Oracle Cloud Infrastructure Documentation

Setting Up Identity Access for Fusion Connections

Create and activate a confidential application so Cost Advisor for AI can connect to Fusion HCM or Fusion EPM.

Important

Pre-General Availability: 2026-10-27

The following legal notice applies to Oracle pre-GA releases. For copyright and other applicable notices, see Oracle Legal Notices.

Pre-General Availability Draft Documentation Notice

This documentation is in pre-General Availability status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

This documentation is not a commitment by Oracle to deliver any material, code, functionality or services. This documentation, and Oracle Pre-GA programs and services are subject to change at any time without notice and, accordingly, should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality for Oracle’s Pre-GA programs and services remains at the sole discretion of Oracle. All release dates or other predictions of future events are subject to change. The future availability of any future Oracle program or service should not be relied on in entering into any license or service agreement with Oracle.

Complete Fusion HCM preparation or Fusion EPM preparation for the connection you're adding. Have an administrator of the associated identity domain complete this procedure. EPM secondary-audience configuration also requires the EPM administrator.

Use the public signing certificate supplied in the corresponding Cost Advisor for AI setup flow and follow the certificate registration instructions for that connection. The certificate lets the identity domain verify signed requests. Cost Advisor for AI manages the signing key. You don't supply its private key, the integration user's password, or an OAuth client secret in the Console.

Note

For EPM, the OAuth token must represent the dedicated integration user. A client-credentials-only token isn't a substitute for this flow. See How JWT Authentication Works for EPM and the user-context requirement in Authentication with OAuth 2. That page's device-code example is a different setup flow. Don't use it in place of the JWT assertion configuration described here.
  1. In the identity access step of the person mapping or destination setup, download the Public signing certificate.

    Use the certificate for the connection you're setting up. Verify its fingerprint through the agreed independent verification channel and confirm the certificate registration procedure supported by the identity domain.

    For EPM, open Set up the EPM identity domain and download cost-advisor-for-ai-epm-public-signing-certificate.pem. Under Create a confidential application, select Copy beside the Certificate alias, oracle-cost-advisor-epm-pub-cert. Use this exact alias when importing the certificate.

    For HCM, open Set up the HCM identity domain and download cost-advisor-for-ai-hcm-public-signing-certificate.pem. Under Create a confidential application, copy the Certificate alias, oracle-cost-advisor-hcm-pub-cert, exactly. HCM and EPM have separate certificate registration requirements.

  2. In the OCI Console, open Identity & Security, select Domains, and open the identity domain associated with the target environment.
    Record the domain's HTTPS URL for the Identity domain URL connection field. For information about opening the IAM interface for EPM, see Accessing the IAM Interface.
  3. Select Integrated applications, Add application, and then Confidential Application. Launch the workflow and enter a name and description that identify the connection and target environment.
    For example, use Cost Advisor EPM Upload JWT Integration Test for a test environment. Keep the application inactive until JWT authentication, certificate trust, and the authorized resource and scope are set up.
  4. Set up the application as an OAuth client with JWT Assertion as an allowed grant and Trusted as the client type.
    If the application is created before its OAuth settings are set up, open OAuth configuration, select Edit OAuth configuration, and then select Configure this application as a client now.
  5. Import the downloaded public certificate into the confidential application's client configuration and enter the certificate alias specified for that connection exactly.
  6. Under Token Issuance Policy, set Authorized resources to Specific, and add the resource and scope for the intended environment.
    • Fusion HCM: Select the Fusion Applications resource for the target HCM environment and add its approved scope.
    • Fusion EPM: Select Add resources, select the target EPM Cloud service, and then select Add scope. Select the scope displayed for that service. The scope has the form urn:opc:serviceInstanceID=<SERVICE_INSTANCE_ID>urn:opc:resource:consumer::all.

    Copy the complete scope from the selected resource. Don't construct it from the example or use a scope from a different environment. Save the application configuration.

  7. For an EPM connection, have the identity domain administrator verify that the signing certificate is also trusted for the user assertion.

    Have the administrator check the domain's certificate trust configuration. If the approved configuration procedure hasn't already registered the certificate for user assertions, register the same public certificate under Security, Trusted partner certificates, using the format required by the identity domain. See Importing a Trusted Partner Certificate.

    Keep a record of the certificate alias, fingerprint, import date, and expiration date with the EPM connection's setup information. Use this record to identify the certificate and review its validity when maintaining the connection.

  8. For an EPM connection, set up the secondary audience for the same EPM Cloud service before activating the confidential application.
    1. In the EPM service's identity domain, select Oracle Cloud Services and open the service selected in the confidential application's authorized resources.
    2. Select OAuth configuration and Edit OAuth configuration.
    3. Enable Add secondary audience and add the HTTPS base URL of that EPM environment, without /epmcloud or any other path, query string, or fragment.
    4. Save and submit the changes.
    For the EPM procedure, see Configuring the Secondary Audience. This EPM-specific step isn't part of HCM extract preparation.
  9. Return to the confidential application. Review the settings and certificate validity, select Actions, and then select Activate. Confirm that the application is active.
    For EPM, have the identity domain and EPM administrators verify the JWT assertion grant type, Trusted client type, public certificate and expiration date, authorized EPM service and scope, and EPM secondary audience before activation. Cost Advisor for AI retains control of its private signing key.
  10. Record the identity domain URL, OAuth client ID, and complete OAuth scope for the next step in Cost Advisor for AI.

    The client ID identifies the confidential application. It isn't the certificate alias or a client secret. Record the activation date with the connection setup information.

    For EPM, retain the approved EPM environment URL and exact integration username with these values. Enter them in the Cost Advisor destination setup.

The confidential application is active and the connection details are ready. For EPM, the target service's secondary audience is also set up.

Return to Cost Advisor for AI, select the identity access completion checkbox, and select Next. Continue with the HCM person mapping or the EPM destination.

For EPM integration validation, have the administrators verify that both client and user assertions are accepted, the access token represents the dedicated integration user, and that user can perform the required file operations. Confirm that authorization is limited to the selected EPM service.

How JWT Authentication Works for EPM

JWT stands for JSON Web Token. In this EPM connection, a JWT assertion is a short-lived, digitally signed statement used to establish identity without sending the integration user's password.

Cost Advisor for AI uses two assertions when requesting an OAuth access token:

  • A client assertion identifies the confidential application registered for Cost Advisor for AI in the identity domain.
  • A user assertion identifies the dedicated EPM integration user that Cost Advisor for AI acts on behalf of.

The identity domain verifies the assertions, including their signatures, using the imported public signing certificate. If the request is valid and authorized, the identity domain issues an OAuth access token. Cost Advisor for AI uses that access token to call EPM APIs. The integration user's EPM roles and permissions still determine which operations are allowed.

You set up the confidential application, certificate trust, and required access. Cost Advisor for AI creates and signs the assertions and obtains the access token. You don't manually create or paste JWTs into the Console.

For more information, see Client Assertion.