1 About the Oracle E-Business Suite HRMS Connectors
The Oracle E-Business Suite HRMS connectors let you create and onboard Oracle E-Business Suite HRMS applications in Oracle Identity Governance.
This chapter contains the following sections:
Note:
In this guide, Oracle E-Business Suite HRMS connectors refers to both the connectors for Oracle EBS Employee Reconciliation (for an Authoritative application) and Oracle EBS HRMS connector (for a Target application).
1.1 Introduction to the Oracle E-Business Suite HRMS Connectors
You can manage HRMS records by using the Oracle E-Business Suite HRMS connectors.
Oracle Identity Governance is a centralized identity management solution that provides self service, compliance, provisioning and password management services for applications residing on-premises or on the Cloud. Oracle Identity Governance connectors are used to integrate Oracle identity Governance with the external identity-aware applications.
Note:
In this guide, the connector that is deployed using the Applications option on the Manage tab of Identity Self Service is referred to as an AOB application. The connector that is deployed using the Manage Connector option in Oracle Identity System Administration is referred to as a CI-based connector (Connector Installer-based connector).Application onboarding is the process of registering or associating an application with Oracle Identity Governance and making that application available for provisioning and reconciliation of user information.
You can use the Oracle E-Business Suite HRMS connectors to create and onboard Target applications and Authoritative applications in Oracle Identity Governance. The connector bundle provides two separate versions (XML files) of the connector for this purpose. The following sections provide information about these connectors:
1.1.1 About the Oracle EBS Employee Reconciliation Connector
You use the Oracle EBS Employee Reconciliation Connector to create and onboard Authoritative applications in Oracle Identity Governance. In other words, the target system is the authoritative source of identity data for Oracle Identity Governance.
This identity data is used to create or update OIG Users.
Note:
In this guide, Oracle EBS Employee Reconciliation Connector is referred to as the EBS ER connector.The EBS ER connector can also be configured for use in scenarios in which EBS ER connector is one of the trusted sources in the operating environment of the organization.
You use the EBS ER connector to reconcile all the person types that are supported by the Oracle E-Business Suite HRMS store. The PER_ALL_PEOPLE_F table represents the Oracle E-Business Suite HRMS store. You can also use this connector to reconcile new, modified, terminated, and deleted person type records.
The following are the person types (HRMS or Person record) supported by the Oracle E-Business Suite HR store:
-
Employee
-
Contingent workers/ Part-time workers
-
Contractors
1.1.2 About the Oracle EBS HRMS Connector
You use the Oracle EBS HRMS connector to provision and reconcile HRMS person records (PER_ALL_PEOPLE_F records) to and from Oracle E-Business Suite HRMS. In other words, you use this connector to create PER_ALL_PEOPLE_F records for OIG Users and grant assignments and addresses to these accounts.
You can also reconcile newly created and modified PER_ALL_PEOPLE_F records from the target system.
Note:
In this guide, the Oracle EBS HRMS Connector for an authoritative application is referred to as the EBS HRMS connector.The object class used for HR management is __PERSON__. When you provision an account, an HRMS person record is created and stored in the PER_ALL_PEOPLE_F table. It can be of the following types:
-
Employee
-
Contingent workers/ Part-time workers
-
Contractors
1.2 Certified Components
These are the software components and their versions required for installing and using the connector.
Table 1-1 Certified Components
| Component | Requirement for AOB Application | Requirement for CI-Based Connector |
|---|---|---|
|
Oracle Identity Governance or Oracle Identity Manager |
You can use one of the following releases:
|
You can use one of the following releases:
|
|
Target system |
The target system can be any one of the following:
These applications may run on Oracle Database 10g, 11g, 12c, or 19c as either single database or Oracle RAC implementation. Note:
|
The target system can be any one of the following:
These applications may run on Oracle Database 10g, 11g, 12c, or 19c as either single database or Oracle RAC implementation. Note:
|
|
Connector server |
11.1.2.1.0 and later |
11.1.2.1.0 and later |
|
Connector Server JDK |
JDK 1.6 or later |
JDK 1.6 or later |
1.3 Certified Languages
These are the languages that the connector supports.
-
Arabic
-
Chinese (Simplified)
-
Chinese (Traditional)
-
Czech
-
Danish
-
Dutch
-
English
-
Finnish
-
French
-
French (Canadian)
-
German
-
Greek
-
Hebrew
-
Hungarian
-
Italian
-
Japanese
-
Korean
-
Norwegian
-
Polish
-
Portuguese
-
Portuguese (Brazilian)
-
Romanian
-
Russian
-
Slovak
-
Spanish
-
Swedish
-
Thai
-
Turkish
1.4 Usage Recommendation
These are the recommendations for the EBS HRMS connector versions that you can deploy and use depending on the Oracle Identity Governance or Oracle Identity Manager version that you are using.
- If you are using Oracle Identity Governance 12c (12.2.1.3.0) or later, then use the latest 12.2.1.x version of this connector. Deploy the connector using the Applications option on the Manage tab of Identity Self Service.
-
If you are using Oracle Identity Manager 11g Release 2 PS3 (11.1.2.3.0) and any later BP in this release track, then you must use the latest 11.1.1.x version of this connector. If you want to use the 12.2.1.x version of this connector with Oracle Identity Manager release 11.1.2.3.0 and any later BP, then you can install and use the it only in the CI-based mode. If you want to use the AOB application, then you must upgrade to Oracle Identity Governance release 12.2.1.3.0.
Note:
If you are using the latest 12.2.1.x version of the EBS HRMS connector in the CI-based mode, then see Oracle Identity Manager Connector Guide for Oracle E-Business HRMS, Release 11.1.1 for complete details on connector deployment, usage, and customization. - If you are using an Oracle Identity Manager release that is earlier than Oracle Identity Manager 11g Release 2 PS3 (11.1.2.3.0), then you must use the 9.1.x version of this connector.
1.5 Supported Connector Operations
These are the list of operations that the connector supports for your target system.
Table 1-2 Supported Connector Operations
| Operation | Supported? |
|---|---|
|
User Management |
|
|
Create Person |
Yes |
|
Update Person |
Yes |
|
Delete Person |
Yes |
|
Enable Person |
No |
|
Disable Person |
No |
|
Entitlement Grant Management |
|
|
Add Address |
Yes |
|
Update Address |
Yes |
|
Delete Address |
Yes |
|
Add Assignment |
Yes |
|
Update Assignment |
Yes |
|
Delete Assignment |
Yes |
1.6 Connector Architecture
The Oracle E-Business Suite HRMS Connectors are implemented using the Integrated Common Framework (ICF) component.
The ICF is a component that provides basic reconciliation and provisioning operations that are common to all Oracle Identity Governance connectors. In addition, ICF provides common features that developers would otherwise need to implement on their own, such as connection pooling, buffering, time outs, and filtering. The ICF is shipped along with Oracle Identity Governance. Therefore, you need not configure or modify the ICF.
During connector operations, Oracle Identity Governance interacts with a layer called Glue. Glue is specific for each of the applications and uses ICF API to invoke operations on the Identity Connector (IC). The connector then calls the target system APIs to perform operations on the resource.
As discussed in one of the earlier sections, there are two versions of the Oracle E-Business HRMS connector as follows:
-
EBS HRMS Connector
The basic function of this connector is to enable management of employee data on Oracle E-Business Suite HRMS through Oracle Identity Governance. You can create and manage employee records for OIG Users through provisioning. In addition, data related to newly created and modified employee records can be reconciled (using scheduled tasks) and linked with existing OIG Users and provisioned resources.
Figure 1-1 shows the architecture of the EBS HRMS connector.
Figure 1-1 Connector Architecture of the EBS HRMS Connector
Description of "Figure 1-1 Connector Architecture of the EBS HRMS Connector" -
EBS ER Connector
The basic function of this connector is to perform identity (trusted source) reconciliation with the target system. In this form of reconciliation, identity data is fetched to Oracle Identity Governance and this data is used to create or update OIG Users.
Figure 1-1 shows the architecture of the EBS ER connector.
Figure 1-2 Connector Architecture of the EBS ER Connector
Description of "Figure 1-2 Connector Architecture of the EBS ER Connector"
1.7 About Reconciliation Queries and Provisioning Procedures
Reconciliation queries and provisioning procedures help in performing reconciliation and provisioning operations more efficiently.
The following sections provide information about reconciliation queries and provisioning procedures:
1.7.1 About Reconciliation Queries for the EBS HRMS Connector
The EBS HRMS connector is configured to perform target resource reconciliation with the target system. Data from newly created and updated target system records is brought to Oracle Identity Governance and used to create and update Oracle E-Business Suite resources provisioned to OIM Users.
A SQL query is used to fetch target system records during reconciliation. All predefined SQL queries that are required to perform reconciliation are stored in the search.properties file. The search.properties file is a common file for all EBS Suite connectors. In other words, the search.properties file contains the queries for the EBS UM, HRMS Target, and HRMS Trusted connectors.
When you run a scheduled job, the connector locates the corresponding SQL query in the search.properties file and then runs it on the target system database. Target system records that meet the query criteria are returned to Oracle Identity Governance.
Depending on your requirements, you can modify existing queries or add your own query in the search.properties. This is discussed later in this guide.
Information in the search.properties file is virtually divided into two parts. The first part lists entries containing the SQL query names in the following format:
OBJ_CLASS.OP_NAME.MODE=QUERY_NAME
In this format:
-
OBJ_CLASS is the name of the object class on which the reconciliation operation is to be performed.
-
OP_NAME is the type of reconciliation operation to be performed. A reconciliation operation can be a search op, sync op, or lookup op.
-
MODE is the name of the mode in which the connector is expected to perform reconciliation. For example, trusted. Note that this value is optional.
-
QUERY_NAME is the name of the SQL query that is to be run on the target system database.
The second part lists the SQL query names and the corresponding SQL queries.
The following are the entries corresponding to the HRMS Target connector in the search.properties file:
-
__PERSON__.search=TARGET_HRMS_CURRENT_EMPLOYEE_RECON_QUERY
This query is used to reconcile all newly created and modified HRMS person records from the target system. The reconciliation operation that is performed is search based.
-
__PERSON__.sync=TARGET_HRMS_CURRENT_EMPLOYEE_RECON_QUERY
This query is used to reconcile all newly created and modified HRMS person records from the target system. The reconciliation operation that is performed is sync based.
-
__PERSON__.sync.terminate=HRMS_TERMINATED_EMPLOYEE_RECON_QUERY
The HRMS_TERMINATED_EMPLOYEE_RECON_QUERY query is used to reconcile records of persons whose services have been terminated. When the connector fetches the records of such persons, the accounts of the corresponding users in Oracle Identity Governance are revoked.
-
__JOBS__.lookup=LOOKUP_JOBS_QUERY
This query is used to synchronize values in the PER_JOBS table of the target system with the Lookup.EBSHRMS.Jobs lookup definition in Oracle Identity Governance.
-
__GRADES__.lookup=LOOKUP_GRADES_QUERY
This query is used to synchronize values in the PER_GRADES table of the target system with the Lookup.EBSHRMS.Grades lookup definition in Oracle Identity Governance.
-
__ORGANIZATION__.lookup=LOOKUP_ORGANIZATION_QUERY
This query is used to synchronize values in the HR_ALL_ORGANIZATION_UNITS table of the target system with the Lookup.EBSHRMS.Organization lookup definition in Oracle Identity Governance.
-
__PERSONTYPE__.lookup=LOOKUP_PERSONTYPE_QUERY
This query is used to synchronize values in the PER_PERSON_TYPES and HR_ALL_ORGANIZATION_UNITS tables of the target system with the Lookup.EBSHRMS.PersonType lookup definition in Oracle Identity Governance.
1.7.2 About Reconciliation Queries for the EBS HRMS ER Connector
The EBS HRMS ER connector is configured to perform trusted source reconciliation with the target system. The target system is used as the trusted source and users are directly created and modified on it. During reconciliation, the EBS HRMS ER connector fetches data (using scheduled jobs) about these target system users into Oracle Identity Governance. This data is used to create or update the corresponding OIM Users.
A SQL query is used to fetch target system records during reconciliation. All predefined SQL queries that are required to perform reconciliation are stored in the search.properties file. The search.properties file is a common file for all EBS Suite connectors. In other words, the search.properties file contains the queries for the EBS UM, HRMS Target, and HRMS Trusted connectors.
When you run a scheduled job, the connector locates the corresponding SQL query in the search.properties file and then runs it on the target system database. Target system records that meet the query criteria are returned to Oracle Identity Governance.
Depending on your requirements, you can modify existing queries or add your own query in the search.properties. This is discussed later in this guide.
Information in the search.properties file is virtually divided into two parts. The first part lists entries containing the SQL query names in the following format:
OBJ_CLASS.OP_NAME.MODE=QUERY_NAME
In this format:
-
OBJ_CLASS is the name of the object class on which the reconciliation operation is to be performed.
-
OP_NAME is the type of reconciliation operation to be performed. A reconciliation operation can be a search op, sync op, or lookup op.
-
MODE is the name of the mode in which the connector is expected to perform reconciliation. For example, trusted. Note that this value is optional.
-
QUERY_NAME is the name of the SQL query that is to be run on the target system database.
The second part lists the SQL query names and the corresponding SQL queries.
The following are the entries corresponding to the HRMS Target connector in the search.properties file:
-
__PERSON__.search.trusted=HRMS_CURRENT_EMPLOYEE_RECON_QUERY
The HRMS_CURRENT_EMPLOYEE_RECON_QUERY query is used to reconcile all employee records that are currently active from the target system. The reconciliation operation that is performed is search based.
-
__PERSON__.search.future_trusted=HRMS_CURRENT_FUTURE_EMPLOYEE_RECON_QUERY
The HRMS_CURRENT_FUTURE_EMPLOYEE_RECON_QUERY query is used to reconcile all future-dated employee records from the target system. The reconciliation operation that is performed is search based.
-
__PERSON__.sync.trusted=HRMS_CURRENT_EMPLOYEE_RECON_QUERY
The HRMS_CURRENT_EMPLOYEE_RECON_QUERY query is used to reconcile all employee records that are currently active from the target system. The reconciliation operation that is performed is sync based.
-
__PERSON__.sync.future_trusted=HRMS_CURRENT_FUTURE_EMPLOYEE_RECON_QUERY
The HRMS_CURRENT_FUTURE_EMPLOYEE_RECON_QUERY query is used to reconcile all future-dated employee records from the target system.The reconciliation operation that is performed is sync based.
1.7.3 About Provisioning Procedures for the EBS HRMS Connector
Provisioning involves management of person accounts in the target system. When you allocate (or provision) an Oracle E-Business HRMS resource to an OIM User, the operation results in the creation of a person record on Oracle E-Business HRMS for that user. Similarly, when you update the resource on Oracle Identity Governance, the same update is made to the person record on the target system.
The connector uses stored procedures for performing provisioning operations. These stored procedures are available in the wrapper packages of the target system. Information about all stored procedures used for performing provisioning operations are defined in the Procedures.properties file. The same file contains stored procedures information for both the HRMS Target and User Management connectors.
When you perform a provisioning operation, the connector locates the corresponding stored procedure in the Procedures.properties file and the runs it on the target system to complete the provisioning operation.
Depending on your requirements, you can modify existing stored procedures or add your own stored procedures to the Procedures.properties file. This is discussed later in the guide.
The first property in the Procedures.properties file, DB.PACKAGES, lists all the wrapper packages that are used during connector operations. The subsequent entries in this file are in the following format:
OBJ_NAME.OP_NAME=WRAPPER_PCKG.STORED_PROC
In this format:
-
OBJ_NAME is the name of the object on which the provisioning operation must be performed.
-
OP_NAME is the type of provisioning operation to be performed. A provisioning operation can be a create, update, delete, or terminate.
-
WRAPPER_PCKG is the name of the wrapper package.
-
STORED_PROC is the name of the stored procedure in the wrapper package that is to be run to on the target system to complete the provisioning operation.
The following are the entries corresponding to the HRMS Target connector in the Procedures.properties file:
-
Entries corresponding to the __PERSON__ object:
-
__PERSON__.create=OIM_EMPLOYEE_WRAPPER.CREATE_PERSON_API
In this entry, the CREATE_PERSON_API stored procedure of the OIM_EMPLOYEE_WRAPPER wrapper package is used for performing the Create provisioning operation against the __PERSON__ object.
-
__PERSON__.update=OIM_EMPLOYEE_WRAPPER.UPDATE_PERSON_API
In this entry, the UPDATE_PERSON_API stored procedure of the OIM_EMPLOYEE_WRAPPER wrapper package is used for performing the Update provisioning operation against the __PERSON__ object.
-
__PERSON__.delete=OIM_EMPLOYEE_WRAPPER.DELETE_PERSON_API
In this entry, the DELETE_PERSON_API stored procedure of the OIM_EMPLOYEE_WRAPPER wrapper package is used for performing the Delete provisioning operation against the __PERSON__ object.
-
__PERSON__.terminate=OIM_EMPLOYEE_WRAPPER.TERMINATE_PERSON_API
In this entry, the TERMINATE_PERSON_API stored procedure of the OIM_EMPLOYEE_WRAPPER wrapper package is used for performing the Terminate services provisioning operation against the __PERSON__ object.
-
-
Entries corresponding to child objects:
-
__ADDRESS__.add=OIM_EMPLOYEE_ADDRESS_WRAPPER.CREATE_PERSON_ADDRESS_API
In this entry, the CREATE_PERSON_ADDRESS_API stored procedure of the OIM_EMPLOYEE_WRAPPER wrapper package is used for adding address for the __PERSON__ object.
-
__ADDRESS__.remove=OIM_EMPLOYEE_ADDRESS_WRAPPER.DELETE_PERSON_ADDRESS_API
In this entry, the DELETE_PERSON_ADDRESS_API stored procedure of the OIM_EMPLOYEE_WRAPPER wrapper package is used for removing the address for the __PERSON__ object.
-
__ASSIGNMENT__.add=OIM_EMPLOYEE_WRAPPER.CREATE_PERSON_ASSIGNMENT_API
In this entry, the CREATE_PERSON_ASSIGNMENT_API stored procedure of the OIM_EMPLOYEE_WRAPPER wrapper package is used for adding assignments for person records.
-
__ASSIGNMENT__.remove=OIM_EMPLOYEE_WRAPPER.DELETE_PERSON_ASSIGNMENT_API
In this entry, the DELETE_PERSON_ASSIGNMENT_API stored procedure of the OIM_EMPLOYEE_WRAPPER wrapper package is used for removing assignments from person records.
-
__ASSIGNMENT__.update=OIM_EMPLOYEE_WRAPPER.UPDATE_PERSON_ASSIGNMENT_API
In this entry, the UPDATE_PERSON_ASSIGNMENT_API stored procedure of the OIM_EMPLOYEE_WRAPPER wrapper package is used for updating assignments for person records.
-
__ADDRESS__.update=OIM_EMPLOYEE_ADDRESS_WRAPPER.UPDATE_PERSON_ADDRESS_API
In this entry, the UPDATE_PERSON_ADDRESS_API stored procedure of the OIM_EMPLOYEE_WRAPPER wrapper package is used for updating the address of a person records.
-
1.8 Supported Connector Features Matrix
Provides the list of features supported by the AOB application and CI-based connector.
Table 1-3 Supported Connector Features Matrix
| Feature | AOB Application | CI-Based Connector |
|---|---|---|
|
Trusted Source and Target Resource Reconciliation |
Yes |
Yes |
|
Configurable Reconciliation Queries and Stored Procedures |
Yes |
Yes |
|
Full and incremental reconciliation |
Yes |
Yes |
|
Batched reconciliation |
No |
Yes |
|
Limited reconciliation |
Yes |
Yes |
|
Connection pooling |
Yes |
Yes |
|
SSL communication |
Yes |
Yes |
1.9 Connector Features
The features of the connector include full reconciliation, batched reconciliation, limited reconciliation, connection pooling, SSL communication, and so on.
The following are the features of the connector:
1.9.1 Support for Trusted Source and Target Resource Reconciliation
There are two versions of the connectors available to provide support for trusted source (authoritative application) and target resource (Target application) reconciliation.
You can use the EBS ER connector to integrate Oracle E-Business HRMS as a trusted source of Oracle Identity Governance. In this mode, the connector reconciles all the person types that are supported by the Oracle E-Business Suite HRMS store.
In the target resource mode, you can use the EBS HRMS connector to create a Target application to provision and reconcile the HRMS/Person records from the Oracle E-Business Suite HRMS store.
1.9.2 Configurable Reconciliation Queries and Stored Procedures
The connector bundle JAR file contains predefined SQL queries and stored procedures for performing reconciliation and provisioning operations, which you can modify to suit your requirements.
Reconciliation involves running a SQL query on the target system database to fetch the required Person records to Oracle Identity Governance. Predefined SQL queries are stored in the search.properties file in the connector bundle JAR package. You can modify these SQL queries or add your own SQL queries for reconciliation.
Similarly, provisioning involves running stored procedures on the target system database to create or update the required Person records. Information about the stored procedures related to performing provisioning operations are stored in the Procedures.properties file in the connector bundle JAR. You can modify these stored procedures or add your own stored procedures for provisioning.
See the following sections for more information about these SQL queries and stored procedures:
1.9.3 Full and Incremental Reconciliation
In full reconciliation, all records are fetched from the target system to Oracle Identity Governance. In incremental reconciliation, only records that are added or modified after the last reconciliation run are fetched into Oracle Identity Governance.
You can switch from incremental to full reconciliation at any time after you deploy the connector. See section Performing Full and Incremental Reconciliation for more information on performing full and incremental reconciliation runs.
1.9.4 Batched Reconciliation
You can break down a reconciliation run into batches by specifying the number of records that must be included in each batch.
See section Performing Batched Reconciliation for more information on performing batched reconciliation.
1.9.5 Limited (Filtered) Reconciliation
To limit or filter the records that are fetched into Oracle Identity Governance during a reconciliation run, you can specify the subset of added or modified target system records that must be reconciled.
See section Performing Limited Reconciliation for more information on performing limited reconciliation.
1.9.6 Connection Pooling
A connection pool is a cache of objects that represent physical connections to the target. Oracle Identity Governance connectors can use these connections to communicate with target systems.
At run time, the application requests a connection from the pool. If a connection is available, then the connector uses it and then returns it to the pool. A connection returned to the pool can again be requested for and used by the connector for another operation. By enabling the reuse of connections, the connection pool helps reduce connection creation overheads like network latency, memory allocation, and authentication.
One connection pool is created for each set of basic configuration parameters that you provide while creating an application. For example, if you have three IT resources for three installations of the target system, then three connection pools will be created, one for each target system installation.
For more information about the parameters that you can configure for connection pooling, see Advanced Setting Parameters for the EBS HRMS Connector and Advanced Setting Parameters for the EBS ER Connector.
1.9.7 Support for SSL Communication Between the Target System and Oracle Identity Governance
You can configure SSL to secure communication between Oracle Identity Governance and the target system.
See Configuring Secure Communication Between the Target System and Oracle Identity Governance for information about configuring secure communication.