Overview of Oracle Payroll Connect for ADP Global Payroll

Integrate Oracle HCM Cloud with ADP Global Payroll through Oracle Payroll Connect for ADP Global Payroll. With this integration, you can convey new-hire transactions in Oracle HCM Cloud to ADP Global Payroll in real-time.

You can also send updates and maintenance to this transaction to ADP in batch mode using HCM Extracts.

You can configure and maintain the integration to ADP Global Payroll through:

A simplified configuration page to define the data elements that you want to send to ADP Global Payroll in real-time and batch mode
A status page to review the status of various transactions sent to ADP Global Payroll in both real-time and batch mode
An embedded page from ADP Global Payroll to manage payroll information from within Oracle HCM Cloud

Here's an overview of the new-hire flow with the Oracle Payroll Connect for ADP Global Payroll:

Hire Employee: Hire an employee in Oracle HCM Cloud through the user interface, loader, or API. Use ADP specific validations to enter the employee data.
Publish Data to ADP: Wait for the application to capture necessary data, then call real-time API to ADP for establishing employee records.
Enter Payroll Data: The new-hire can enter payroll data into ADP through self-service. The Payroll Administrator can add more info to the payroll data in ADP.
Run Payroll Interface for ADP Global Payroll v2: Send additional changes from Oracle HCM Cloud to ADP using HCM Extracts.

This image summarizes the implementation of new hire flow with Oracle Payroll Connect for ADP Global Payroll.

You would need various configurations for the transaction flows in both the applications:

Set Profile Options
Configure Federation SSO
Identify Payrolls Processed by ADP
Define and Assign Payroll Security Profile
Activate Sandbox
Configure Data Validation Rules
Configure Payload Rules
Configure Payroll Integrations
Schedule ESS Job

This image summarizes the configuration requirements in both ADP Global Payroll and Oracle HCM Cloud.

Before You Start

Before you integrate Oracle HCM Cloud with ADP Global Payroll, perform these tasks:

Set Profile Options: Log in to Oracle HCM Cloud as an Integration Specialist and set profile options.

Profile Option Code	Profile Option Name	Profile Level	Value
ORA_PAY_ENABLE_EXT_PAY_INTEGRATION	Enable Integration with ADP Systems for Payroll Processing	Site	Yes

Authenticate Real-Time Integration: You must authenticate this real-time integration using Single Sign-On (SSO) and JSON Web Token (JWT).
- Use SSO for authentication: Payroll Administrator can navigate to ADP Global Payroll embedded interface from within Oracle HCM Cloud using this SSO setup, whereby session credentials are used to establish authentication in ADP Global Payroll. Configure federation SSO between Oracle HCM Cloud and Customer Identity Provider (IdP), and also between the Customer IdP and ADP's Global Payroll applications.
  
  Here are few points that you must consider for this implementation:
  - You must have an IdP that's trusted by both Oracle HCM Cloud and ADP Global Payroll.
  - Establish SSO between Oracle HCM Cloud (Service Provider 1) and the IdP using Security Console.
  - Establish SSO between ADP (Service Provider 2) and the IdP using the ADP SR process.
  - You must be present and e-mail must be synced in Customer IdP, Oracle HCM Cloud, and ADP.
  Once you have completed the SSO setup, you must review and complete the Single Log-Out (SLO) setup too. This approach ensures that once you log out from Oracle HCM Cloud, the user session terminates in ADP Global Payroll too.
  
  Here's how you review the SLO setup:
  1. Enter IdP Global SLO URL in Security Console. For example, Log-out URL for ADFS IdP:
```
https://<external IDP>/adfs/ls/?wa=wsignout1.0
```
  2. ADP must provide PING SLO URL for ADP-IdP trust setup. For example, SLO URL:
```
https://portal00x.globalview.adp.com/federate2/sp/SLO.saml2
```
- Authenticate using JWT: Oracle Payroll Connect integration uses ADP REST APIs to send new-hire data in real-time, and JWT token authenticates these APIs.
  
  Here's how you can set up the JWT authentication:
  1. Export orakey_sign public key from Oracle HCM Cloud for ADP Global Payroll integration.
    1. Navigate to Security Console and API Authentication tab.
    2. Click the Oracle Public Certificate to download the certificate.
  2. Once you receive the key, open a service request with ADP for importing the key to the corresponding ADP instance. For example, public key from Oracle HCM Cloud production instance imported into the ADP Global Payroll production instance. Here's a sample JWT generated for ADP authentication flow:
```
JWT HEADER
{
  "alg": "RS256",
  "typ": "JWT",
  "x5t": "r2oR5F01a-a5cwAdgUAt6JfE4k0"
}
JWT PAYLOAD
{
  "exp": 155364350,
  "tenant": "123456",
  "iss": "www.oracle.com",
  "aud": "globalview-prod",
  "jti": "1234-12345-123456-12345-1234",
  "iat": 1555363750
}
```
Identify Payrolls Processed by ADP: Identify payroll definitions that are processed by ADP Global Payroll, and for which you want to enable this integration.
Review Data Security: Payroll Interface Coordinators must have the required data roles to review the data associated with specific payrolls that interfaces with ADP Global Payroll. You can create data roles with appropriate payroll security profiles from the Manage Data Roles and Security Profiles page.

Note: You can't use View All payroll security profile while creating data roles using payroll security profile
Assign Data Roles to Payroll Administrators: Assign the generated data roles from Step 4 to the Payroll Administrators who are managing the identified payrolls. This step provides these administrators access to the navigation to the ADP Global Payroll interface embedded in Oracle HCM Cloud.