1 Security Features

Oracle Retail AI Foundation Cloud Services uses web services to push information to Customer Engagement and to expose configuration as well as application incremental data and reports to customers.

Technology-Specific Guidelines

This section details the security guidelines.

Security Features

Oracle Retail AI Foundation Cloud Services supports the following security features.

Web Services

The Web service in Oracle Retail AI Foundation Cloud Services is stateless, so state is not stored or managed. Pagination such as the batch size of data and parameters such as export data time, product, location, and so on are used to manage payload size and to handle session timeouts.

SOAP

Oracle Retail AI Foundation Cloud Services has an Outbound Interface to push Customer Segment and its members to ORCE (Customer Engagement). This interface supports the following security features.

• Message authentication is enabled in ORCE, and the Oracle Retail AI Foundation Cloud Services message includes authentication information in the HTTP header for the message. This authentication information is specific to ORCE and is stored in the Credential Stores. The Credential Stores are created or updated from the Data Management task, enabled for an Administrator. The Base64 encoding tool is used to encode the authorization key that is sent as part of the Message HTTP Header request. The Credential Stores use APIs that applications can use to create, read, update, and manage credentials securely and mark code as being "privileged", thus affecting subsequent access determinations.

• Oracle Retail AI Foundation Cloud Services provides configuration to set up proxy settings for both HTTP and HTTPS.

• XML sent as part of the message relies on marshalling and un-marshalling to and from Java Objects generated using the WSDL/Schema exposed via ORCE. This enforce XML generated is well formed and valid. It is the responsibility of ORCE to convert XML; Oracle Retail AI Foundation Cloud Services does not perform any XML Conversion. There are no concerns regarding XXE and XEE.

REST

Oracle Retail AI Foundation Cloud Services has an Outbound Interface to export data (GET request), and it use REST to expose data. These web services are REST-based; it is assumed that callers are familiar with the basic REST principles (such as the usage of HTTP verbs). AC and ASO export web services can serve as a means of obtaining incremental update data from a specified point in time. All services support the query parameter contentType and the HTTP header Content-Type, with supported values application/json and application/xml. The query parameter takes precedence; if no content type is supplied, then application/json serves as the default. Basic authentication is used, so you may use any client software that supports it. Authorization is done for ADF-LDAP (OID) mapped roles, and only administrator roles are used. (That is, the calling user must be in a duty that is mapped to the defined administrator roles.) JSON/XML parsing is done using standard JAXB request parameters that are validated before data is fetched.

Authentication and Authorization

For authorization, Oracle Retail AI Foundation cloud Services modules have been built with role-based access. Access to application user interface components is done by assigning application roles. Application roles are defined as part of the application and deployed as part of the installation process. Application roles are mapped to enterprise roles during the initial environment provisioning. Enterprise roles exist as LDAP groups in OID. For Oracle Identity Cloud Service (IDCS) and Oracle Cloud Infrastructure Identity and Access Management (OCI IAM) users, it is available in the import file. Refer to the Oracle Retail AI Foundation Cloud Services User Guide for the definition of standard user roles.

User Roles

Oracle Retail AI Foundation Cloud Services supports the following roles.

Table 1-1 User Roles

Job Role	Role Description
AIF Platform
ADMINISTRATOR_JOB	A user who understands all the parameters driving the application and is responsible for their configuration as well as managing the credential store for CE, RPM, and so on.
ANALYTIC_EXPERT_JOB	Responsible for understanding the retailer's business, has some business analytics training, and has been trained in the use of the CDT and DT applications.
ASSORTMENT_PLANNER_JOB	The Assortment Planner is responsible for creating the category assortments, to meet the roles, strategies, and tactics set for the category by the Category Manager. Multiple category assortments are created, for each cluster or store. One planner can be responsible for multiple categories.
CLUSTERING_ADMINISTRATOR_JOB	Responsible for planning, building, and analyzing store clusters based on a variety of store and category attributes to support assortment, pricing, and space planning business processes in the Store Clustering Module.
CUSTOMER_ANALYST_JOB	Develops customer segments and analyzes their customer shopping and buying behavior to determine customer differentiation, trends, and opportunities in Customer Segmentation Module.
CUSTOMER_SEGMENT_ADMINISTRATOR_JOB	Responsible for analytical defaults and configuration, testing, and model diagnosis. This includes Filter, Sampling and Attribute Mining in the Customer Segmentation Module.
DATA_LAKE_HUE_ANALYST_JOB	Analyst role for accessing data lake.
DATA_LAKE_HUE_ADMIN_JOB	Administrator role for accessing data lake.
FORECAST_ANALYST_JOB	Reviews and approves forecasts on a day-to-day basis. An advanced forecast analyst may also be responsible for forecast parameter maintenance and demand modeling activities.
HOS_FORECAST_ANALYST_JOB	A user who understands the restaurant's business, has some business analytics training, and has been trained in the use of the Forecasting application.
HOS_FORECAST_CORPORATE_ANALYST_JOB	Responsible for ensuring the efficient running and profitability of multiple stores in a restaurant chain. This user works with the store manager to review and override the daily sales forecasts, as needed.
HOS_FORECAST_STORE_MANAGER_JOB	Responsible for overseeing stock levels and ordering supplies to meet a restaurant's profitability and quality goals. This user reviews, overrides, and approves the daily sales forecast of menu item groups. The store manager is typically responsible for one store.
MARKET_ANALYST_JOB	Reviews customer segments with business experts, suited (distinctly) for targeted promotion, category and assortment planning, targeted pricing, customer, and market basket analytics in Customer Segmentation module.
MARKET_BASKET_ANALYSIS_JOB	A user who understands the retailer's business, has some business analytics training, and is responsible for reviewing sales transaction affinity analysis.
MERCHANDISER_JOB	A Store Merchandiser (or In-Store Merchandiser) is an hourly employee who executes the placement and assembly of retail fixtures, adjustment of shelves and arrangement and placement of product on the shelves in accordance with CAD drawings and planograms.
ORCL_ADMIN_JOB	Oracle Cloud Administration role for a retailer using Innovation Workbench using APEX Workspace.
RETURN_LOGISTICS_JOB	A user who is familiar with the retailer's product categories and has been trained in the use of the AE application.
SIZE_PROFILE_ANALYST_JOB	Responsible for system parameter maintenance to support size profile calculations. May also be responsible for approval of size profiles. A user who understands size and profile estimations and is able to review and submit them for the retailer's business.
SIZE_PROFILE_OPT_JOB	A user who understands size and profile estimations and is able to review and submit them for the retailer's business.
SOCIAL_ANALYTICS_JOB	A user who understands the retailer's business, has some business analytics training, and has been trained in the use of the Social Analytics application.
ATTRIBUTE_EXTRACTION_JOB	A user who is familiar with the retailer's product categories and has been trained in the use of the Attribute Extraction.
ATTRIBUTE_BINNING_JOB	A user who understands the retailer's business, has some business analytics training, and has been trained in the use of the CDT application and attribute binning application.
MENU_RECOMMENDATION_JOB	A user who understands the restaurant's business, has some business analytics training, and has been trained in the use of the Menu Recommendation.
DATA_SCIENCE_ANALYST_JOB	Data Science Analyst role for a retailer using Innovation Workbench using APEX Workspace
DATA_SCIENCE_ADMINISTRATOR_JOB	Data Science Administration role for retailer using Innovation Workbench using APEX Workspace
DATA_SCIENCE_ORCL_ADMIN_JOB	Data Science Cloud Administration role for a retailer using Innovation Workbench using APEX Workspace
DATA_SCIENCE_OLDS_ADMIN_JOB	Role to enable the administration of python notebook service under Innovation Workbench
DATA_SCIENCE_OLDS_ANALYST_JOB	Role to enable the Python notebook for an analyst under Innovation Workbench.
POSLOGS_SERVICE_JOB	Point of Sales broadcast listener role to enable integration between AIF and Oracle XStore.
PLATFORM_SERVICES_ADMINISTRATOR_ABSTRACT	Platform Services role required for accessing services.
Assortment Space Optimization
CATEGORY_MANAGER_JOB	Product-assortment-centric user who is interested in viewing ASO results and in the translation of data between CMPO, Retail Analytics, and ASO.
SPACE_PLANNER_JOB	A Store Planner is a corporate employee with responsibility for designing the layout of floor plans, department sizes and locations, the layout of fixtures and aisles, applying health, safety and welfare guidelines, and managing and publishing floor-plan versions. This user is also responsible for the day-to-day micro-space optimization activities.
MERCHANDISING_ANALYST_JOB	Main business user responsible for day-to-day micro-space optimization activities
SPACE_ADMINISTRATOR_JOB	Responsible for general system setup and configuration tasks related to the business
FORECAST_MANAGER_JOB	Responsible for analytical configuration, testing, and model diagnosis.
Promotions and Markdowns Optimization
BUYER_JOB	Responsible for a department or departments and makes the budget decisions for pricing recommendations. Approves or rejects an OO run. Responsible for the translation of data between OO and Oracle Retail Price Management (RPM) and Oracle Retail Customer Engagement (CE).
PRICING_ANALYST_JOB	Main business user responsible for day-to-day pricing optimization activities (e.g., creating scenarios).
PRICING_MANAGER_JOB	Responsible for analytical configuration, testing, and model diagnosis. Oversees the work done by the pricing analyst.
PRICING_ADMINISTRATOR_JOB	Responsible for the general system setup and configuration tasks related to the business.
Offer Optimization
CHATBOT_QNA_VIEW_JOB	Conversational AI role to enable frequently asked question types of bot conversation.
CHATBOT_SERVICE_JOB	Conversational AI role to enable integration between AIF and Oracle Chatbot.
CHATBOT_VIEW_JOB	Conversational AI role to enable real time bot conversations.
TARGETED_OFFER_JOB	User who probably works in the marketing department and who is responsible for accepting or rejecting targeted offers that are sent out to customers.
Inventory Optimization
INVENTORY_ANALYST_JOB	Works closely with the buyer to ensure product distribution aligns to strategy. Main business user responsible for day-to-day inventory optimization activities (e.g., reviewing strategies, recommendations, and so on).

Note that in stage and pre-production environments, users are assigned roles that are appended with _PREPROD.

Oracle Retail AI Foundation Cloud Services/ORDS Integration

This section provides security details regarding ORDS/(APEX) integration with Oracle Retail AI Foundation Cloud Services. The following three security features are provided:

• Single Sign On (SSO). AIFF integration with ORDS supports SSO, using ORDS-provided authentication schemes called the HTTP Header Variable. User credential verification is performed by IDCS or OCI IAM, which passes the user's name to Oracle Application Express using a HTTP header variable such as IDCS REMOTE_USER. While setting up the scheme in ORDS, the logout URL is also configured.

• Schema used in the ORDS Workspace. Oracle Retail AI Foundation Cloud Services integration with ORDS includes defining a new schema called Retail Workspace Schema in the ORDS workspace. This is provided to the retailer, and in turn is associated with the AIF product schema. Any database objects shared with the Retail Workspace Schema have read-only privileges.

• Declarative REST API. Oracle Retail AI Foundation Cloud Services integration with ORDS also provides the retailer with a declarative way to create new service endpoints in the system. Access to such endpoints are enabled via oAuth2.0. This REST API request is authorized using the IDCS or OCI IAM client credential grants type, where the retailer requests an access code from IDCS or OCI IAM and passes the token in subsequent calls to access data.

Figure 1-1 Network Diagram

Description of ''Figure 1-1 Network Diagram''