Design a Project
You create and design a project and its components (integrations, connections, lookups, and JavaScript libraries) from a single location.
Topics:
- Control Who Can Edit, View, and Monitor in a Project
- Create or Import a Project
- Create, Import, or Copy an Integration into a Project
- Unlock an Integration in a Project
- Refresh Endpoints of an Integration in a Project
- Update Property Values of an Integration in a Project
- Create a Version of an Integration in a Project
- Add a Connection to a Project
- Edit a Connection in a Project
- Refresh Connection Metadata in a Project
- Delete a Connection in a Project
- Unlock a Connection in a Project
- Add a Lookup to a Project
- Edit a Lookup in a Project
- Clone a Lookup in a Project
- Delete a Lookup in a Project
- Import a JavaScript Library in a Project
- Delete a JavaScript Library in a Project
- Update a JavaScript Library in a Project
Control Who Can Edit, View, and Monitor in a Project
You can control the users and groups that edit, view, and monitor a project with role-based access control (RBAC). You select who can access a set of project resources while limiting (or hiding) those same resources from others (for example, providing an HCM group of users with access to some project resources while restricting an ERP group of users from accessing those same project resources).
Capabilities
RBAC-enabled projects provide the following capabilities:
- Support project isolation
Project isolation enables multiple users and groups to work in the same Oracle Integration instance, with access to only the projects to which they are assigned. This enables multiple groups (for example, ERP and HCM) to work on the same Oracle Integration instance and only edit, view, and monitor project resources assigned to their group.
- Support for setting restriction levels within a project
You can assign users and group to specific project permissions based on their needs. For example, you assign project editor permissions to some users and groups to create and edit projects and invoke integrations, while you assign project monitor permissions to other users and groups to only monitor integration instances at runtime.
Project permissions are similar to the Oracle Integration service roles (for example, ServiceDeveloper, ServiceMonitor, ServiceInvoker, and others) that the user with the ServiceAdministrator role first assigns to other users and groups from the Oracle Cloud Infrastructure Console in an Oracle Identity Cloud Service or identity domain environment. See Manage Access and Assign Roles in Provisioning and Administering Oracle Integration 3.
Project permissions are essentially a layer of permissions on top of service roles.
Once you assign these service roles to users and groups, the user with the ServiceAdministrator role or the project owner can assign these users and groups with project permissions inside a specific project. Project access is restricted based on a user's service role, plus their project permissions.
The following project permissions are available:Project Permission Description Owner
Enables you to perform all available actions on the project (as a project-level super user), including associating groups/users with each project permission. The project creator (owner) is automatically set as a project-level super user.
Modification of project permissions is restricted to the user with the ServiceAdministrator role (system super user) and the project owner (project-level super user).
Only a user with the ServiceAdministrator role or a ServiceDeveloper who is an owner/editor of a project can export the project to another Oracle Integration instance.
Editor
Enables you to edit certain metadata in a project, create projects, and create, remove, edit, and run project resources.
You can view runtime metrics and perform actions against runtime instances. You cannot modify the assigned project permissions.
Viewer
Enables you to view certain metadata in a project and discover and view project resources.
You cannot add, remove, edit, run, export, or import a project or project resources.
Monitor
Enables you to monitor runtime metrics in a project and perform actions (for example, abort, retry, and discard) against runtime instances.
You cannot access the Design and Deploy tabs of a project.
None.
A user without any project permissions (owner, editor, viewer, monitor) can see the project name when viewing the main Projects page. However, the user cannot do the following:- Access the project details page to retrieve any details or query details with a REST API.
- View instance monitoring details (for example, integration statistics, instances, errors, and more) outside the project under the Observability tab.
- Support RBAC for projects created prior to version 23.06
After version 23.06 patching, projects created in versions 23.04 and earlier automatically include the Share section inside the project. These earlier projects automatically inherit the Everyone project permission. This setting makes everyone with the correct service role an owner who can edit, view, and monitor project resources. You can then restrict access if necessary by assigning users and groups to each project permission. If you are happy with your pre-23.06 permissions, you can also leave things as they are. Assigning specific project permissions is not required.
- Enforce the rule that a user's assigned service roles
(ServiceDeveloper, ServiceMonitor, ServiceInvoker, and others) always
takes precedence over their assigned project permissions. For example:
- Assume a user with the ServiceMonitor service role is
assigned the editor project permission in the Can
edit field.
However, because this user is only assigned the ServiceMonitor service role, their permissions in the project are not elevated to allow them to create, update, or delete project resources; they can only monitor the project.
- Assume a user with the ServiceMonitor service role is
assigned the editor project permission in the Can
edit field.
- Support projects on a single Oracle Integration instance that are
both unrestricted and restricted for use by one or more groups.
When you create a project, import a project, or convert a package to a project, you can select the Anyone can edit, view, and monitor check box if you want to make a project unrestricted to all users with the correct service roles. See Create or Import a Project and Convert a Package to a Project.
- Allow users with the ServiceAdministrator role to perform all actions in a project, regardless of project permissions.
- Filter the ability to call REST APIs.
For example, a user in an ERP group who invokes the
/ic/api/integration/v1/monitoring/instances
API only returns flow instance data from integrations attached to their group. - Support having zero or more project owners.
If zero, then project owner defaults to the user with the ServiceAdministrator role. Only administrators have the unique privilege to update project-level access control. Project owners are essentially project-level super users.
RBAC-Enabled Projects FAQ
- Can you import a standalone integration into an RBAC-enabled
project?
Only a user with the ServiceAdministrator role or a user with the ServiceDeveloper role that has the owner or editor project permission can import a standalone integration into an RBAC-enabled project.
- Are project permissions moved from development to test to
production environments in a CICD pipeline?
Project permissions are not moved to test and production. The users and groups have different permissions in different environments. However, if a user sets up permissions in production, they are carried forward for future project updates. When a project is imported for the first time, it is owned by whoever imported it. That user must set the project permissions. If a project is re-imported, the permissions are left alone.
- Do standalone (non-project) integrations use RBAC?
Integrations created outside of a project do not support RBAC. Non-project or global resources are restricted by existing service roles.
- Are there limits on the number of users and groups you can
assign to a project?
You can assign a maximum of five users and/or groups (any combination) to each of the project roles.
- Do I need to use RBAC with my projects
No, using RBAC is optional. If you do not want to use it, you can ignore the Share section in the project.
- Can members of a project see the other members and their project
permissions?
Only a user with the ServiceAdministrator role or a ServiceDeveloper who is the project owner can see other assigned members. For these two conditions only, the Share section is editable.
- Do project permissions take precedence over service roles?
No. Service roles (ServiceDeveloper, ServiceMonitor, ServiceInvoker, and others) always takes precedent over the assigned project permissions. For example, if a user with the ServiceMonitor service role is assigned the editor project permission, they cannot access the Design and Deploy tabs of a project.
- Can restrictions be enforced at the REST API level? For example,
can lookup update/delete only be assigned to a specific user and restricted
from another?
No. If both users have editor permissions on one type of resource, they have permissions on all types of resources.
- If you have the editor permission in project A and want to invoke
a child integration (set as publicly available) in project B, but you only
have the monitor permission (or perhaps, no permission) in project B, can
you do so? Or do you need to update your permissions in project B to match
those in project A?
You can discover and invoke the child integration in project B without setting any additional project permissions.
- Any special permissions for project deployment? Can only a user
with the edit permission create a deployment?
To create a project deployment, you must have the ServiceAdministrator role or the ServiceDeveloper role plus the project owner/editor permission.
- Can a user create groups and assign permission to groups rather
than assigning users?
Yes, the entries can be Oracle Identity Cloud Service or identity domain users or groups.
- Can a user with the ServiceMonitor service role see all
integrations?
From monitoring pages under Observability, the user with the ServiceMonitor service role cannot see all the integrations. They cannot see integrations that are part of a project on which they do not have any permissions. The same applies to integration instances.
- Are project roles applied in a production system?
Project roles are still applicable. For example, the HCM_monitor group can monitor HCM projects, but not the finance project.
- What can a user with no project permissions do?
They can see the existence of the project on the main Projects page, but cannot perform any actions and are not allowed to access the project details page. They also cannot see monitoring resources (for example, integration statistics, instances, errors, and others) for the project under the Observability tab.
Select Who Can Edit, View, and Monitor a Project
The user with the ServiceAdministrator role or the project owner can select the users and groups who can view, edit, and monitor the page.
- In the navigation pane, click Projects.
- Click the project name or click
.
- Go to the Share section.
- Click
to show the Share dialog.
- Assign users and groups to the project permissions, and click
Share.
Note:
You must have already created users and groups to which you assigned those users before they are visible for selection in this dialog. See Manage Access and Assign Roles in Provisioning and Administering Oracle Integration 3.Field Description Owners
Begin typing to search for users and groups to own the project. By default, the user who created the project is an owner. The user with the ServiceAdministrator service role is also automatically an owner.
The owner can perform all available actions, including associating users and groups with each of the project permissions.
Can edit
Begin typing to search for users and groups to which to assign the editor permission.
If you select a user or group that includes users that do not have the ServiceDeveloper role, those users are unable to edit the project.
Can view
Begin typing to search for users and groups to which to assign the viewer permission.
Can monitor
Begin typing to search for users and groups to which to assign the monitor permission.
Best Practices
- Provide project access only to users that need it.
- Give users the minimal permissions necessary to perform their responsibilities. For example, if a user only needs to monitor integrations, don't give them the permission to edit integrations.
- Give projects nonsensitive names. For example, don't specify names such as employeeSalaries, employeeRatings, and so on. Even if users don't have access to projects, they can still see the project names listed on the Projects page.
RBAC-Enabled Project Use Case
This use cases provides a high level example of creating an RBAC-enabled project. It demonstrates what users can and cannot do based on their assigned project permissions.
- Neeharika, the user with the ServiceAdministrator role, performs
the following tasks:
- Creates the following user and service role assignments in
the Oracle Cloud
Infrastructure
Console:
- Vijaya: ServiceDeveloper
- Bipin: ServiceDeveloper
- Sumit: ServiceDeveloper
- Goes to the Projects page, and clicks Add.
- Creates two new projects:
- HCM Project12
- FinancialServiceLocalInvoke
- Opens HCM Project12.
- Goes to the Share section.
- Clicks Edit
to show the Share dialog.
- Assigns the following users to each project permission. By
default, Neeharika is the owner because she created the HCM
Project12 project.
This configuration creates the following similarities between the service roles and the project permissions:
User Service Role Project Permission Vijaya ServiceDeveloper Editor Bipin ServiceDeveloper Viewer Sumit ServiceDeveloper Monitor - Does not make any project permission updates in the
Share section of the
FinancialServiceLocalInvoke project.
Because Neeharika created this project, she is listed as the owner. The Can edit (for the editor permission), Can view (for the viewer permission), and Can monitor (for the monitor permission) fields remain empty.
With project permission assignments complete, Vijaya (editor permission), Bipin (viewer permission), and Sumit (monitor permission) log in and see their capabilities and restrictions.
- Creates the following user and service role assignments in
the Oracle Cloud
Infrastructure
Console:
- What the Vijaya (ServiceDeveloper with the editor project
permission) can do:
- Opens the HCM Project12 project and
goes to the Share section. Because Vijaya has
editor permissions, she can edit, view, and monitor resources in the
project.
- Clicks Actions
in the Integrations section and notes that all edit actions are listed and can be performed.
- Moves around the project and successfully performs assorted
editor tasks without any restrictions, such as the following:
- Adds new project keywords in the Details section.
- Imports a schedule integration and updates the schedule.
- Deletes a library.
- Exits the HCM Project12 project.
- Attempts to open the
FinancialServiceLocalInvoke project. This is
the project described in Step h to which no project permissions were
assigned.
Because Vijaya is not assigned any permissions on this project, the following error is displayed:
User Vijaya does not have sufficient privilege to perform this action.
- Opens the HCM Project12 project and
goes to the Share section. Because Vijaya has
editor permissions, she can edit, view, and monitor resources in the
project.
- What Bipin (ServiceDeveloper with the viewer project permission)
can do:
- Opens the HCM Project12 project and
goes to the Share section. Because Bipin has
viewer permissions, he can only view resources in the project.
- Clicks Actions
in the Integrations section and notes that no edit actions are listed; only the View and Schedule (for viewing the schedule) actions can be performed.
- Clicks the Deploy tab.
- Clicks Actions
and notes that no edit actions are listed; only the View action can be performed.
- Clicks the Observe tab.
- Clicks Actions
and notes that no edit actions such as abort or retry are listed; only the Schedule (to view a schedule) and View child instances actions can be performed.
- Opens the HCM Project12 project and
goes to the Share section. Because Bipin has
viewer permissions, he can only view resources in the project.
- What Sumit (ServiceDeveloper with the monitor project permission)
can do:
- Opens the HCM Project12 project.
Because Sumit has monitor permissions in the project, only the
Observe tab is accessible. The
Design and Deploy tabs
are both disabled.
- Clicks Observe.
- Clicks View details
to view the activity stream.
- Click Actions
and notes that Retry, Abort, Schedule, and View child instances can all be performed.
- Clicks the Future runs and
Audit tabs to view future scheduled runs and
audit details, respectively.
- In the navigation pane, clicks Observability, then Dashboards for a global view of aggregated data for all integrations in the instance (whether or not they are in a project). All integrations are visible to Sumit regardless of his project permissions.
- In the navigation pane, clicks the
Integrations tab to view all integration
instances except for instances in projects in which Sumit does
not have project permissions.
For example, if Sumit clicks Filter
, selects a project on which he does not have any permissions, and clicks Apply, the following error is displayed:
User Sumit does not have sufficient privilege to perform this action.
- Clicks Actions
to view the instance statistics for an integration instance that is part of the HCM Project12 project.
- Selects the Edit schedule option, but
receives the following
error:
User Sumit does not have sufficient privilege to perform this action.
The restriction occurs because Sumit's monitor permissions do not support this task.
- In the navigation pane, clicks the Instances tab to view all tracking instances except for instances in projects in which Sumit does not have project permissions.
- Performs monitoring tasks successfully:
- Views the activity stream.
- Aborts and retries instances.
- In the navigation pane, clicks the Errors tab to view all instances in error except for instances in projects in which Sumit does not have project permissions.
- Performs monitoring tasks successfully:
- Views the activity stream.
- Aborts and retries instances.
- Opens the HCM Project12 project.
Because Sumit has monitor permissions in the project, only the
Observe tab is accessible. The
Design and Deploy tabs
are both disabled.
Create or Import a Project
You can create a project in which to design, manage, and monitor integrations. You can also import user-developed, accelerator, or recipe projects into an instance.
- Create or Import a Project
- Understand an Imported Oracle Accelerator Project
- Add a Newer (Extended) Version of an Accelerator Project
- Understand an Imported Recipe Project
See Get Started with Integration Recipes and Accelerators in Getting Started with Oracle Integration 3.
Create or Import a Project
- In the navigation pane, click Projects.
- Click Add.
- Select an option:
- Create a new project.
- Import an existing project.
- To create a new project, perform the following steps.
- Click Create.
- Enter the following information.
Field Description Name
Provide a meaningful name so that others can understand the project. You can include English alphabetic characters, numbers, underscores, and dashes in the identifier.
Note: You cannot create a project name containing
-BA-
or_BA_
. These conventions are reserved for accelerator projects.Identifier
Accept the default identifier value. The identifier is the same as the project name you provided, but in upper case.
Keywords Enter keywords (tags) to identify the project. You can search for projects on the Projects page using keywords. Keywords are useful for filtering and discovery. Description
Provide a meaningful description so that others can understand the project.
Anyone can edit, view, and monitor
- Select this option to allow
anyone to edit, view, and monitor resources in the
project.
You can always restrict access at a later time.
- Don't select this option if you want to restrict access to editing, viewing, and monitoring resources in this project. After project creation, you can select the specific groups and users to which to provide access. See Control Who Can Edit, View, and Monitor in a Project.
- Select this option to allow
anyone to edit, view, and monitor resources in the
project.
- Click Create.
Your new project page is displayed. You can now add integrations, connections, lookups, and JavaScript libraries to the project.
- To import an existing project (
.CAR
file), perform the following steps. This enables you to import a project with all assets and metadata from one system to another. You can import user-developed, accelerator, or recipe projects.- Click Import.
- Click the field to browse for a project or drag and drop a project into the field.
- With the Anyone can edit, view, and
monitor check box, select the level of access you want
to provide to other users:
- Select this option to allow anyone to edit, view,
and monitor resources in the project.
You can always restrict access at a later time.
- Don't select this option if you want to restrict access to editing, viewing, and monitoring resources in this project. After import, you can select the specific groups and users to which to provide access. See Control Who Can Edit, View, and Monitor in a Project.
- Select this option to allow anyone to edit, view,
and monitor resources in the project.
- Click Import.
The project connections contain information that is specific to the processing environment. Connections in the imported project omit this potentially sensitive data. You must reconfigure connections before they can operate properly.
Understand an Imported Oracle Accelerator Project
If you import an Oracle accelerator project into your project, the project includes the labels Accelerator and Oracle on the Projects page. The Type column also includes the Accelerator label.
- You cannot edit the details that were specified when the project was created, such as name, project identifier, description, and keyword selections. These details are in read-only mode.
- The Edit, Clone,
and Delete tasks are not visible under the
Actions
menu on the Deploy tab. The only task visible under this menu is View.
- You can extend (customize) an integration in the accelerator
project by selecting Actions
, then Extend. See Extend an Integration in an Accelerator Project.
Note the following restrictions for individual assets in accelerator projects
Integrations | Connections | Lookups | JavaScript Libraries | Deployments | Certificates |
---|---|---|---|---|---|
Allowed:
Restricted:
Allowed in extended accelerator:
Restricted in extended accelerator:
|
Allowed:
Restricted:
|
Allowed:
Restricted:
|
Allowed:
Restricted:
|
Allowed:
Restricted:
|
No restrictions. |
** Export as an accelerator or extended accelerator only.
Add a Newer (Extended) Version of an Accelerator Project
Assume a newer version of an accelerator project becomes available for you to import.
For this example, assume the first version of the accelerator project
included integrations Oracle ERP 1 and Oracle ERP 2, each with versions of 1.0.0.
The two integrations and their versions are included in a project deployment named
1.0.0 that you previously imported into your instance.
A newer version of the accelerator project then becomes available. This
version now includes two versions of the two integrations: Oracle ERP 1 versions
1.1.0 and 1.0.0 and Oracle ERP 2 versions 1.1.0 and 1.0.0.
All four integrations and versions are included in a project deployment
named 1.1.0.
- In the navigation pane, click Projects.
- Click Add.
- Click Import and upload the latest
accelerator project.
The following message is displayed:
Project has been successfully imported.
- Click the project name or click
.
Note that the latest accelerator project includes Oracle ERP 1 versions 1.1.0 and 1.0.0 and Oracle ERP 2 versions 1.1.0 and 1.0.0.
Understand an Imported Recipe Project
When you import a recipe project, it is displayed as Developed in the Type column on the Projects page.
Create, Import, or Copy an Integration into a Project
You can create, import, or copy integrations into a project. The integration to copy can be either in a different project (as long as it is marked as globally available) or outside of any project.
Unlock an Integration in a Project
You can unlock and recover unsaved changes in an integration in a project. An integration becomes locked if your browser fails during design-time.
- In the navigation pane, click Projects.
- Click the project name or click
.
- In the Integrations section, hover over the specific integration to unlock.
- Click Actions
and select Unlock.
- Follow the steps to unlock and recover unsaved changes in an integration. See Recover Unsaved Integration Changes.
Refresh Endpoints of an Integration in a Project
You can refresh the endpoints of an integration in a project that includes endpoints that support refreshing artifacts.
- In the navigation pane, click Projects.
- Click the project name or click
.
- In the Integrations section, hover over the specific integration to refresh.
- Click Actions
and select Refresh Endpoints.
Update Property Values of an Integration in a Project
You can update property values of an integration in a project. At runtime, these integration properties take effect and override the values you configured at design time.
Integration Pattern | When Activated | When Deactivated |
---|---|---|
Application integration | Can view, but not edit. | Can edit. |
Schedule integration | Can edit. | Can view, but not edit. |
- In the navigation pane, click Projects.
- Click the project name or click
.
- In the Integrations section, hover over the specific integration to update.
- Click Actions
and select Update property values.
Create a Version of an Integration in a Project
You can create a new version of an integration in a project.
Note:
Integration versions follow a formatting convention ofxx.yy.zzzz
, where xx
is the major
version and yy.zzzz
is the minor version. If you clone an
integration (for example, version 1.00.0000
) and change the minor
version of the cloned integration to 1.10.0000
, version
1.00.0000
is deactivated when you activate version
1.10.0000
. To keep both integrations active, change the major
version of the cloned integration to 2.00.0000
. This enables
integration versions 1.00.0000
and 2.00.0000
to be
active at the same time.
Add a Connection to a Project
You can add a connection to use in an integration in a project. Only connections within the project can be used as a trigger or as invokes in an integration.
Refresh Connection Metadata in a Project
You can manually refresh the currently-cached metadata available to adapter connections in a project that have implemented metadata caching.
Delete a Connection in a Project
You can delete an adapter connection in a project. A connection currently used in an active integration cannot be deleted. Deleting the connection would invalidate the integration. Active integrations would stop running. Remove the connection from the integration and then delete the connection.
- In the navigation pane, click Projects.
- Click the project name or click
.
- In the Connections section, find the specific adapter connection to delete.
- Click Actions
and select Delete.
- Confirm your selection when prompted.
Unlock a Connection in a Project
You can unlock a connection in a project. A connection becomes locked when the browser fails in edit mode, which prevents it from being edited.
- In the navigation pane, click Projects.
- Click the project name or click
.
- In the Connections section, find the specific adapter connection to unlock.
- Click Actions
and select Unlock.
Add a Lookup to a Project
You can create new or import existing lookups in a project. Only the lookups within the project can be used by expressions and in the mapper.
Edit a Lookup in a Project
You can edit a lookup in a project.
- In the navigation pane, click Projects.
- Click the project name or click
.
- In the Lookups section, find the lookup to edit.
- Click the lookup name or click Actions
and select Edit.
Clone a Lookup in a Project
You can clone a lookup in a project and customize its content to use in other integrations. Cloning provides a quick way to create a new lookup with similar information.
- In the navigation pane, click Projects.
- Click the project name or click
.
- In the Lookups section, find the lookup to clone.
- Click Actions
and select Clone.
- Enter a name, optional keyword, and optional description.
Delete a Lookup in a Project
You can delete a lookup in a project. A lookup cannot be deleted if in use by an integration. Deleting the lookup would invalidate the integration and cause an active integration to stop running. You must first remove the lookup from the integration and then delete the lookup.
- In the navigation pane, click Projects.
- Click the project name or click
.
- In the Lookups section, find the lookup to delete.
- Click Actions
and select Delete.
Import a JavaScript Library in a Project
You can import a JavaScript library file in .ZIP
,
.JAR
, or .JS
format into a project. Only
those libraries within the project can be used by JavaScript callouts.
Delete a JavaScript Library in a Project
You can delete a JavaScript library in a project. If any of the library’s functions are used by an integration, you are prevented from deleting the library. You must remove the functions from the integration before you can delete the library.
- In the navigation pane, click Projects.
- Click the project name or click
.
- In the Libraries section, find the library to delete.
- Click Actions
and select Delete.