| Oracle® Retail Predictive Application Server and Applications Cloud Edition Security Guide Release 22.1.202.0 F56956-01 |
|
 Previous |
| Oracle® Retail Predictive Application Server and Applications Cloud Edition Security Guide Release 22.1.202.0 F56956-01 |
|
Previous |
This chapter covers integrating information across multiple RPASCE applications.
The client/server interactions of RPASCE define how users may access the system but are not effective for larger scale modification of the data of the system. To allow for these operations, RPASCE supports bulk data load and export operations. RPASCE supports only file-based integration. These files are provided to and retrieved from the system through the use of an SFTP server that is part of the provisioned environment.
RPASCE applications rely on OCI IAM for user authentication and authorization. Users are created, deleted, and assigned roles within OCI IAM. Those users who have been granted the authentication role for an RPASCE application are given access to the application with the set of application privileges granted by the user roles that user has been granted in OCI IAM. Additionally, users granted the administrator role in OCI IAM are also allowed access to the administrative functions of the RPASCE application and granted super user rights that supersede the rights of the application roles they may have.
As a result, the integration of user information between multiple RPASCE applications or between an RPASCE application and another Oracle Retail application is entirely a matter of role membership within OCI IAM. Users granted the authorization role for multiple RPASCE applications will have access to those applications, with application privileges determined by the application roles for those applications.
RPASCE uses object storage for interacting with incoming and outgoing files in the cloud. Object storage is available from Oracle for cloud customers and is documented at the link below.https://docs.oracle.com/en-us/iaas/Content/Object/Concepts/objectstorageoverview.htm
Data from all pre-defined planning interfaces to external systems such as RMF CS (Oracle Retail Merchandising Foundation Cloud Service) or internal systems like Retail Insight/Science is pulled via importers from RDX schema. Any data that is going from Planning to external systems can also be exported via exporters to the RDX schema. Though interface tables in the RDX schema will not change quite often, as defined by the interface contracts between respective applications, the planning/forecast application that is implemented on PDS supports extensibility and EE configuration. Therefore, importers and exporters must be configurable, since dimensions and fact names can be different for different customers. To provide for the configurability of importers and exports, the interface.cfg file (interface configuration file) is used. It is a free-form text file similar to the batch control file, and contains the mapping of dimension/facts in PDS to columns mapped to external tables for each interface.
Both importers and exporters are commonly referred as interfaces within PDS; each interface has a unique interface ID. Interfaces are classified as one of three types: dimension importers, data importers, or data exporters. Customer can create or modify entries only for the available list of interfaces. They can configure the interface to match and pull the required dimension/fact data per the dimension/fact names configured with in their application when those interfaces are executed in batch. For general availability applications, the pre-configured interface.cfg file is readily available, and customer can customize the file for any required extensibility changes, similar to an EE customer.
For more information about uploading the custom interface.cfg file, see the Load Interface Mappings task in the Oracle Retail Predictive Application Cloud Edition Administration Guide.
Customers can make use of Oracle ReSTful Data Services (ORDS) to invoke web services that supply the data stored with in the Planning Data Schema. Several standard web service endpoints are provided, and it is possible to create additional endpoints to supplement those provided.
The access provided to ORDS by the Planning Data Schema allows only for reading data; there is no capability for modification of the data contained within the Planning Data Schema. The endpoints provided are intended for use by external systems that connect to ORDS through the use of system accounts.
In order to connect to the Planning Data Schema through ORDS, the account representing the external process must exist within the OCI IAM instance associated with the application. Additionally, that account must belong to the group RPAS_ORDS_GROUP. All unauthenticated access requests and any requests made by a user who is not a member of the RPAS_ORDS_GROUP will be denied.
In order to create additional service endpoints, it is necessary for a user to gain limited administrative access to ORDS. First, the user must exist within the OCI IAM instance and belong to the RPAS_ORDS_GROUP role. Second, a service request must be created to give that user access to the ORDS administrative UI.
Once access is granted, authorized users will be able to access parts of the ORDS administrative UI that allow the creation and registration of endpoints. However, they will not have access to other administrative functions (such as security policy management) of the ORDS instance.
RPASCE makes use of a service provider, Pendo, in order to deliver guided learning for RPASCE applications and to collect analytic information about application usage, which is used for product training improvements and feature development decisions. This chapter provides information about that data collection: what is collected, how it is used, how it is protected, and how users may exercise their rights to control the data collection and usage.
For a complete list of Oracle affiliates and subprocessors, review Doc ID: 2237897.2 for your Retail Cloud Services application.
The information collected by Pendo does not include personally identifiable information (PII) such as name, email address, or other sensitive information, nor does it include information that could be used to identify a user, such as geolocation data. All information is associated with a given user using a token consisting of a one-way hash of the user identifier, and no mapping of users to these tokens is available either to Pendo or to any other external party.When a user connects to a RPASCE application, a set of executable scripts is loaded into the user's browser. The scripts are used by the browser to interact with the RPASCE application. If a user has consented to the collection of data (as described in which is described in "User Control of Collected Data"), then additional scripts will be loaded to allow them to interact with the third-party guided learning and user analytic services provided by Pendo.These scripts make it possible for the guided learning resources hosted by Pendo to be available to the user to assist them in using the RPASCE application. These scripts also collect information about an individual user's actions within the application, both in regards to the guided learning (for example, which lessons are attempted or completed) as well as the functionality of the base RPASCE application (for example, which screens are visited or which operations are being performed).
Non-aggregated information collected by Pendo is accessible only by authorized Oracle employees and only to those with a legitimate business need and only to be used for the intended purpose: to allow Oracle to better understand how users interact with the application in order to improve the application and overall user experience.Additionally, information aggregated across all users of a given customer may be used to provide a set of pre-defined reports to that customer in order to assist in the evaluation of the Cloud Services and the guided learning contained within them.This information is not used for other purposes nor is it disclosed to other parties.Information collected and stored for an individual user is also accessible to that user, which is described in "User Control of Collected Data."
User information collected by Pendo is stored within its systems where it is protected from unauthorized access in compliance with industry best practices and regulatory standards. Information about the protections Pendo provides for user data and privacy can be found here:https://www.pendo.io/support/trust/The data hosted within Pendo's system is stored for a maximum of one-hundred eighty (180) days, at which point it is deleted. Additionally, users may request that all information collected about them be deleted, which is described in "User Control of Collected Data.".
In accordance with Oracle policies for data collection and with international law, including the General Data Protection Regulation (GDPR), users have the right and ability to control how information about their actions is collected and used. These rights are met by three systems accessible to a user when logged into the hosting RPASCE application.Firstly, users will not have information collected about them unless they have explicitly provided consent. This takes the form of an opt-in step users can complete when logged into an RPAS CE application. Users who have opted-in for data collection have the ability to revoke this consent at any time they are logged into the RPASCE application.Secondly, users have the right to request that any information collected about their usage of the system be deleted. This request may be made at any time a user is logged into the RPASCE application. The RPASCE application will process the user request and provide notification when the deletion has been completed by Pendo.Finally, users have the right to request access to any information collected about their usage of the system. This request may be made at any time the user is logged into the RPASCE application. The RPASCE application will process the user request, retrieve that user's information from Pendo, and make it available to the requesting user. Note that the information retrieved from the Pendo service is returned "as is" and is not inspected or manipulated after retrieval. It is retained within Oracle systems only for the duration required to supply it to requesting user.Additional information about how to initiate any of the above actions can be found in the User Guides for the RPASCE applications.
