Oracle® Fusion Applications Sales Implementation Guide 11g Release 7 (11.1.7) Part Number E20373-08

Home

Contents

Book List

Contact Us

Previous

Next

PDF

8 Common Applications Configuration: Define Security for CRM

This chapter contains the following:

Define Security for CRM

Define Users for CRM

Define Security for CRM

Oracle Fusion CRM Security: Functional Overview

Oracle Fusion CRM Applications come secured using the industry standard for access control that is called role-based access control (RBAC). This topic discusses key aspects of the RBAC approach that are specific to an Oracle Fusion CRM implementation. You must review other documentation to understand how RBAC is designed to handle a broad range of security needs.

The RBAC standard supports the enforcement of user access control that is based on the role of the user within the organization rather than the user's individual identity. In RBAC, you assign users with roles that represent the job functions in your enterprise. These roles provide access both to the application functions that users need to perform their jobs as well as the permissions to access the data where they need to perform those functions.

Oracle Fusion Applications, including Oracle Fusion CRM, are secured with a predefined set of enterprise roles. This security reference implementation fulfills the needs of midsize horizontal enterprises, generally between 250 and 10,000 employees. To enable users to perform specific jobs in your CRM enterprise, you provision them with the appropriate enterprise roles. For example, when you provision sales managers with the sales manager job role, they can perform all their job duties, including managing sales teams and their forecasts, setting quotas, and managing sales leads and opportunities.

You can change this security reference implementation if the roles in your enterprise are different or if you want to accommodate expansion into vertical industries, such as health care, insurance, automobiles, or food manufacturing. Application patching does not affect your changes.

Key Components of Oracle Fusion CRM Application Security

The following graphic provides an overview of the key components that determine what functions users can perform in the application (functional security) and on what data they can perform those functions (data security).

For Oracle Fusion CRM, the relevant security components are the following:

• User

  This document refers to security for human users, not background processes and other system users that are also secured with RBAC.

• Autoprovisioning rules

  Rules automatically provision users with enterprise roles that carry all the security settings that are appropriate for their duties. You can provision users based on their role in your organization and other factors, such as their status as an employee or contractor.

• Enterprise roles

  There are two types of enterprise roles:

  • Job roles

    Job roles permit users to perform activities specific to their job. For example, providing users with the Sales Manager job role permits them to manage salespersons within the organization, follow up on leads, generate revenue within a territory, build a pipeline, manage territory forecasts, and assist salespersons in closing deals.

  • Abstract roles

    Abstract roles permit users to perform functions that span the different jobs in the enterprise. For example, each user who is an employee must be provisioned with the Employee abstract role to be able to update their employee profile and picture. For CRM, you must also provision users with the Resource abstract role, this permits users to be assigned to work on leads, opportunities, and other CRM work.

• Duty roles

  Job and abstract roles permit users to carry out actions by virtue of the duty roles they include. For example, the Sales Manager job role includes the Sales Lead Follow Up Duty and the Quota Management Duty. The Sales Management Duty makes it possible for the managers to create and update a sales lead, qualify a sales lead, and convert a sales lead into an opportunity. The Quota Management Duty enables the management of sales territory quotas and territory quota formulas.

• Functional security policies

  Duty roles include functional security policies that provide access to user interface elements, Web services, tasks flows, and other functions. For example, a sales manager who has the Delete Opportunity functional policy can view and click the Delete button. Removing that policy removes the button from view.

  A functional policy is made up of the duty role name and the Delete Opportunity functional privilege. The functional privilege specifies the application features that are being secured. In the security reference manuals, functional privileges are listed in the Privileges section.

• Data security policies

  Duty roles also include data security policies that specify which roles can perform an action under what conditions. For example, the Opportunity Sales Manager Duty includes a data security policy that specifies that sales managers can view opportunities if they are in the management chain or are members of the sales team on the opportunity.

  Each data security policy represents an underlying SQL query. Oracle Fusion CRM Applications evaluate the query at run time, and permit access to data that meets the condition.

  A data security policy is composed of the name of the duty where it applies, a data privilege, and a condition. A data privilege is the combination of the action users can take, the conditions under which they can carry them out, and the object they can act on. Data privileges are listed in the Data Security Policies section of the security reference manuals.

How enterprise roles work in practice is best illustrated with an example from the Sales Manager job role outlined in the following diagram:

• A provisioning rule automatically provisions employee sales managers with the enterprise roles they need to do their jobs.

• The rule provisions the Sales Manager job role and the Employee and Resource abstract roles.

• The Sales Manager job role includes the Quota Viewing Duty and the Sales Manager Duty.

• Duty roles inherit other duty roles. For example, the Sales Manager Duty inherits many other duty roles including the Marketing Lead Analysis Duty and the Opportunity Sales Manager Duty.

• The duty roles are associated with functional security policies and data security policies. For example, the inherited Opportunity Sales Manager Duty comes with the following:

  • Functional security policies that specify which application pages and functions sales managers can access for deleting, assigning, closing, creating, and viewing an opportunity. For example, the view opportunity policy permits sales managers to view all UIs, Web services, and task flows that are related to opportunities.

  • Data security policies that specify what actions opportunity sales managers can take on what opportunities and under what conditions.

    For example, opportunity sales managers can view all data related to opportunities where they are opportunity sales team members with view, edit, or full access.

The following diagram provides more detail about the composition of a policy. Each policy, such as the View Opportunity policy, is composed of a duty role name and a privilege:

• The view opportunity functional security policy is composed of the duty name and the View Opportunity functional privilege.

• The view opportunity data security policy is composed of the duty name, the View Opportunity data privilege, and a condition. It specifies that sales managers can view all data related to opportunities where they are an opportunity sales team member with view, edit, or full access.

About the Security Reference Implementation

Details about the available enterprise roles, duty roles, and policies in the security reference implementation are described in reference manuals organized by business process.

Each of the enterprise roles provided by Oracle is composed of a hierarchy of other roles and duties. The following diagram displays a portion of the hierarchy for the Sales Manager job role from the Oracle Fusion Applications Sales Security Reference Manual as an illustration.

The Sales Manager job role inherits the Business Intelligence Applications Worker abstract role. This abstract role comes with the Business Intelligence Applications Analysis Duty that permits the viewing of business analysis reports.

The Sales Manager job role also inherits the Sales Manager duty role. All job roles include a top-level duty role with the same name as the job role. This top-level duty role is the container for all of the duty roles assigned to a job role. As a general rule, the permissions are attached to the duties at the lowest level of the hierarchy.

The top-level duty roles make it easier for you to create job roles of your own. For example, if you want to create a new job role because you want to give additional functionality to a special class of sales managers, then you can assign the top-level Sales Manager duty to the new job role to give the users all the same permissions as a regular sales manager and then add whatever additional duty roles you want. (For an example of how to do this task, see the Enabling Salespeople to Obtain Microsoft Outlook Access to All Sales Accounts: Worked Example help topic.)

How Opportunity Information Is Secured: Explained

This topic explains how the security reference implementation provided by Oracle determines who can access what opportunity information in your CRM organization.

Your CRM application data comes secured with Oracle's security reference implementation. The following diagram illustrates who can access what opportunity information:

• Named agents in the diagram (A, B, and C) can access the opportunity because they have created it, are on the sales team, or own a territory related to the opportunity.

• Unnamed agents (highlighted in yellow) cannot view the opportunity although they have the same manager as their peers who can view them.

• Managers can view the opportunity because a salesperson in their management chain can view it.

This figure shows who in a sales hierarchy can access an opportunity:

You can see the opportunity in this figure if you do the following:

• You create the opportunity.

  Agent A can access the opportunity because she created it. When you create an opportunity, you are the initial owner.

• You are on the opportunity sales team.

  Agent B can access the opportunity because he is on the sales team.

• You are the owner of the territory.

  Agent C can access the opportunity because he is the owner of the NW territory.

• The opportunity owner is your direct or indirect report in the resource hierarchy.

  Sales managers who are higher up in the management chain can also see the opportunity because access is provided through the resource hierarchy. Agent C's manager can access the opportunity information, but agent C's colleagues cannot.

• You can also access the opportunity if you are assigned to a territory for the sales account associated with the opportunity or if a territory is assigned to the revenue lines on the opportunity. (Revenue lines and sales accounts are not shown in this diagram).

Access differs between territory members and opportunity members:

• An opportunity owner gets full access to the opportunity, which includes the ability to edit as well as add and remove team members.

• Owners and members of territories assigned to the sales account of the opportunity get read-only access to the opportunity and are not added to the opportunity sales team.

• Owners and members of territories assigned to the opportunity revenue lines are added as a distinct list of territories to the opportunity sales team. Owners and members of these territories get full access to the opportunity. Depending on a profile option, either only the owner or all the members of the territory are added as resources to the opportunity sales team. Regardless of the access level for these members as a resource on the opportunity team, they will always have full access.

Special Access

Some access is not affected by the management hierarchy and membership in sales teams or territories. This special access includes:

• Administrators: Administrators get access to opportunities and other objects. This access is based on their privileges, regardless of where the administrators are in the management hierarchy. Administrators do not have to be on the sales team or members of territories.

• Deal Protection: Salespersons assigned to an opportunity retain the sales credit on an opportunity even if they are moved to another opportunity.

• Team Selling: You can configure the application to allow salespersons to see all opportunities related to their sales accounts.

Oracle Fusion CRM Security: Architectural Overview

Setting up Oracle Fusion CRM security involves the use of multiple application components outlined in this topic. For example, you create duty roles and enterprise roles in separate Oracle Fusion Middleware applications and the rules to provision them in Oracle Human Capital Management (HCM). While you can access all of these application components from the Setup and Maintenance work area, understanding what components are used for what purpose and terminology differences in these applications will help you with your setup.

Application Components Used for Implementing Oracle Fusion CRM Security

This diagram provides an overview of the key security setups and the application components that you use to configure them.

The following table provides an explanation of the application components:

Terminology Differences Between Applications

Oracle Fusion CRM applications use different terminology from Oracle Fusion Middleware applications. The key differences are described in the following table:

Oracle Fusion CRM Security: Implementation Planning

Users gain access to application functionality when you provision them with enterprise roles. Oracle provides you with the enterprise roles required for all the standard jobs in a CRM organization. This topic outlines the steps you must complete to provision users with the enterprise roles provided by Oracle and what additional steps you must complete if you are planning to make changes.

Implementing Security If You Plan to Use Enterprise Roles Provided by Oracle

Follow these steps if you want to provision users with the preconfigured enterprise roles provided by Oracle:

1. Create resource roles if the existing resource roles do not match the job titles in your organization.

   Resource roles indicate the role the resource plays in the CRM organization. When you create users for Oracle Fusion CRM applications, you must specify their resource role, which appears as the job title of the person in the resource directory and in social applications, such as the Activity Stream.

   You also use resource roles to trigger the provisioning rules you will set up in the next step.

   Oracle supplies the resource roles that correspond to the preconfigured job roles. For example, Oracle includes the Sales Vice President and the Marketing Vice President resource roles, which correspond to the Sales VP and the Marketing VP job roles.

   If your organization uses different titles, then you must create additional resource roles.

   You can review a list of the existing resource roles and create additional resource roles by navigating to the Setup and Maintenance work area and searching for the Manage Resource Role Lookups task.

   See the Creating Resource Roles: Worked Example help topic for step-by-step instructions on creating resource roles.

2. Create rules that automatically provision users with job roles and abstract roles.

   When you create users, the provisioning rules automatically provision users based on the user resource role and employment status.

   You must create the provisioning rules from the Setup and Maintenance work area, by using the Manage HCM Role Provisioning Rules task.

   See the following help topics for information on best practices to create the rules and step-by-step instructions:

   • Rules to Automatically Provision Oracle Fusion CRM Users with Enterprise Roles: Explained

   • Creating Rules to Automatically Provision Enterprise Roles to Oracle Fusion CRM Users: Worked Example

3. You are now ready to create users.

Implementing Security If You Plan to Customize Enterprise Roles Provided by Oracle

The following steps will help you plan your security implementation if you decide to make changes to the preconfigured job roles and abstract roles provided by Oracle:

1. Review the enterprise roles provided by Oracle.

   Details on the available job roles, abstract roles, duty roles, privileges, and data security roles are described in reference manuals organized by different business areas, such as sales, marketing, and partner relationship management.

   If the jobs in your organization do not match the job roles provided by Oracle, then you can modify access for users by assigning them with multiple existing job roles or creating new job roles. Creating new job roles makes it possible for you to select which duty roles to include and, in some cases, to configure new data security policies that govern on what data those duty roles grant access to.

2. Create any additional job roles.

   You create additional job roles in Oracle Identity Manager, an Oracle Fusion Middleware application, which can be accessed from the Setup and Maintenance work area by using the Manage Job Roles task.

   Note

   If you are implementing security in the Oracle Sales and Marketing Cloud Service, then you must request the Oracle provision administrator to create job roles for you because access to this functionality has not been extended to the Oracle Sales and Marketing Cloud Service.

   Before creating job roles, review the hierarchy of job roles and duty roles in the security reference manuals. The hierarchy of duty roles is not visible when you view them in Oracle Identity Manager.

   Each job role includes a top-level duty role with the same name, which inherits all the other duty roles. If you want to give additional functionality to a group of users, for example, sales managers, then assign the Sales Manager Duty role to the job role you are creating to inherit all the current permissions and data access, and then add whatever additional duty roles you needed.

   Tip

   Oracle Identity Manager uses different terminology from Oracle Fusion CRM. Job roles and abstract roles are referred to as roles.

3. Create duty roles and add them to the job roles that you created.

   If you do create a job role, then use the Oracle Authorization Policy Manager, which is a separate Oracle Fusion Middleware application, to do the following:

   1. Create a top-level duty role for the job role.

   2. Add the duty roles that you want to inherit to that top-level duty role.

   3. Associate the job role that you created with your duty role on the External Role Mapping tab.

   Tip

   Oracle Authorization Policy Manager uses different terminology from Oracle Fusion CRM. Duty roles are referred to as application roles and job roles as external roles. You can identify duty roles by the word DUTY at the end of their names.

   You can access Oracle Authorization Policy Manager from the Setup and Maintenance work area using the Manage Duties task.

   Detailed steps on how to create a job role and duty role are provided in the following help topic: Enabling Sales Representatives to Obtain Microsoft Outlook Access to All Sales Accounts: Worked Example.

   The duty role that you create inherits all of the data security policies from the duty roles that you add. You can create additional data security policies if you want to change user access to specific data. For example, the predefined data security policies for the duty roles inherited by the Sales Representative Duty permit salespeople to view only sales accounts if they are on the sales account team. If you want to give salespeople access to all sales accounts, then you can create a data security policy. The same example, Enabling Sales Representatives to Obtain Microsoft Outlook Access to All Sales Accounts: Worked Example, provides the detailed steps.

4. Retrieve any security changes made in Oracle Identify Manager (stored in the Lightweight Directory Access Protocol (LDAP) store) so they are available for creating users.

   Modifications to the reference become available only after the LDAP store is synchronized. The Oracle Sales and Marketing Cloud Service takes care of the synchronization for you. If you are implementing on premises, then you must run the synchronization process from the Setup and Maintenance work area using the Run User and Roles Synchronization Process task.

5. Follow the steps for implementing the preconfigured security described in the Implementing Security If You Plan to Use Enterprise Roles Provided by Oracle section.

Oracle Fusion CRM Security: Special Considerations

This topic explains what happens if you omit the security setups and highlights the differences between implementing security on premises and in the Oracle Sales and Marketing Cloud Service.

Minimum Required Security Setups

If you plan to use only the preconfigured enterprise roles provided by Oracle, then you must:

1. Review the existing resource roles to see if they correspond to the titles of the different resources in the CRM organization, and create any additional resource roles you need.

2. Create the provisioning rules to automatically provision the required job roles and abstract roles.

3. If you are implementing on premises, then you must Synchronize the Lightweight Directory Access Protocol (LDAP) store by using the Run User and Roles Synchronization Process task from the Setup and Maintenance work area.

   If you are implementing in the Oracle Sales and Marketing Service, then the process is run for you.

Differences Between Implementing Security On Premises and In the Cloud

The following table highlights the differences between implementing security on premises and in the Oracle Sales and Marketing Cloud Service:

Siebel CRM and Oracle Fusion CRM Security Differences: Explained

Siebel CRM and Oracle Fusion CRM implement different methods of securing access to application functionality and data. This topic outlines the mechanisms provided by Siebel CRM to control the privileges or resources that users are entitled to after they have accessed a Siebel application and been authenticated. For additional information on Siebel CRM security, see Siebel Security Guide on Oracle Technology Network.

Siebel CRM uses two primary access-control mechanisms:

• View-level access control to manage the application functionality that a user can access

• Record-level access control to manage the data items that are visible to each user on a view

View-Level Access control

In Oracle Fusion CRM, access to functionality is provided by assigning enterprise roles to users. In Siebel CRM, access to functionality is provided by assigning responsibilities to users.

Within each Siebel application, screens provide a broad area of functionality. A screen is composed of views, and the collection of views to which users have access determines the application functionality available to them. Access to views is determined by responsibilities.

Organizations are generally arranged around job functions, with employees being assigned one or more functions. In Siebel CRM, these job functions are called responsibilities. Each responsibility is associated with more or more views, which represent data and functionality needed for a job function. Each user must be assigned at least one responsibility to access the Siebel application.

Siebel Business Applications ship with many predefined responsibilities. However, you can also define any additional responsibilities that you require that correspond to the major job functions in your organization.

Record-Level Access Control

Record-level access control is used to assign permissions to individual data items within an application so that only authenticated users who need to view particular data records have access to that information. In Oracle Fusion CRM, access to data is primarily determined by the data security policies that apply to specific enterprise roles. In Siebel CRM, the access control mechanism that applies to a view determines the data records that a user sees in a view.

Siebel CRM uses the following types of record-level access control mechanisms:

• Personal access control. Access to data associated with a user's Person record in the database is restricted to that user.

• Position access control. Access to data that is specific to a job title is restricted to users assigned that job title, to their team members, or to their subordinates.

• Organization access control. Employees assigned to a position within an organization are granted access to the data assigned to that organization.

• Access-group access control. Access groups are used to control access to master data by diverse groups of individuals.

• All-access control. All-access control provides access to all records in a view that has a valid owner. If a view applies all-access control, then all users with access to the view see the same data in the view.

Business Components and Record-Level Access Control

Within Siebel CRM, views are based on business components and must use one of the view modes specified for the business component. A business component's view mode determines which access control mechanisms can be applied to the business component in any view. Applet and view properties also determine the data available in a view. Applet visibility properties define the business component on which a view is based, and a view's access control properties determine what access control mechanism is applied to the business component on which the view is based. For example, a business component might have personal or position access control available. The view access control property specifies which of these to use.

Creating Resource Roles: Worked Example

Follow the steps in this topic to create resource roles. Resource roles, for example, Sales Manager, Salesperson, or Vice President of Marketing, describe the role that a resource plays in the CRM organization and appear as job titles in the resource directory and in social applications, such as Activity Stream. Resource roles are also used to assign users with the enterprise roles they need to carry out the duties of their job.

After you create a resource role, you must create the appropriate provisioning rules to provision the user with the required enterprise roles. The resource role by itself is only a title.

Steps to Create a Resource Role

1. Navigate to the Setup and Maintenance work area by selecting the link in the Navigator menu.
2. On the All Tasks tab, search for the Manage Resource Role task.
3. Click the Go to Task button.

   The Manage Resource Roles page appears.

4. Click the Create button.

   The Create Resource Role page appears.

5. In the Role Name field, enter the name of the resource role as it will appear in the application, for example, CEO.
6. In the Role Code field, enter a unique internal name. No spaces are permitted.
7. Select the Manager option if the resource role belongs to a manager, or the Member option if the resource role belongs to a single contributor.
8. In the Role Type list, select either Sales or Marketing to classify the role that you are creating. Your selection has no impact on the security functionality.
9. Click the Save and Close button.

Rules to Automatically Provision Oracle Fusion CRM Users with Enterprise Roles: Explained

By creating rules using the Manage HCM Role Provisioning Rules task from the Setup and Maintenance work area, you can automatically provision users with all the enterprise roles they need for their job. These roles ensure the users have access to all the application functions and data they need to carry out their job duties. The rules automatically provision the users when they are created or move positions within your organization. If resources leave your company, the roles can be automatically removed so the resources can no longer access the application.

You must ensure that the rules you create assign Oracle Fusion CRM application users with:

1. One or more job roles required to perform their job in the organization.

2. If the users work in the CRM organization, then you must assign them the Resource abstract role. This role permits users to be assigned to sales teams, territories, and other CRM work.

3. If the users are employees, then you must also assign them with the Employee abstract role. If they are temporary workers, then you must instead assign them with the Contingent Worker abstract role.

   In CRM, both abstract roles assure that users can update their personal profiles and other common tasks.

As a best practice:

• Create rules that provision the Resource abstract role and the job roles users need to perform their job based on the resource role assigned to them. Most resource roles will require just one job role, but some may have more than one. For example, the Sales and Marketing Vice President may require both the Sales VP and the Marketing VP job roles.

• Create one rule that provisions all users who are employees (Person Type of Employee) with the Employee abstract role.

• If you hire contractors, then create a separate rule to provision the Contingent Worker abstract role to all users with the Person Type of Contingent Worker.

• For all rules you create, ensure that the privileges the users are granted are automatically removed when they are no longer with the company. You can do this by stipulating the condition that the rule apply only when the user has the Assignment Status of Active.

• If you plan to create users to perform implementation tasks who are not resources in the CRM organization, then you must create a provisioning rule that is based not on the resource role but some other user attribute. For example, you can create a rule to provision the required Application Implementation Consultant and IT Security Manager job roles based on the user's job assignment.

The following figure provides an example of the rules you would create to provision employee users who are assigned the Sales Manager resource role:

• Rule one assigns the Employee abstract role to users who are employees with an Assignment Status of Active.

• Rule two assigns the Sales Manager job role and the Resource abstract role to users with the Sales Manager resource role and an Assignment Status of Active.

Creating Rules to Automatically Provision Enterprise Roles to Oracle Fusion CRM Users: Worked Example

Follow the steps in this example to create rules that automatically provision Oracle Fusion CRM application users with the necessary enterprise roles. The provisioning is based on the resource role that you assign to a user.

In this example, you create a rule to provision users with the Sales Vice President resource role with the enterprise roles they need to perform their jobs.

Steps to Create an Autoprovisioning Rule

1. From the Navigator menu, click the Setup and Maintenance link located under the Tools heading.
2. On the Overview page All Tasks tab, search for the Manage HCM Role Provisioning Rules task.
3. Click the Go to Task button for the Manage HCM Role Provisioning Rules task.

   The Manage HCM Role Provisioning page appears.

4. Click the Create button.

   The Create Role Mapping page appears.

5. In the Mapping Name field enter a name, for example, Sales Vice President.
6. In the Conditions region, enter the resource role as a condition. In this example, you enter Sales Vice President in the Resource Role field.
7. Enter Active for Assignment Status.

   This additional condition ensures that the provisioned enterprise roles are automatically removed if the user is terminated.

8. In the Associated Roles region, click Add to add the enterprise roles. For this example, you add the following:

   • Sales Vice President

   • Resource

   Note

   Each CRM resource who is an employee must be provisioned with both the Resource and Employee abstract roles. You must create a separate rule that assigns the required Employee abstract role to all users who are employees. You must always provision the Resource role along with the appropriate job roles. This provisioning ensures that the user can be assigned work in your CRM application.

9. Make sure the Autoprovision option is selected for all the job roles.
10. Click Save and Close.

Define Users for CRM

Creating Oracle Fusion CRM Application Users: Functional Overview

This topic outlines concepts that will help you understand and plan the creation of Oracle Fusion CRM applications users.

Types of Users That You Can Create

The types of users that are available to you differs for Oracle Sales and Marketing Cloud Service implementations and on-premises implementations.

• On-premises implementations can use Oracle Identity Manager, an Oracle Fusion Middleware application, to create and provision enterprise roles to implementation users outside Oracle Fusion CRM applications.

• Oracle Sales and Marketing Cloud Service implementations do not have access to Oracle Identity Manager, so you must create and provision implementation users within Oracle Fusion CRM. The term setup users distinguishes the implementation users created from within the Oracle Fusion CRM applications from those created in Oracle Identity Manager.

The following table lists the different user types. Because permissions granted to users depend on the enterprise roles you assign them, you are not restricted to the user types listed in the table.

Ways of Creating Oracle Fusion CRM Application Users

You can create Oracle Fusion CRM application users in multiple ways. You can:

• Create users individually in the user interface

  Use this method for creating implementation and sales administrator users and for creating application users unless the number of the number users you are creating is very large.

• Import users from a file

  Import users from a file using the file-based import feature only if you have a very large number. You cannot import implementation users because the import process requires you to import CRM resources.

• Load user records into the database tables

  If you are implementing CRM on premises and you are creating a large number of users, then you can load users into the application using a loader of your choice.

Tasks That Are Accomplished When You Create Users

When you create CRM implementation and application users, you are accomplishing multiple tasks at the same time, depending on the type of user. The following table lists the tasks:

Setting Up E-Mail Notifications for New Users

For each CRM user that you create, you must enter a unique e-mail address. By default, the application automatically sends an e-mail notification with the user name and temporary password to this address immediately after the user is created. Users then sign in and change their passwords.

If you do not want users to receive the notification e-mail right away because you are in the trial phase of your implementation project, then you can disable the automatic notification using the following steps:

1. Navigate to the Setup and Maintenance work area.

2. Search for the task Manage Enterprise HCM Information on the All Tasks tab of the Overview page.

3. Click the Go to Task button.

4. In the Enterprise page, click the Edit button, and select Update.

5. In the User and Role Provisioning Information region, set the Send User Name and Password option to No.

6. Click Done.

When users are ready to receive their temporary passwords, you can send all of the notifications at the same time, using the following steps:

1. In the Navigator menu, select Scheduled Processes under the Tools heading.

2. In the Scheduled Processes Overview page, click Schedule New Process.

3. In the Schedule New Process dialog box, make sure the Job option is selected for Type.

4. Enter Send User Name and Password E-Mail Notifications in the Name field.

5. Click OK.

6. In the Process Details window, click Submit.

7. Click Close.

Alternately, you can send a notification to an individual user:

1. While editing the user in the Create User or Edit User page, select the Send User Name and Password check box in the User Notification Preferences region.

Creating the Resource Reporting Hierarchy

The resource reporting hierarchy provides the basis for CRM data security. The resource reporting hierarchy need not mirror the formal reporting hierarchy, which is captured separately in the Oracle Fusion HCM application if it has been implemented.

You build a resource reporting hierarchy when you create CRM application users by specifying the manager for each user. If you are creating users one-by-one in the user interface, then you must start by creating the user at the top of the hierarchy and work your way down. If you are importing users using file-based import, then the order does not matter provided that all of your users are in the same file.

Creating Resource Organizations and the Resource Organization Hierarchy

In Oracle Fusion CRM, you must assign each manager that you create as a user with his or her own resource organization. All direct reports who are individual contributors inherit their manager's organization.

In Oracle Fusion CRM, resource organizations serve a limited purpose. Their names appear in the application's Resource Directory, which users can access to obtain information about their coworkers, and in social media interactions. Resource organizations are not used for work assignment.

The following screen capture shows the Resource Directory, which is available on the application Navigator. The resource organization names appear under each person's title.

The application automatically builds a resource organization hierarchy, using the resource reporting structure.

Suppose, for example, that your CRM enterprise includes sales and marketing departments that report to the Executive VP of Sales and Marketing and its members as follows:

• Mathew Fullerton, Executive VP Sales and Marketing

• Bob Doyle, Sales VP

• Mateo Lopez, Sales Manager

• Gabrielle Lee, Sales Manager

• Jillian Henderson, Sales Representative (reporting to Mateo Lopez)

• Joseph Kerr, Sales Analyst (reporting to Gabrielle Lee)

A diagram of the reporting hierarchy looks like the following:

Now, also suppose that you create the following resource organizations and assign them to the managers.

The application automatically builds the resource organization hierarchy, shown in the following figure, using the hierarchy of managers.

The resource organizations remain even if managers leave. You can reassign the resource organizations to their replacements.

The resource organization names do not have to reflect the names of departments. Departments are tracked along with employee records in the Oracle Fusion HCM application if it has been implemented. The resource organizations are not used in application security or to assign work to users. For example, you cannot include a resource organization on an opportunity sales team or as a territory owner.

Creating Oracle Fusion Human Resources Employee Records

When you create application users, you must include information that is used to create basic employee records for the Oracle Fusion HCM application. This requirement is part of the CRM application architecture. These records are used only if you are implementing this application now or plan to do so.

Creating Oracle Fusion CRM Application Users: Architectural Overview

This topic describes the different applications and application modules that you use when you create Oracle Fusion Customer Relationship Management (CRM) users. These include Oracle Fusion Human Capital Management (HCM), File-Based Data Import, Universal Messaging Service, and Oracle Identity Management, which is an Oracle Fusion Middleware application.

The following figure outlines the different application components that you use when you are creating and managing users:

• Creating users

  You can create CRM application users in one of three ways. Each method involves different application components.

  • To create users individually in the user interface, you select the Manage Users option in the application Navigator.

    The Create User page is part of the Oracle Fusion HCM application, but you are not required to purchase or to implement Oracle Fusion HCM. The core Oracle Fusion HCM features that are required to create and manage CRM users are provided with Oracle Fusion CRM.

  • To import users from a file, use the tasks in the setup task group Define File-Based Data Import. You can search for this task group from the Setup and Maintenance work area. You can use the File-Based Data Import task group, which is described in a separate topic, to import many application objects, including customer records, opportunities, and leads.

  • If you are implementing CRM on premises, then you can also create users by importing them using a loader of your choice. To use a loader, select Data Import under the Customer Data Management heading in the Navigator menu, or use the Define Trading Community Import task list in the Setup and Maintenance work area.

• Managing notifications

  When you create users using any of these methods, you can automatically send an e-mail notification with the user name and temporary password. The e-mails are sent by the User Messaging Service, a part of the Oracle Service-Oriented Architectures Suite, which is a separate Oracle Fusion Middleware application. If you are implementing your CRM application on premises, then a superuser can also manage the notifications and the notification templates from the User Messaging Service application.

• Managing users

  When you create users, basic user information is copied to Oracle Identity Management, which is a separate Oracle Fusion Middleware application. If you are implementing CRM on premises, then you can use Oracle Identity Management for user management. For example, you can use Oracle Identity Management to reset user passwords and manage the enterprise roles that provision users with the security settings they require to carry out their duties. On premises implementations can use Oracle Identity Management to create implementation users, but not CRM application users.

The following table provides a breakdown by task or component:

Creating Oracle Fusion CRM Application Users: Implementation Planning

This topic provides an overview of how to create Oracle Fusion Customer Relationship Management (CRM) application users and their resource organizations.

This topic covers:

• Creating the resource organization at the top of the CRM organizational hierarchy

• Creating the resource organizations that you must assign to each manager

• Creating the users

Prerequisites

Before you create CRM users you must:

• Make sure that all enterprise information has been set up.

• Complete the security setup. Make sure you have all the resource roles, enterprise roles, and autoprovisioning rules you need for the users you are creating.

Creating the Resource Organization at the Top of the CRM Hierarchy

Before you can create resource organizations for your users, you must create the top-level organization in your hierarchy.

To create the top-level organization, do the following:

1. Create the top-level organization as you would create any other resource organization by using the Manage Sales and Marketing Organizations task from the Setup and Maintenance work area.

2. Specify the resource organization that you created as the top of your sales and marketing hierarchy by using the Manage Resource Organization Hierarchies task from the Setup and Maintenance work area.

For more information, see the Creating the Top Level of the CRM Resource Organization Hierarchy: Worked Example help topic.

Creating Resource Organizations for Manager Users

If you are creating users individually in the user interface using the Create User page, then you can create the resource organizations while you are creating the users, or you can create them before using the Manage Sales and Marketing Organizations task from the Setup and Maintenance work area.

If you are importing users, then you must have the resource organizations created before you import any data.

For more information, see the Creating Resource Organizations for Oracle Fusion CRM: Worked Example help topic.

Creating Users

This section provides an overview of the different methods of creating Oracle Fusion CRM users:

• To create users individually in the user interface:

  Navigate to the Manager Users work area, which is available as a selection on the application's Navigator.

  The Create User page, displays up to six regions, depending on your release version, your enterprise defaults, and the enterprise roles assigned to you. The following screen capture shows the page.

  
  
  

  The following table describes the regions.

  
  

  Create User Page Region	Description
  Personal Details	You are required to enter the user's last name, hire date, and a unique e-mail address for the initial e-mail notification.
  User Details	Enter the user name that the user will use to sign in.
  User Notification Preferences	Select the option in this region if you want to send the user name and password to the user you are creating. This region appears only if you decided to turn off automatic notifications by setting the Send User Name and Password option to No while editing the enterprise information using the Manage Enterprise HCM Information task.
  Employment Information	The information you enter in this region is used to create the basic employee record for use with the Oracle Fusion Human Capital Management (HCM) application. Only the required fields are relevant to CRM.
  Resource Information	Make entries in this region if you are creating a CRM application user who is a CRM resource. Leave this region blank for setup users who are not members of the CRM organization. You must enter a resource role and a manager for every CRM application user, because access to application data depends on the resource hierarchy. For every user with a manager resource role, you must enter a resource organization. The resource role you select determines the job roles that the user will be assigned when you click the Autoprovision Roles button
  Roles	Clicking the Autoprovision Roles button provisions the user with the enterprise roles that provide access to the application functions and data. If you are importing resources from a file, then the autoprovisioning is done automatically.

• To import users from a file:

  Use the Manage File Import Activities task from the Setup and Maintenance work area, and create an import activity. To import users, you must select the Employee Resource object when creating the import activity. Before you can import users, you must:

  • Understand what attributes are required, and what values are permitted.

  • Create a mapping between the user data that you are importing and the attributes in the application.

  Refer to Define File-Based Data Import topics for more information on how to import users and other data.

• If you are implementing CRM on premises, then you can load user data into the application by using a loader of your choice.

  Use the Import Worker Users task from the Setup and Maintenance work area.

Creating Oracle Fusion CRM Application Users: Special Considerations

This topic summarizes the main differences between creating users when you are implementing Oracle Fusion CRM on premises and in the Oracle Sales and Marketing Cloud Service.

The following table summarizes the main differences.

Creating Resource Organizations for Oracle Fusion CRM: Worked Example

In Oracle Fusion CRM, you must assign a resource organization to each manager user that you create. All direct reports of that manager inherit the organization. You can create resource organizations before you create users according to the steps in this example.

Steps to Create a Resource Organization

1. Navigate to the Setup and Maintenance work area, and search for the Manage Sales and Marketing Organizations task.
2. Click the Go to Task button.

   The Manage Sales and Marketing Organization page appears.

3. Click the Create button.

   The Create Organization: Select Creation Method page appears.

4. Select Option 2: Create New Organization.
5. Click Next.

   The Create Organization: Enter Basic Information page appears.

6. Enter the name of the organization, for example, Sales.
7. In the Organization Usages region, click Add Row (green plus sign) to specify whether the organization is going to be used as a sales organization, a marketing organization, or both.

   Specifying a usage determines whether the organization is visible when creating a sales manager or a marketing manager.

8. Click Finish.

Creating the Top Level of the CRM Resource Organization Hierarchy: Worked Example

Use this example as a guide for creating the resource organization at the top of the resource organization hierarchy. You must complete this setup before you create users.

When you create users who are managers in the Oracle Fusion CRM organization, you must assign a resource organization to each of them. The application automatically builds a resource organization hierarchy for you from the management hierarchy that you create.

Before you can create the resource organizations for the managers, you must create the top-level resource organization in your hierarchy following the steps in this example.

Creating the top-level resource organization in the resource organization hierarchy involves the following:

1. Creating the resource organization

2. Specifying the organization as the top of your sales and marketing hierarchy

Creating the Resource Organization at the Top of the Hierarchy

1. Search for the Manage Sales and Marketing Organizations task in the Setup and Maintenance work area.
2. Click the Go to Task button.

   The Create Organization: Select Creation Method page appears.

3. Click Create and select Option 2: Create New Organization.
4. Click Next.
5. Enter Global Organization (or another name of your choice) in the Name field.
6. In the Organization Usages region, click Add Row to add Sales Organization and Marketing Organization.

   This step identifies how the organization is being used.

7. Click Finish.

Specify the Organization as the Top of Your Sales and Marketing Hierarchy

1. Search for the Manage Resource Organization Hierarchies task in the Setup and Maintenance work area.
2. Click the Go to Task button.

   The Manage Resource Organization Hierarchies page appears.

3. Click Search.
4. In the Search Results, select the Sales and Marketing Organization Hierarchy link.

   You will associate the resource organization you created with the predefined hierarchy type.

5. From the Action menu at the top right-hand corner of the page, select Edit This Hierarchy Version.

   The Edit Organization Hierarchy Version page appears.

6. Click the Add button in the Global Sales and Marketing Organization Hierarchy region.

   The Add Tree Node window appears.

7. Click Search.

   The Search Node window appears.

8. Click Search.
9. Select Global Organization.
10. Click OK.

    The application returns you to the Edit Organization Hierarchy Version page.

11. Click Done.

Creating Setup Users for Oracle Fusion CRM: Worked Example

Follow the steps in this example to create a setup user, an application user with the privileges to set up application security, make changes to the enterprise setup, create other users, and complete most setup tasks. Because setup users are not created as CRM resources, they cannot view CRM data or reports and cannot be assigned to sales teams and territories.

Creating a Setup User Overview

Setup users do not work in the CRM organization and so should not appear in the CRM application directory or be available as resources for assignment to sales teams. For this reason, you do not specify a resource role or any other resource information for this type of user.

To provision these users with the required Application Implementation Consultant and IT Security Manager job roles, you must create a provisioning rule that is triggered not by the resource role assigned to the user, but by some other attribute. In this example, you will trigger the rule on the user's job.

To create the setup user, you will:

1. Sign in as a user with implementation privileges. This can be another setup user.

2. Create the job that will trigger the rule, Customer Administrator in this example.

3. Synchronize the Lightweight Directory Access Protocol (LDAP) directory with any changes to the security setups by running a scheduled process.

   The LDAP directory enables quick access by CRM Fusion Applications to security settings, so it is a good idea to update the directory to make sure it reflects all the latest security changes.

4. Create the provisioning rule to provision the required enterprise roles to users with the Customer Administrator job.

5. Create a rule to provision the Employee abstract role to all employee users. This is a one-time setup, so you can ignore this step if you created the rule previously.

6. Create the user.

Creating a Job

To create the job:

1. Navigate to the Setup and Maintenance work area.
2. On the All Tasks tab search for the Manage Job task.
3. Click the Go to Task button for the Manage Job task.

   The Manage Job page appears.

4. Click the Create button.
5. Enter a name for job that will be displayed for selection in the Create User page. For example, Customer Administrator.
6. In the Code field, enter an internal code for the job, for example, CUSTADMIN. The code must be uppercase with no spaces.
7. For Job Set, select Common.
8. Click Next.

   The Create Job: Details page appears.

9. Click Submit.

Updating the LDAP Directory

To update the LDAP directory:

1. Select the Scheduled Processes link in the Navigator.
2. Click the Schedule New Process button.

   The Schedule New Process window appears.

3. Select Retrieve Latest LDAP Changes from the Name list.
4. Click OK.
5. Click Submit.

Creating the Role Provisioning Rule for the Setup User

To set up the provisioning rule that automatically assigns the appropriate enterprise roles:

1. Navigate to the Setup and Maintenance work area.
2. On the All Tasks tab search for the Manage HCM Role Provisioning Rules task.
3. Click the Go to Task button for the Manage HCM Role Provisioning Rulestask.

   The Manage HCM Role Provisioning page appears.

4. Click the Create button.
5. In theMapping Name field enter a name, for example, Customer Administrator.
6. In the Conditions region, enter the job you created earlier as a condition. In this example, you would enter Customer Administrator in the Job field.
7. Enter Active for Assignment Status. This additional condition ensures that the provisioned enterprise roles are automatically removed if the user is terminated.
8. In the Associated Roles region, use the Add button to add the following job roles:

   • Application Implementation Consultant

   • IT Security Manager

9. Make sure the Autoprovision option is selected for both job roles.
10. Click Save and Close.

Creating the Role Provisioning Rule for All Employees

You must create one rule to provision all users who are employees with the Employee abstract role. This is a one-time-only setup.

To create the provisioning rule for employees:

1. Navigate to the Setup and Maintenance work area.
2. On the All Tasks tab search for the Manage HCM Role Provisioning Rules task.
3. Click the Go to Task button for the Manage HCM Role Provisioning Rulestask.

   The Manage HCM Role Provisioning page appears.

4. Click the Create button.
5. In theMapping Name field enter the rule name, for example, Employee.
6. In the Conditions region, select Employee from the Assignment Type field.
7. Select Active for Assignment Status. This additional condition ensures that the role is automatically removed if the user is terminated.
8. In the Associated Roles region, use the Add Row button to add the Employee role.
9. Make sure the Autoprovision option is selected for the role.
10. Click Save and Close.

Creating the Setup User

To create the setup user:

1. On the Navigator select the Manage Users link under the Manager Resources heading.

   The Manage Users page appears.

2. Click the Create button.

   The Create User page appears.

3. In the Personal Details region, enter the following fields:
   

   Field	Entry
   Last Name	Enter the user's last name. Entry is required.
   First Name	Optionally, enter the user's first name.
   E-Mail	Enter a unique e-mail address. This e-mail address is used to send the initial notification to the user and can be changed later.

4. In the User Details region, enter the user name. If you leave the User Name field blank, the application creates a user name based on the entries you already made.
5. If the User Notification region appears and the Send User Name and Password is unselected, then select it if you want to send the e-mail notification with the login and password to the user when you save the record.

   If this region is not present in the page, then the notification will be sent automatically.

6. In the Employment Information region, enter the following:
   

   Field	Entry
   Person Type	Select Employee. Do not select Contingent Workerbecause enterprise role provisioning is based on the employee's job, a field that appears only for employees.
   Legal Employer	Select the legal employer created as part of enterprise setup. If you are implementing in the Oracle Sales and Marketing Cloud Service, then the legal employer was set up for you based on the information that you provided when you signed up for the service.
   Business Unit	Select the business unit created as part of enterprise setup. If you are implementing in the Oracle Sales and Marketing Cloud Service, then the business unit was set up for you based on the information that you provided when you signed up for the service.
   Job	Select the job you created earlier.

7. Click the Autoprovisioning Roles button.

   The Roles region should now display the following roles:

   • Application Implementation Consultant

   • IT Security Manager

   • Employee

8. Click Save and Close.

Previous

Next

Copyright ©  2011-2013, Oracle and/or its affiliates. All rights reserved. Legal Notices

Home

Contents

Book List

Contact Us