVFBsA1Iqt4Abh+8dWh3UtTcSuT8KIDYX+OpnVrWAUXMmnKT+JAI7Tk3vtYPiWe7E slg+8m7jXsFfZE5vaJOeFMbMfxC1jVNy+azO/EMg41kKW7pJHCTsGnChrteJ1ocv1iycl NAPf7E==ofag -----END PGP PRIVATE KEY BLOCK----- ``` 11. Enter the **PGP Private Key Password** generated at the Oracle Fusion HCM system. 12. Enter the unique end point **URL** to connect to the Oracle Fusion HCM managed system. For example: ```text https://{yourOracleCloudDomain}.com ``` > **Note** > > SailPoint recommends using HTTPS for a secured connection. 13. In **API Authentication Settings**, for **Authentication Type**, select **Basic Authentication** or **OAuth 2.0 JWT User Assertion**. **Basic Authentication** is the default. > **Note** > > Existing basic authentication configurations continue to work without changes. - **Basic Authentication** Enter the **Username** and **Password** that connects with the end point database. - **OAuth 2.0 JWT User Assertion** > **Screenshot** > > [![OAuth 2.0 JWT User Assertion authentication settings]()]() > **Note** > > One signing certificate signs both the user assertion and the client assertion. For Oracle-side setup, refer to [Configuring OAuth 2.0 JWT User Assertion](<#configuring-oauth-20-jwt-user-assertion>). Provide the following details: - **Username** - The username is the subject of the user assertion. Enter the identity-domain **Username**. Use that value when the username and email differ. - **OAuth Token URL** - Enter the Oracle token endpoint that receives the user assertion and the client assertion. - **OAuth Client ID** - Enter the **Client ID** from the confidential application OAuth configuration page. Do not use the Fusion service parameter `IDCS_CONNECTOR_CLIENT_ID`. - **OAuth Scope** - Enter the Fusion Applications client scope. Copy it from the confidential application **Resources** table, or from the Fusion service parameter `IDCS_CONNECTOR_CLIENT_SCOPE`. Scope values differ by instance. Do not rebuild the string from a screenshot. Do not use the Spectra / Oracle BOSS scope `urn:opc:resource:fusion::boss/`. - **OAuth Audience** - Enter the audience expected by Oracle Identity Cloud Service. The audience is the JWT `aud` claim, normally `https://identity.oraclecloud.com/`. It is separate from the Fusion primary audience used inside the scope. - **Signing Key ID** - Enter the certificate alias (`kid`). - **Signing Private Key** - Enter the PEM-formatted private key. - (Optional) **Private Key Passphrase** - If the signing private key is encrypted, enter its passphrase. 14. Enable **Via API Authentication** if you want to use the API authentication credentials you provide instead of the SFTP server authentication. 15. Select **Enter**. ## Configuring OAuth 2.0 JWT User Assertion Follow [Configure OAuth to Access Oracle Fusion Cloud Applications REST APIs](), section **Configure OAuth Using User Assertion Grant Type**. > [!NOTE] > > Do not change the name of the OAuth token issuer. ### Identifying the Identity Domain and Token URL 1. Sign in to the OCI Identity and Access Management console as an administrator of the identity domain associated with the Fusion Applications instance. 2. Open that domain and copy the **Domain URL** from the domain details page. 3. The **OAuth Token URL** is the **Domain URL** plus `/oauth2/v1/token`. The same endpoint is listed in `https:///.well-known/idcs-configuration`. ### Registering the Confidential Application 1. In that identity domain, open **Integrated applications** and select **Add application**. 2. Select **Confidential Application** and select **Launch workflow**. 3. Enter an application name. Skip the other fields and select **Submit**. 4. In **OAuth configuration**, select **Edit OAuth**, then **Configure this application as a client now**. 5. Under **Authorization**, select only **JWT assertion**. 6. Under **Client type**, select **Trusted**. A trusted client can request access tokens with a signed JWT assertion. 7. Select **Import certificate** and import the public signing certificate that matches the private key stored in SailPoint. Set the certificate alias to the JWT Key Identifier (`kid`). That alias is the connector **Signing Key ID**. 8. Under **Token issuance policy**, set **Authorized resources** to **specific**. 9. Turn on **Add resources**. Select **Add scope**, select **Oracle Applications Cloud (Fusion)**, and add the Fusion client scope described in [Generating the OAuth Scope](<#generating-the-oauth-scope>). Remove any resource that is not required. 10. From the **Actions** menu, select **Activate**, then **Activate application**. 11. On the OAuth configuration page, copy the **Client ID**. That value is the connector **OAuth Client ID**. Do not use the Fusion service parameter `IDCS_CONNECTOR_CLIENT_ID`. Also import the same public certificate in the same domain under **Security** \> **Trusted partner certificates**, using the same alias as the JWT `kid`. Oracle stores one certificate on the confidential application. The connector uses the matching private key to sign both the user assertion and the client assertion. ### Generating the OAuth Scope The connector **OAuth Scope** is the Fusion Applications client scope. Do not use the Spectra / Oracle BOSS scope (`urn:opc:resource:fusion::boss/`). 1. In the same identity domain, open **Oracle Cloud Services** and select **Oracle Applications Cloud (Fusion)**. 2. Go to **OAuth configuration** \> **Configure application APIs that need to be OAuth protected** \> **Scopes**. 3. Copy the primary audience. Oracle shows it in one of these forms: - `urn:opc:resource:fa:instanceid=` - `urn:opc:resource:faaas:fa:` 4. Copy the resource scope. For this connector, use `urn:opc:resource:consumer::all`. 5. Concatenate the primary audience and the resource scope with no space and no extra slash. For example: ```text urn:opc:resource:fa:instanceid=urn:opc:resource:consumer::all ``` 6. Add that exact string on the confidential application **Resources** list. 7. Enter the same string in the connector **OAuth Scope** field. Copy it from the **Resources** table, or from the Fusion service parameter `IDCS_CONNECTOR_CLIENT_SCOPE`. Scope values differ by instance. Do not rebuild the string from a screenshot. **OAuth Audience** is the JWT `aud` claim, normally `https://identity.oraclecloud.com/`. It is separate from the Fusion primary audience used inside the scope. ### Mapping Oracle Values to Connector Fields | Oracle Value | Connector Field | | --- | --- | | **Domain URL** + `/oauth2/v1/token` | OAuth Token URL | | Confidential Application Client ID | OAuth Client ID | | Primary audience concatenated with `urn:opc:resource:consumer::all` | OAuth Scope | | `https://identity.oraclecloud.com/` | OAuth Audience | | Certificate alias (`kid`) | Signing Key ID | | Matching private key | Signing Private Key | | Identity-domain **Username** | Username (user assertion subject) | The API username must be the identity-domain **Username**. Use that value when the username and email differ. ## Aggregation Settings For more information about aggregation, refer to [Loading Account Data](). Use the settings available in **Aggregation Settings** to adjust aggregation processes as required for your organization. > [!NOTE] > > - When full aggregation is triggered, the connector always reads data from CSV files. > - Past and Future offsets for full aggregation are configured under **Filter Condition** when generating the extract. For more information about filter conditions, refer to the [Oracle HCM Cloud Export File Guide](). > - The **Past Termination Offset** and **Future Offset** values are applicable only when delta aggregation is triggered. > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() [![Aggregation Settings]()]() [![Aggregation Settings]()]() [![Aggregation Settings]()]() [![Aggregation Settings]()]() 1. Enable aggregation options as per your requirements: - **Aggregate Employes** will aggregate employee type workers. - **Aggregate Contractors** will aggregate contractor type workers. - **Aggregate Pending Workers** will aggregate pending worker type workers. - **Aggregate Non Workers** will aggregate non worker type workers. > **Note** > > Selection of at least one person type is mandatory 2. Enter the **Page Size** as the number of records to aggregate in a single page when iterating over large datasets, from 1 to 499 records. The default is 100 records. 3. Enable **Delta Aggregation** to aggregate accounts that have changed since the last execution. For more information about supported ATOM feeds, refer to [Delta Aggregation via ATOM Feeds](<#delta-aggregation-via-atom-feeds>). 4. Configure the **Delta Aggregation Page Size** as the number of records to aggregate in a single page when iterating over large datasets, from 1 to 499 records. The default is 100 records. 5. Enable **Delta Aggregation Via Worker CSV Extractor** to aggregate delta accounts by using the Worker CSV Extractor. > **Note** > > Selecting this option configures the connector to read from the delta file paths specified below. When disabled, ATOM Feeds API is used by default. 1. Enter the fully qualified file path and file name of the delta Active Workers CSV extract file in **Delta Active Workers File Path**. 2. Enter the fully qualified file path and file name of the delta Future Workers CSV extract file in **Delta Future Workers File Path**. 3. Enter the fully qualified file path and file name of the delta Terminated Workers CSV extract file in **Delta Terminated Workers File Path**. 6. Enter the **Past Termination Offset** as the number of past days to aggregate terminated workers. For example, the number 14 will aggregate workers whose termination date is within a 14 day range in the past. > **Note** > > This date offset setting applies only to single account aggregation and delta aggregation by using the ATOM Feeds API. It does not apply if **Delta Aggregation Via Worker CSV Extractor** is enabled. 7. Enter the **Future Offset** as the number of days in advance to aggregate future hires and terminations. For example, the number 14 will aggregate workers 14 days in advance of their joining date. > **Note** > > This date offset setting applies only to single account aggregation and delta aggregation by using the ATOM Feeds API. It does not apply if **Delta Aggregation Via Worker CSV Extractor** is enabled. 8. Define **Retryable Errors**, which are error messages from the Oracle Fusion HCM system that, when returned, tell the connector to retry failed operations. Enter the error message in the field provided and press **Enter** to add it to the list. 9. Enter the **Connection Timeout** as the duration of inactivity the connector allows before terminating its connection to the source. The default is 1 minute. 10. Select **Save**. ### Delta Aggregation via ATOM Feeds The Oracle HCM Cloud connector supports delta aggregation for accounts. Delta aggregation aggregates accounts that have changed since the last aggregation. > [!NOTE] > > When **Delta Aggregation Via Worker CSV Extractor** is disabled, the connector uses the Oracle HCM ATOM Feeds API for delta aggregation. For more information about aggregation settings, refer to [Aggregation Settings](<#aggregation-settings>). #### Supported ATOM Feeds When delta aggregation uses the ATOM Feeds API, the Oracle HCM Cloud connector supports the following Atom feeds: | Atom Feed | Feed Code | Description | | --- | --- | --- | | New Hire | `newhire` | Triggered when an employee is hired, a terminated employee is rehired, or a future-dated new hire is created. | | Employee Assignment Update | `empassignment` | Triggered when assignment, salary, or manager information is created, updated, corrected, or deleted, or when assignment flexfields are updated. | | Employee Update | `empupdate` | Triggered when person details such as name, email, phone, address, national identifier, passport, citizenship, religion, or flexfields are created, updated, or corrected. | | Termination | `termination` | Triggered when an employee is terminated. | | Person Work Relationship Cancelled | `cancelworkrelship` | Triggered when a work relationship is cancelled. | | Employee Work Relationship Updated | `workrelshipupdate` | Triggered when the work relationship of an active employee is updated, including changes to the start date and other configured attributes. | ## Attribute Mapping The Oracle HCM Cloud connector uses a combination of REST API, Atom Feeds, and File Export to read data from the Oracle Fusion HCM source. The attribute name in the Oracle File export can be anything you choose. However, the parameter names in the REST API and Atom Feed are rigidly configured. To keep all the information in sync, you must map the attributes properly. > [!NOTE] > > For a list and correlation information of the API parameters, refer to [Employees]() for account attributes and [Assignments]() for entitlement attributes in the Oracle documentation. The linked documents are not maintained by SailPoint and are subject to change without notice. > [!NOTE] > > **Screenshot** > > [![Attribute Mapping]()]() > [!CAUTION] > > Failure to properly map an attribute will result in data not being fetched for the specified attribute. This may result in inconsistent behavior between full, delta, and single account aggregation processes. For example, the three attribute names in the following list all describe the same account attribute. In this example, they describe a given worker's start date. However, it might go by a different attribute name in the Workers Attribute column or the Atom Feeds column. - `HIRE_DATE` - The worker's start date according to the CSV file/Schema Attribute for full aggregation processes. - `workRelationships.StartDate` - The worker's start date according to the Workers Attribute for single account aggregation. - `DateStart` - The worker's start date according to the Atom Feeds Attribute for delta aggregation processes. In the following table, each row represents a single mapped account attribute. You configure which attribute name in each account data file that the connector uses for the attribute. With the information provided earlier, you can map the attribute like it is in the first row. Two other attributes, `PERSON_NUMBER` and `WORKER_TYPE`, are provided as additional examples. | CSV/Schema Attribute | Workers Attribute | Atom Feeds Attribute | | --- | --- | --- | | HIRE\_DATE | workRelationships.StartDate | DateStart | | PERSON\_NUMBER | PersonNumber | PersonNumber | | WORKER\_TYPE | workRelationships.WorkerType | PeriodType | To map an attribute: 1. In the **CSV/Schema Attribute** field, enter the attribute's name in the CSV file extracted from the Oracle HCM source. 2. In the **Workers Attribute** field, enter the corresponding Workers API attribute name of the extract column header. 3. In the **ATOM Feeds Attribute** field, enter the corresponding Atom feeds API attribute name of the extract column header. 4. (*Optional*) Select **Add Another** to add another row to the list to map an additional attribute. Repeat steps 1-3 as needed for each attribute. 5. Select **Save**. > [!NOTE] > > If you want to map an attribute, but there is no corresponding parameter in either the Workers Attribute or Atom Feeds available from Oracle, reach out to Oracle's support team create a new parameter. ## JSON Path Mapping > [!WARNING] > > The `PERSON_NUMBER` attribute should not be updated in the JSON Path Mapping. > [!NOTE] > > **Screenshot** > > [![JSON Path Mapping]()]() ### Full Aggregation The Oracle HCM Cloud connector will aggregate the attributes associated with the primary work relationship and corresponding assignments based on the dates. In order to change this behavior, specify the attribute value as specified below in JSON Path Mapping. This will enable the customer to fetch the work relationship and Job Information in accordance with your requirements. The following API response is an example of how to specify the JSON path query for the `workRelationships` attribute: ```json "workRelationships": [ { "PeriodOfServiceId": 300000034528102, "LegislationCode": "IN", "WorkerType": "E", "PrimaryFlag": true, "StartDate": "2022-08-11", "assignments": [ { "AssignmentId": 300000034528108, … } ] }, "PeriodOfServiceId": 300000034528226, "LegislationCode": "IN", "WorkerType": "N", "PrimaryFlag": false, "StartDate": "2022-08-23", "assignments": [ {"AssignmentId": 300000034528233, … } ] ``` #### Case 1 If concurrent `workRelationships` are active and you want to fetch the attribute from primary `workRelationships` such as `PeriodOfServiceId`, then the JSON path for attribute mapping is: ```text workRelationships[?(@.PrimaryFlag==true)].PeriodOfServiceId ``` #### Case 2 If concurrent `workRelationships` are active and you want to fetch the attribute from secondary `workRelationships` such as `PeriodOfServiceId`, then the JSON path for attribute mapping is: ```text workRelationships[?(@.PrimaryFlag==False)].PeriodOfServiceId ``` #### Case 3 If multiple `workRelationships` attributes are active, the API response looks like the following: ```json "workRelationships": [ { "PeriodOfServiceId": 300000034528102, "LegislationCode": "IN", "WorkerType": "E", "PrimaryFlag": true, "StartDate": "2022-08-11", "assignments": [ {"AssignmentId": 300000034528108, "AssignmentType": "E", "PrimaryFlag": true, "PrimaryAssignmentFlag": true, … } ] }, "PeriodOfServiceId": 300000034528226, "LegislationCode": "IN", "WorkerType": "N", "PrimaryFlag": false, "StartDate": "2022-08-23", "assignments": [ {"AssignmentId": 300000034528233, "AssignmentType": "P", "PrimaryFlag": false, "PrimaryAssignmentFlag": true, … } ] ``` If you want to fetch the attribute from assignments which is primary and belongs to a particular `AssignmentType` such as `AssignmentId`, then the JSON path for attribute mapping is: ```text workRelationships..assignments[?(@.PrimaryAssignmentFlag==true && @.AssignmentType=='E' && @.PrimaryFlag==true)].AssignmentId ``` 1. Select **Add Another** to add a new entry. 2. In each row, enter a **CSV/Schema Attribute** name, its corresponding **JSON Path**, and **ATOM Feeds Attribute**. 3. (*Optional*) Select **Add Another** to add more rows to the list. 4. Select **Save**. ### Delta Aggregation The Oracle ATOM feed API response is divided into the following parts: - Context - Changed Attributes By default, the Oracle HCM Cloud Connector fetches the information from the `Changed Attributes` section. If you want to change this behavior, the **JSON Path** mapping section can be used. For example, ```json Context" : [ { "PersonNameId" : "300000040265075", "PersonName" : " 7939first", "PersonNumber" : "7939", "WorkEmail" : "test@gmail.com", "PrimaryPhoneNumber" : "", "PersonId" : "300000040265074", "PeriodType" : "E", "WorkerType" : "EMP", "DMLOperation" : "UPDATE", } ], "Changed Attributes" : [ { "OrderName" : { "old" : "test", "new" : "test 7939first" } }, { "ListName" : { "old" : "test", "new" : "test1" } }, { "FirstName" : { "old" : null, "new" : "7939first" } }, { "FullName" : { "old" : "test", "new" : "7939first" } }, }, { "Title" : { "old" : null, "new" : "MR." } }, { "MiddleNames" : { "old" : null, "new" : "7939middle" } } ] }] ``` In the following example, the `PersonName` attribute is not available in `Changed Attributes`. Therefore, the connector will not fetch the value out of the box. To fetch it, you can specify the following JSON path. ```text Context[0].PersonName ``` ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Integrating SailPoint with Oracle HCM Cloud Connecting SailPoint to your Oracle HCM system allows you to seamlessly automate your Joiner, Mover, and Leaver functions. This guide provides the information you need to configure the Oracle HCM Cloud connector in SailPoint as a source of identity data. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features SailPoint's Oracle HCM Cloud supports the following features: - Full Account Aggregation - Single Account Aggregation - Delta Aggregation - Discover Schema - Update Account > [!NOTE] > > The Oracle HCM Cloud connector aggregates the attributes associated with the primary work relationship, identified by `workRelationships.PrimaryFlag=true`, and its corresponding assignment whose `workRelationships.assignments.EffectiveStartDate` is closest to the aggregation date. > > An exception applies to Pending Workers. If Oracle marks a currently effective, active Pending Worker work relationship as nonprimary, the connector can select that relationship instead of an inactive or terminated primary Employee work relationship. > > To change this behavior, refer to [JSON Path Mapping](). ### Update Account Operation > [!NOTE] > > - In order for the update operation to work, the source must have attribute synchronization configured. For more information, refer to [Synchronizing Attributes](). > - To update `USER_NAME` and `WORK_EMAIL`, the worker must have an Oracle HCM account on the Oracle tenant. The Update Account operation is only supported for the following attributes: - USER\_NAME - WORK\_EMAIL > [!NOTE] > > The following delta aggregation support applies when you use the ATOM Feeds API. Delta aggregation via Worker CSV Extractor (HCM Extract) works differently and returns all changed records as configured in the Oracle HCM Extract change-only mode. For more information about supported ATOM feeds, refer to [Delta Aggregation via ATOM Feeds](). ### Supported Use Cases | Category | Example | Supported in Full Aggregation | Supported in Delta Aggregation | | --- | --- | --- | --- | | Joiner | A new person who is joining the organization. | Yes | Yes | | Joiner /Rehire use case | A person who was a contractor in the past and is getting rehired as a full time employee. | Yes | Yes | | Joiner /Rehire use case/Conversion use case | A person who has a primary workrelationship as a contractor and a secondary workrelationship assigned as an employee at the time of full aggregation as contractor.
During the employee lifecycle contractor workrelationship, the person is getting terminated. | Yes | No | | Mover use case | The person has a single workrelationship and a single assignment, and now there is a change to that in terms of events, such as the person being promoted, demoted, location changed, etc. | Yes | Yes | | Mover use case | The person has multiple workrelationships with each having multiple assignments, and now there is a change to that in terms of events, such as the person being promoted, demoted, location changed, etc.
The end user is interested in pulling data specific to a particular workrelationship and its associated assignment. | Yes | Partially supported. The Oracle Atom Feeds API has a restriction of not returning the relationship of assignment and its parent work relationship. | | Mover use case | The person is getting promoted with a change in both workrelationship and assignment. | Yes | Yes | | Mover use case | The person has multiple work relationships and assignments with one being primary and the other being secondary.
The end user has a requirement to fetch the primary relationship, and during the employee lifecycle event the primary relationship is getting changed to a secondary relationship, or vice versa. | Yes | No | | Mover use case | The person's manager is getting changed. | Yes | Partially supported. Only line manager changes are supported. | | Leaver use Case | The person is leaving the organization. | Yes | Yes | | Accounts Attribute | Support for fetching the below Information associated with the person: Name details, Address Details, Phone Details, WorkRelationship Details, Assignment details | Yes | Partially supported. Limited attributes are supported in the Oracle Atom Feeds API. For the list of attributes, refer to Oracle's documentation: [REST API for Oracle Fusion Cloud HCM - Employees Attributes]()
[REST API for Oracle Fusion Cloud HCM - Assignment Attributes]()
*Note: The Oracle links provided correspond to the Oracle Fusion HCM 24 D release, and are the latest links as per the Oracle guide.* | | All supported scenarios for a non-worker. For example, joiner, mover and leaver, and account update. | A non-worker is joining the organization. A non-worker is getting promoted. A non-workers is getting terminated. A non-workers person details (such as, first name, email, etc) is getting changed. | Yes | No. The Oracle Atom Feeds API does not support non-workers. | | Back-dated joiner, mover, leaver and account update. | An employee is being terminated with the effective date in the past. An employee is being hired with the effective date in the past. An employee's details (such as, first name, email, etc) is being changed with the effective date in the past. An employee is being promoted with the effective date in the past. | Yes | Partially supported. Changes related to employment (such as hiring, termination, etc) will be captured. | ## Prerequisites - Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](). To connect SailPoint to your Oracle HCM system for aggregation, you need to export the HCM data in three separate files. For more information, refer to the following: ### Create HCM Export Files for Account Aggregation To support proper account aggregation with the Oracle HCM source, you must first export the account data into three CSV files. These files should then be saved into an FTP server that both the source and the connector can access. These files and the FTP server they reside in serve as the middleware required for entitlement management in the Oracle HCM system. The data in these three files enables the connector to differentiate between new hires and rehires. It also enables the source to populate data points which enable it to trigger the Joiner, Mover, and Leaver workflows more effectively. For more information, refer to [Fusion Cloud HCM Integration with External Entitlement Management Systems]() in the Oracle documentation. > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. You need to export HCM account data into the following three files, depending on the account type: - **Active Workers File** - Includes an export of all the active person details from the HCM system. - **Terminated Workers File** - Includes terminated person details that are within the **Past Termination Offset** setting. For more information, refer to [Aggregation Settings](). - **Future Workers File** - Includes an export of all the future hires and active person future employment details that are within the **Future Offset** setting. For more information, refer to [Aggregation Settings](). > [!IMPORTANT] > > It is recommended to configure the SFTP server with FIPS-compliant algorithms to ensure a secure integration. Verify that the export files are stored on an FTP server to which the connector has appropriate read/write access. #### Export File Requirements This section lists specific requirements that each generated aggregation file must meet to support account aggregation operations. If any of the requirements aren't met, you may experience unexpected results during account aggregation or the aggregation process may fail. - All three generated files must be in CSV format with a comma delimiter (`,`). - If a value in any of the three CSV files is a special character, such as a comma (`,`), enclose it with double quotes (`"`). - All three files must be PGP encrypted and signed using a separate public and private key. SailPoint recommends that you have FIPS compliant algorithms enabled on an SFTP server. - All three files must use UTF-8 encoding. - All three files must include the following attributes listed as headers. > **Caution** > > The following schema attributes are case-sensitive, and must contain only capital letters. Lower-case letters are not accepted. > **Warning** > > Do not edit or delete any of the default schema attributes listed below from any file. Removing or editing these fields will cause aggregation processes to fail. | Sr. No | Schema Attribute Name | | --- | --- | | 1 | `PERSON_NUMBER` | | 2 | `HIRE_DATE` | | 3 | `TERMINATION_DATE` | | 4 | `PERIOD_OF_SERVICE_ID` | | 5 | `WORKER_TYPE` | | 6 | `WORKRELATIONSHIP_PRIMARY_FLAG` | | 7 | `ASSIGNMENT_ACTION_CODE` | | 8 | `ASSIGNMENT_EFFECTIVE_START_DATE` | | 9 | `ASSIGNMENT_EFFECTIVE_END_DATE` | | 10 | `ASSIGNMENT_PRIMARY_FLAG` | | 11 | `ASSIGNMENT_STATUS` | | 12 | `WORK_EMAIL` | Additionally, the `WORKER_TYPE` attribute must be mapped to include the following possible values: > **Caution** > > The configured attribute value is case-sensitive, and it must use capital letters. Lower-case letter values are not accepted. | Attribute Value | Definition | | --- | --- | | `E` | Employees | | `P` | Pending Workers | | `C` | Contingent Workers | | `N` | Non-workers | For example: ```text WORKER_TYPE="E" ``` #### Example Use Cases These examples are used to describe how additional attributes are fetched by the connector. For more information on additional attributes, refer to [Additional Account Attributes](). ##### Case 1 File content - The Terminated Workers File will include the entry of current employment information, and the Future Workers File will include the entry of future employment information. Aggregation behavior - The person will be aggregated as a terminated contractor with the following additional attributes: | Attribute | Value | | --- | --- | | `FUTURE_WORKRELATIONSHIP_START_DATE` | Future Hire date will be fetched | | `FUTURE_ASSIGNMENT_ACTION` | The future action of the person becomes “Rehire” | ##### Case 2 A worker is active, but their employment is scheduled to terminate in the future. File content - The Active Workers File will include current active employment information, and the Future Workers File will include the contract end date. Aggregation behavior - The person will be aggregated as an active employee with the following additional attributes: | Attribute | Value | | --- | --- | | `FUTURE_WORKRELATIONSHIP_START_DATE` | Future terminated date will be fetched | | `FUTURE_ASSIGNMENT_ACTION` | The future action of the person becomes “Termination” | > [!NOTE] > > In both of the example `FUTURE_WORKRELATIONSHIP_START_DATE` and `FUTURE_ASSIGNMENT_ACTION` can act as data points which can be configured to trigger Joiner, Leaver, and Mover workflows. ### Delta Aggregation via Worker CSV Extractor If you use the Worker CSV Extractor for delta aggregation, you must prepare three separate delta extract files (Active, Future, and Terminated) that contain only the records that changed since the last run. These files follow the same schema requirements as the full aggregation files. In Oracle, configure the HCM Extract in **change-only** mode by enabling **Include Changes from Last Successful Run**. For configuration steps, refer to [Configuring HCM Extract with change only mode](<#configuring-hcm-extract-with-change-only-mode>). > [!NOTE] > > For more information and similar examples of exporting HCM data for both full and delta aggregations, refer to the [Oracle HCM Cloud Export File]() guide. ### Configuration for Delta Aggregation The following steps must be followed in the Oracle Fusion HCM system to enable the ATOM feeds API: 1. Go to **Setup and Maintenance** \> **Manage HCM Atom Feeds**. 1. Select the **Person's Assignment Changed** Atom feed. 2. Click the **Other Events** tab. 3. Review and select the events “Trigger on New Hire Event”. 4. Save the changes. 2. Go to **Setup and Maintenance** \> **Manage Administrator Profile Value**. 1. Search for the **ORA\_HRC\_ATOM\_OTHER\_EVENTS\_IN\_ASG** profile option using the profile option code. 2. Set the profile value to "Y" to make the configuration effective. 3. Save the changes. ### Configuring HCM Extract with Change Only Mode #### HCM Extracts The HCM Extracts feature generates data files and reports. It provides a dedicated interface where you can specify the exact records and attributes to extract. By using this feature, you can: - Identify records for extraction by using complex selection criteria. - Define data elements in an HCM extract by using fast formula database items and rules. You can configure the HCM Extract in change-only mode. In this mode, the system compares the current data status with baseline data from previous runs to identify new or modified records. #### Steps to configure HCM Extract with change only mode 1. When you create the extract, go to the **Additional Details** section and select **Yes** for **Changes Only**. Selecting **Yes** automatically applies the **Include Changes from Last Successful Run** parameter, which calculates the delta result by comparing the current data with the last successful run and returning only the changed records. 2. Specify the **Threading Database Item** as a unique database item. If you use views that combine multiple tables, verify that this key has a **Primary Key** and **Foreign Key** relationship with all underlying tables. 3. Verify that the attribute used as the **Threading Database Item** is configured as a **Key Attribute** and set to **Always Display** in the HCM Extract. 4. Complete the remaining standard configuration steps. For more information, refer to [Oracle HCM Cloud Export File Guide](). 5. Submit the extract based on the run type: 1. **First extract run**: Select **All attributes**. This creates a data baseline for future delta runs. 2. **Subsequent runs**: Select **Changed attributes** for all future scheduled runs. ##### Important Considerations The queries defined for the changed extracts should respect the Future and Termination offsets specified in the application. ## Required Permissions The following minimum permissions are required to access the SFTP server: | Operation | Required Permission | | --- | --- | | Test Connection | The service account must have the read permission for the file on the SFTP server | | Account Aggregation | The service account must have the read permission for the file on the SFTP server | Select an approach to view the minimum permissions required to perform operations: ### Approach 1 - Role-Based Configuration The following minimum permissions are required to perform operations > [!NOTE] > > These permissions do not aggregate the ManagerAssignmentId attribute. Refer to [Approach 2 - Using the Integration Specialist Role](<#approach-2-using-the-integration-specialist-role>) for those permissions. #### Step 1: Create an HCM Duty Role 1. Go to **Tools \> Security Console \> Roles \> Create Role**. 2. Set the **Role Category** to **HCM - Duty Roles**. 3. Under **Function Security Policies**, add the permissions listed in the following table: | Operation | Required Permission | | --- | --- | | Single Account Aggregation | Use REST Service - Collective Agreements List of Values
Use REST Service - Identity Integration
Use REST Service - Workers
View Person
View User Accounts | | Update Account | Use REST Service - Workers
Use REST Service - Collective Agreements List of Values
View User Account
Use REST Service - Identity Integration | | Delta Aggregation | Use Atom Feed - Employees Workspace | > [!NOTE] > > The `View Person` and `View User Accounts` permissions are required to fetch the `USER_NAME` attribute. #### Step 2: Create an HCM Job Role 1. Go to **Tools \> Security Console \> Roles \> Create Role**. 2. Set the **Role Category** to **HCM - Job Roles**. 3. Under **Data Security Policies**, create the policies listed in the following table: | | | | | | --- | --- | --- | --- | | Policy Name | Data Resource | Privilege (Actions) | Condition | | Address | Person Address for Table PER\_ADDRESSES | Manage Person | Access the person for table PER\_ADDRESSES for people and assignments in their person and assignment security profile | | Choose Business Unit Organization | Organization for Table HR\_ALL\_ORGANIZATION\_UNITS\_F | Choose Business Unit Organization | Access the business unit for table HR\_ALL\_ORGANIZATION\_UNITS\_F for business units in their organization security profile | | Choose Business Unit Organization | Organization for Table HR\_ORG\_UNIT\_CLASSIFICATIONS\_F | Choose Business Unit Organization | Access the business unit for table HR\_ORG\_UNIT\_CLASSIFICATIONS\_F for business units in their organization security profile | | Choose Department | Organization for Table HR\_ALL\_ORGANIZATION\_UNITS\_F | Choose Department | Access the business unit for table HR\_ALL\_ORGANIZATION\_UNITS\_F for business units in their organization security profile | | Choose Department | Organization for Table HR\_ORG\_UNIT\_CLASSIFICATIONS\_F | Choose Department | Access the business unit for table HR\_ORG\_UNIT\_CLASSIFICATIONS\_F for business units in their organization security profile | | Choose Legal Employer | Organization Detail for Table HR\_ORGANIZATION\_INFORMATIO\_EFC | Choose Legal Employer | Access the legal employer for table HR\_ORGANIZATION\_INFORMATIO\_EFC for legal employers in their organization security profile | | Choose Legal Employer | Organization for Table HR\_ALL\_ORGANIZATION\_UNITS\_F | Choose Legal Employer | Access the business unit for table HR\_ALL\_ORGANIZATION\_UNITS\_F for business units in their organization security profile | | Choose Legal Employer | Organization for Table HR\_ORG\_UNIT\_CLASSIFICATIONS\_F | Choose Legal Employer | Access the business unit for table HR\_ORG\_UNIT\_CLASSIFICATIONS\_F for business units in their organization security profile | | Choose Legal Employer | Organization for Table HR\_ORG\_UNIT\_CLASSIFICATIONS\_F | Choose Legal Employer | Access the business unit for table HR\_ORG\_UNIT\_CLASSIFICATIONS\_F for business units in their organization security profile | | Choose Person Type | Person Type for Table PER\_PERSON\_TYPES | Choose Person Type | Access the person type for table PER\_PERSON\_TYPES for any person type | | FND\_TERRITORIES\_B | FND\_TERRITORIES\_B | Read | Access the application reference territory for table FND\_TERRITORIES\_B for countries in their country security profile | | PER\_ALL\_ASSIGNMENTS\_M | Person Work Terms Assignment | Manage Direct Reports; View Assignment Summary; Report Assignment; Manage Person Assignment; View Work Relationship | Access the person assignment for table PER\_ALL\_ASSIGNMENTS\_M for people and assignments in their person and assignment security profile | | Person Detail | Person Detail | View Person Assignment; Choose Person; View Person Address; View Person Communication Method; View Person Contact; View Person Number; Search Person Live Data | Access the person for table PER\_ALL\_PEOPLE\_F for people and assignments in their person and assignment security profile | | Person Extra Information | Person Extra Information | View Person | ORA\_PER(300000000324293):HCM:PER:PER\_PEOPLE\_EXTRA\_INFO\_F:View All Workers | | Person Name | Person Name | View Person Name | All values | | Person National Identifier | Person National Identifier | View Person National Identifier | All values | | Person Phone | Person Phone | View Person Phone | All values | | Public Assignment | Public Assignment | Choose Public Person | Access the public assignment for table PER\_ASSIGNMENTS\_V for people and assignments in their public person and assignment security profile | | Public Person | Public Person | Choose Public Person | Access the public person for table PER\_PERSONS for persons and assignments in their person and assignment security profile | | View Position | Position for Table HR\_ALL\_POSITIONS\_F | Choose Position; View Position | Access the position for table HR\_ALL\_POSITIONS\_F for positions in their position security profile | | Work Relationship | Work Relationship | Choose Worker; View Work Relationship; View Employment Information Summary; View Employment Termination; Search Worker; | All values | | person work term | Person Work Terms Assignment | View Employment Information Summary; View Work Relationship; View Person Extra Information; View Future Assignment Changes; View Worker Availability; View Employment Termination; View Person Assignment | All values | | View Position | Position for Table HR\_ALL\_POSITIONS\_F | Choose Position; View Position | Access the position for table HR\_ALL\_POSITIONS\_F for positions in their position security profile | | Work Relationship | Work Relationship | Choose Worker; View Work Relationship; View Employment Information Summary; View Employment Termination; Search Worker | All values | | Person Work Term | Person Work Terms Assignment | View Employment Information Summary; View Work Relationship; View Person Extra Information; View Future Assignment Changes; View Worker Availability; View Employment Termination; View Person Assignment | All values | 4. Under **Role Hierarchy**, include the **HCM Duty Role** you created in step 1. 5. Select **Next**, then **Submit**. 6. Go to **Tools \> Scheduled Processes \> Retrieve Latest LDAP Changes** and **Send Pending LDAP Requests** to execute the processes. #### Step 3: Create an HCM Data Role 1. Go to **My Client Groups \> Workforce Structures \> Data Roles and Security Profiles**. 2. Select **Create**, and assign a name as required. 3. In **Inherited Job Role**, select the **HCM Job Role** you created in step 2. 4. Set the following: - **Country Security Profile**: View All Countries - **Organization Security Profile**: View All Organizations - **Position Security Profile**: View All Positions - **Person Security Profile**: View All People - **Public Person Security Profile**: View All People 5. Select **Submit**. 6. Go to **Tools \> Scheduled Processes \> Retrieve Latest LDAP Changes** and **Send Pending LDAP Requests** to execute the processes. #### Step 4: Create a User and Assign the HCM Data Role 1. Go to **Tools \> Security Console \> Users \> Add User Account**, then enter the user information. 2. Select **Add Role**, and assign the **HCM Data Role** you created. 3. Go to **Tools \> Scheduled Processes \> Retrieve Latest LDAP Changes** and **Send Pending LDAP Requests** to execute the processes. ### Approach 2 - Using the Integration Specialist Role Create a service account with the following required permissions: 1. Go to the **Security Console**, search for the **Human Capital Management Integration Specialist** job role and use **Copy Role** to create a custom job role. 2. In the **Function Security Policies** tab, assign the following policies: - Use REST Service - Workers - Use ATOM Feed - Employees Workspace - Use REST Service - Identity Integration (ASE\_REST\_SERVICE\_ACCESS\_IDENTITY\_INTEGRATION\_PRIV) - View User Account (ASE\_VIEW\_USER\_ACCOUNT\_PRIV) > **Note** > > The last two permissions are required only for the Get and Update functionality of the User Name and Email. 3. In the **Data Security Policies** section, select **Create Data Security Policy** to add data security policies to the role. 4. Add the following data policy attributes: - **Name**: Choose Person - **Database Resource**: Person Detail - **Start Date**: System date - **Data Set**: Select by instance set - **Condition Name**: Access the person for the PER\_ALL\_PEOPLE\_F table for people in the Person and Assignment Security profile. - **Actions**: Choose Person 5. Select **OK**. 6. In **Create Data Security Policy** add the following data policy attributes: - **Name**: Choose Application Reference Territory - **Database Resource**: FND\_TERRITORIES\_B - **Start Date**: System date - **Data Set**: Select by instance set - **Condition Name**: Access the application reference territory for table FND\_TERRITORIES\_B for countries in the country security profile. - **Actions**: Choose Application Reference Territory 7. Select **OK**, and confirm that the newly created data policies have been assigned to the application role. 8. On the **Summary and Impact Report** section, select **Save** and **Close**. 9. Execute the **Retrieve Latest LDAP Changes** process. 10. Create a new Data Role from the **Manage Data Role and Security Profiles** page, which holds only the new custom Job role. Add the security policies as needed. 11. Go to **View \> Security Profiles \> View All** to view security criteria and set it as per your requirement. 12. Repeat the steps for the rest of the security criteria. Select **Next**, and then **Submit**. 13. Create the user account and assign the newly created role to this user account. 14. Execute the **Retrieve Latest LDAP Changes** and **Send Pending LDAP Requests** processes. 15. For a new user, assign the new Data Role that has been created. 16. Re-execute the **Retrieve Latest LDAP Changes** and **Send Pending LDAP Requests** processes. # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Oracle HCM Cloud connector uses the following default correlation and object configurations. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | PERSON\_NUMBER | Account | ### Default Account Attributes The Oracle HCM Cloud connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | PERSON\_NUMBER | Unique identifier for the person. This is an Account ID which must not be changed. | | HIRE\_DATE | The hiring date of the person. | | TERMINATION\_DATE | Termination date of the person. | | PERIOD\_OF\_SERVICE\_ID | Unique identifier for the person WorkRelationship. | | WORKER\_TYPE | Type of the person, for example Employee/Contingent. | | WORKRELATIONSHIP\_PRIMARY\_FLAG | Flag indicating whether WorkRelationship is primary or not. | | ASSIGNMENT\_ACTION\_CODE | Primary assignment's action code of the person. For example, `HIRE` | | ASSIGNMENT\_EFFECTIVE\_START\_DATE | Primary assignment effective start date of the person. | | ASSIGNMENT\_EFFECTIVE\_END\_DATE | Primary assignment effective end date of the person. | | ASSIGNMENT\_PRIMARY\_FLAG | Flag indicating whether assignment is primary or not. | | ASSIGNMENT\_STATUS | Primary assignment status of the person. | | WORK\_EMAIL | Work Email for the person | > [!NOTE] > > The connector internally generates a JSON path for the above attributes where the PrimaryFlag is set to true. If a customer wants to aggregate data where the PrimaryFlag is false, they should add a JSON path mapping for that specific attribute. ### Additional Account Attributes > [!NOTE] > > These attributes are calculated attributes based on the mandatory account schema and should not be part of the HCM Export Files. | Attribute Name | Description | | --- | --- | | FUTURE\_WORKRELATIONSHIP\_START\_DATE | The future hire date of the person. | | FUTURE\_ASSIGNMENT\_START\_DATE | The future assignment start date of the person. This attribute is only supported as part of full aggregation. | | FUTURE\_WORKRELATIONSHIP\_END\_DATE | The future termination date of the person. | | FUTURE\_ASSIGNMENT\_ACTION | The future action of the person. This attribute is only supported as part of full aggregation. | > [!NOTE] > > You must manually add these attributes in the account schema. ## Additional Attributes of REST API The Oracle HCM Cloud connector supports aggregation of additional attributes from the Oracle Fusion HCM Workers API during get object operation. Complete the following steps to add additional attributes of rest API: 1. Add the attribute name in the Account Schema. 2. Apply the appropriate JSON path query for the attribute. Refer to [JSON Path Mapping]() to add JSON path for attribute mapping. 3. Using REST, ensure the attributes are also added in the Workers API Additional Fields. **Key**: connector\_workersAPIAdditionalFields > **Note** > > Values should be valid JSON path. **Case 1**: Suppose you want to aggregate `AssignmentName` using the JSON path given below: ```text workRelationships..assignments[?(@.PrimaryAssignmentFlag==true && @.AssignmentType=='E' && @.PrimaryFlag==true)].AssignmentName ``` In this scenario, you need to mention `AssignmentName` as well as those attributes on which JSON path conditions are applied, (such as `PrimaryAssignmentFlag, AssignmentType, and PrimaryFlag`) in the **Workers API Additional Fields** as shown below: ```text workRelationships.assignments:AssignmentName,PrimaryAssignmentFlag,AssignmentType,PrimaryFlag ``` # Migrate VA-based Source to a SaaS Source > [!NOTE] > > Migration is only applicable if you are using a cloud-based SFTP server for aggregation. Some sources that are connected to virtual appliance (VA) clusters can be migrated to SaaS connections. This ensures data (users and entitlements) remain intact and can maintains your source configurations like access profiles, roles, password settings, and correlation configurations when switching from a VA cluster to a SaaS connection. To migrate a source from a VA-based source to a SaaS source, you will provide configuration details on a draft version of the source before publishing the source. > [!NOTE] > > - You must have an Admin or Source Admin user level to migrate a source. A draft version of the source is created. As your migration process is in progress the live source will continue to work as it is. For more information on the Oracle HCM Cloud SaaS connector, refer to the [Oracle HCM Cloud SaaS Supported Features](). ## Important Considerations Before Migrating - You do not need to edit additional configurations (other than connection credentials) to migrate the source. - If your source migration is in progress, please do not make any configuration changes to your live source as those can be overwritten once you apply the migration your draft version. - Once you've gone ahead with your migration, it can't be rolled back. Your source is permanently migrated to a SaaS source. - Any preview operations or configuration changes on the draft source will not impact the live source until you apply the migration. ## Migrating Sources To migrate your source, complete the following: 1. Go to **Admin \> Connections \> Sources**. 2. Select or edit the VA-based source you want to migrate. 3. Open the source configuration, and select **Migrate to SaaS**. 4. When prompted, select **Continue**. A draft version of the source is created. The live source will continue to work. 5. Select **Connection Settings**. 6. Re-enter encrypted configuration details. For example, you might need to re-enter the Client Secret, Password, Refresh Token, Personal Access Token (PAT), or Certificates to migrate from the VA cluster to the SaaS connection. > **Important** > > Avoid editing the other configuration options in the draft source. 7. Select **Review and Test**. 8. Select **Test Connection**. 9. (Optional) Select **Accounts**. If you successfully tested your connection in **Review and Test**, you can select **Preview** to display a subset of accounts from the application that will be mapped to SailPoint identities. This can help ensure you are accurately connecting identity data from the application with SailPoint identities. 10. (Optional) Select **Entitlements**. If you successfully tested your connection in **Review and Test** and your source type supports entitlement type configuration, you can select **Preview** to view a preview of entitlements using the current configuration settings. 11. When you've finished reviewing your changes and successfully tested your connection, select **Apply Migration**. Your changes will be applied to the live source and the draft source will be deleted. ## Viewing Source Migration Status You can view the status and creation date of draft sources. 1. Go to **Admin \> Connections \> Sources \> Source Migration Status**. 2. Select **Source Migration Status**. 3. To view or edit the draft source, select **Actions** ![]() **\> Preview** on the draft source. 4. To delete the draft source, select **Actions** ![]() **\> Delete** on the draft source. # Enable Connector Logging This topic provides the steps needed to enable logging on SailPoint using REST APIs. > [!NOTE] > > This topic only applies to VA-based integrations. > [!NOTE] > > The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector. This process is broken up into four steps: 1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging. 2. Get the logging configuration for the existing VA cluster. 3. Update the VA cluster to enable logging levels. 4. Observe logging changes to the logging levels. ### Identify the Virtual Appliance Cluster Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>). 1. Make the following call to the REST API to return a list of available VA clusters: GET /v3/managed-clusters The REST API returns a response that looks similar to the following: ```json [ { "id": "2c9180866166b5b0016167c32ef31a66", "name": "Development Cluster", "description": "Development Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": null }, { "id": "2c9180846a93ce60016ab29f039944de", "name": "Cloud Cluster", "description": "Cloud Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } } ] ``` > **Note** > > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster. 2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute. ### Get the Logging Configuration Get your selected VA's cluster logging configuration and identify the values you need to update. 1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. GET /v3/managed-clusters/{id}/log-config - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response. - If the VA has an existing logging configuration, it returns something similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` You'll need to configure the following information in the response: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). ### Update Logging Configuration Update the VA cluster configuration returned by the REST API to update the logging settings as needed. 1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. PUT /v3/managed-clusters/{id}/log-config 2. Submit your configuration changes to the REST API in a JSON body. - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one. - If the VA returned a configuration, you can edit it to include the changes. The JSON body should be as follows: ```json { "durationMinutes": 60, "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` Consider the following as you edit the JSON: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). If the update was successful, the REST API should return a response similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` ### Observe Logging Changes Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**. ### References The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file. #### Logging Levels | Logging Level | Description | | --- | --- | | ERROR | Designates error events that might still allow the connector to continue. | | WARN | Designates potentially harmful situations. | | INFO | Designates information messages that highlight process at a coarse-grain level. | | DEBUG | Very verbose. Fine grain logging levels used for development and debugging. | | TRACE | Most verbose. Finer grain logging levels than debugging. | #### Logging Classes | Connector | Logging Class | | --- | --- | | Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector | | AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector | | Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT | | Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector | | Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector | | Microsoft Entra ID | sailpoint.connector.AzureADConnector | | Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter | | Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter | | Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT | | Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter | | Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter | | GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter | | Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter | | IBM i | openconnector.connector.IBMiConnector | | Lotus Domino | sailpoint.connector.LotusDomino | | JDBC | sailpoint.connector.JDBCConnector | | Sun One LDAP | sailpoint.connector.LDAPConnector | | Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector | | Microsoft Office365 | sailpoint.connector.Office365Connector | | Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 | | Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT | | Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector | | Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector | | Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter | | Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector | | Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector | | Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector | | PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter | | PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector | | RemedyForce | sailpoint.connector.ForceConnector | | RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter | | Salesforce | sailpoint.connector.ForceConnector | | SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector | | SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector | | SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT | | SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector | | SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter | | SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter | | ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter | | ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter | | Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter | | Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter | | Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter | | SuccessFactors | sailpoint.connector.SuccessFactorsConnector | | Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector | | Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter | | Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter | | Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter | | Web Services | sailpoint.connector.WebServices | | XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter | | Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter | | Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Health check and test connection dependent on SFTP server To remove dependency on SFTP server, enable via API Authentication toggle in **Connection Settings** and **Save**. ## Aggregation fails with Java Heap Space error This error may occur if the extract file size is large as compared to the heap space specified in the VA. **Resolution**: To increase the heap space and resolve this issue, reach out to [SailPoint Support](). ## No records are aggregated from the CSV file during full account aggregation This error may occur if your HCM Extract is configured to drop null values. You will see errors in your ccg.log file on the virtual appliance of "Skipping Record due to column length mismatch." **Resolution**: Check your HCM Configuration for Include Null Values in HCM Extract XML Data (WRITE\_NULL\_VALUES), by performing the following: 1. In Oracle, Go to **My Client Groups \> Show More \> Payroll \> Payroll Process Configuration**, and select the **Default Group**. 2. If you don't see **Include Null Values in HCM Extract XML Data (WRITE\_NULL\_VALUES)** in the list, select the **\+** icon. 3. In **Parameter Name**, select **Include Null Values In HCM Extract XML Data allow choice to write null values in XML**. > **Screenshot** > > [![Payroll Process Configuration]()]() > **Note** > > This screenshot may vary from customer to customer depending on their environment. 4. Set the **Default Value** to **Y**. 5. Now that your configuration has been checked, ensure that WORKER\_TYPE values are correct and according to standard as defined in Create a Separate HCM Export File. ## Test connection fails when incorrect PGP keys are used You might notice one of the following errors when the incorrect PGP Public Key or PGP Private Key are used during configuration: Error 1 ```text sailpoint.connector.InvalidConfigurationException: [ InvalidConfigurationException ] [ Possible suggestions ] Ensure that pgp encrpted file is provided or correct Public Key, Private Key and Private Key Password is provided [ Error details ] Signature not found ``` Error 2 ```text sailpoint.connector.InvalidConfigurationException: [ InvalidConfigurationException ] [ Possible suggestions ] Ensure that pgp encrpted file is provided or correct Public Key, Private Key and Private Key Password is provided [ Error details ] invalid armor ``` Error 3 ```text sailpoint.connector.ConnectorException: [ ConnectorException ] [ Possible suggestions ] Ensure that configuration parameters is correct and SFTP server is reachable [ Error details ] org.bouncycastle.openpgp.PGPSecretKeyRing found where PGPPublicKeyRing expected ``` Error 4 ```text sailpoint.connector.ConnectorException: [ ConnectorException ] [ Possible suggestions ] Ensure that configuration parameters is correct and SFTP server is reachable [ Error details ] crc check failed in armored message ``` Error 5 ```text sailpoint.connector.ConnectorException: [ ConnectorException ] [ Possible suggestions ] Ensure that configuration parameters is correct and SFTP server is reachable [ Error details ] invalid header encountered ``` **Resolution**: Ensure you are using PGP Public Key or PGP Private Key in the correct format as generated by the Oracle Fusion HCM system during configuration. For example, you can use the format as shown below: ```text -----BEGIN PGP PUBLIC KEY BLOCK----- Version: BCPG v1.71 lEVFBsA1Iqt4Abh+8dWh3UtTcSuT8KIDYX+OpnVrWAUXMmnKT+JAI7Tk3vtYPiWe7E slg+8m7jXsFfZE5vaJOeFMbMfxC1jVNy+azO/EMg41kKW7pJHCTsGnChrteJ1ocv1iycl NAPf7E==ofag -----END PGP PUBLIC KEY BLOCK----- ``` Or use only the key as shown below: ```text lEVFBsA1Iqt4Abh+8dWh3UtTcSuT8KIDYX+OpnVrWAUXMmnKT+JAI7Tk3vtYPiWe7E slg+8m7jXsFfZE5vaJOeFMbMfxC1jVNy+azO/EMg41kKW7pJHCTsGnChrteJ1ocv1iycl NAPf7E==ofag ``` For more information on the PGP Public Key or PGP Private Key, refer to [Connection Settings](). ## Test connection fails with checksum mismatch at in checksum of 20 bytes You might get the following error when incorrect PGP Private Key Password is provided during configuration: ```text [ InvalidConfigurationException ] [ Possible suggestions ] Ensure that pgp encrypted file is provided or correct Public Key, Private Key and Private Key Password is provided [ Error details ] checksum mismatch at in checksum of 20 bytes ``` **Resolution**: Ensure you are using correct PGP Private Key Password generated by the Oracle Fusion HCM system during configuration. ## Test connection fails with unknown object in stream: 16 You might get the following error when the HCM export file provided is unencrypted and not signed. ```text [ InvalidConfigurationException ] [ Possible suggestions ] Ensure that pgp encrypted file is provided or correct Public Key, Private Key and Private Key Password is provided [ Error details ] unknown object in stream: 16 ``` **Resolution**: Ensure that HCM export file is encrypted and signed. For more information for creating HCM extract file, refer to Create a Separate HCM Export File. ## Test connection fails with Poor PGP. Signature not found **Resolution**: Ensure that HCM export file is encrypted and signed. For more information for creating HCM extract file, refer to Create a Separate HCM Export File. ## Get Object / Single account aggregation failure Get Object / Single account aggregation fails with the following error: ```text URL request parameter fields with value field 1, field 2 and field3 ; is not valid ``` **Resolution**: Ensure that additional fields is defined under **Workers API Additional Fields**. ## Data Is Overwritten After Provisioning After a provisioning operation, account data aggregated from the CSV extract is overwritten. The connector performs a getObject call that reads the account from the Workers API and updates the record. Attributes that exist in the CSV extract and are not returned by the Workers API might be cleared. **Resolution**: To skip the getObject call after an update, add the following entry to the source using the [Update Source API](). Key: `skipGetObjectAfterUpdate` Value: `true` ## Delta aggregation doesn't fetch the new hires As per standard API response the `DateStart` must be present in the context or changed attributes to fetch the records. **Resolution**: Ensure the `DateStart` is in the Atom feed API. If it isn't present, add it. If the `EffectiveStartDate` value is the same as the `DateStart` you must change the schemaToAttributeMapping as follows and check delta aggregation again. ```xml ``` ## Delta aggregation fails with Null Pointer Exception error **Error**: `Error in aggregation 2fb93885d3db4620a40c02d58bfd0a67: java.lang.RuntimeException - sailpoint.connector.ConnectorException: NullPointerException - java.lang.RuntimeException: sailpoint.connector.ConnectorException: NullPointerException` **Resolution**: Set the `lastAggregation` date in the DD/MM/YYYY format. ## Delay processing the atom feed data When you see issues that the Oracle target system takes a few more minutes/seconds to process the atom feed data and publish it, the changed records are not aggregated by the connector. **Resolution**: To add delay in `publishedMinDelay` in all the atom feed, the parameter given below has to be added in the application via debug. ```text ``` > [!NOTE] > > The value is in Seconds. ## Test connection fails with error during download of file ```text Caused by: java.lang.Exception: Error during download of file[ /Sailpoint_Active_09072025.csv.pgp].net.schmizz.sshj.sftp.SFTPException: /Sailpoint_Active_09072025.csv.pgp at connector.common.transport.SFTPFileTransport.internalDownload(SFTPFileTransport.java:380) at connector.common.transport.SFTPFileTransport.download(SFTPFileTransport.java:212) ``` **Resolution**: If the file is present in the home directory, then you must provide the file name. For example, `Sailpoint_Active_09072025.csv.pgp` ## Single Account Aggregation fails to fetch assignmentsDFF attributes During single account aggregation, the system does not fetch the correct values for the `assignmentsDFF` attributes. The `supplierOrAgency_Display` and `vendorAccessLevel` attributes return empty results. Worker API Response: ```json "assignmentsDFF": [ { "supplierOrAgency_Display": "Aceik Pty Ltd", "vendorAccessLevel": "Light" } ] ``` **Resolution**: 1. Update the following schema attributes: ```xml ``` 2. Update the schemaToAttributeMapping entries with the following configurations: ```xml ``` 3. Run a single account aggregation to verify the changes. # Timeout Errors and Settings Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down. This document is designed to give specific information that can be used to resolve these errors. Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error. > [!IMPORTANT] > > Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail. To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### aggregateTimeout **Description:** This parameter is set for the aggregation timeout, measured in seconds. **Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds. For example: If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/aggregateTimeout", "value": 600 } ] ``` ### healthCheckTimeout **Description:** This parameter is set for the test connection and health check timeout. **Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again. For example: If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 45 } ] ``` ### provisioningTimeout **Description:** This parameter is set for provisioning timeout. **Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds. For example: If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/provisioningTimeout", "value": 360 } ] ``` ### timeout **Description:** This parameter is set for pass-through authentication timeout. **Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again. For example: If your current time value is 15 seconds, update the `timeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeout", "value": 30 } ] ``` ### apiTimeout **Description:** This parameter is set for API time tracking; customers can check it using an external tool. **Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again. For example: If your current time value is 60 seconds, update the `apiTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/apiTimeout", "value": "75" } ] ``` ### timeoutInSeconds **Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests. For example: If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeoutInSeconds", "value": "15" } ] ```