Prerequisites for the Token-Based Authentication Security Policy

If you want to use the token-based authentication (TBA) security policy with the Oracle NetSuite Adapter, you must fulfill the prerequisites specific to this security policy in addition to the general prerequisites.

To create an Oracle NetSuite connection with TBA, you'll require the following details from your Oracle NetSuite instance:

• Consumer Key / Client ID: The key/ID associated with the integration record created for Oracle Integration.
• Consumer Secret / Client Secret: The secret associated with the integration record created for Oracle Integration.
• Token: The token ID associated with the access token created for the Oracle Integration's user account, role, and integration record.
• Token secret: The token secret associated with the access token created for the Oracle Integration's user account, role, and integration record.
• Account ID: Your Oracle NetSuite account ID.

To create and obtain these details, log in to your Oracle NetSuite instance as an Administrator and execute the following tasks.

Note:

To perform the TBA-related configuration tasks listed in this section, you must first enable the TBA feature in your Oracle NetSuite account. See Register with Oracle NetSuite and Enable Features.

Topics:

• Create a Role with Token-Based Authentication Permissions

• Create a User Account for Oracle Integration

• Create an Integration Record for Oracle Integration

• Create an Access Token for the User Account

• Make a Note of the NetSuite Account ID

Create a Role with Token-Based Authentication Permissions

Create a new role and assign TBA permissions along with other necessary permissions (specific to your integration) to it. You'll assign the Oracle Integration user account—which you'll subsequently create—to this role.

Note:

As a best practice, avoid using the Administrator and Full Access roles/users in Oracle NetSuite connections that use the TBA security policy.

To create a new role:

1. On the NetSuite home page, select Setup, then User/Roles, then Manage Roles, and then New.
2. On the Role page:
   1. Enter a name for the role, for example, Oracle Integration Role.
   2. In the CENTER TYPE drop-down field, select System Administrator Center.
   3. In the Subsidiary Restrictions section, select All. For information on subsidiary restrictions, see Restricting Role Access to Subsidiaries.
   4. On the Permissions tab, add the required permissions for the role from the four available subtabs: Transactions, Reports, Lists, and Setup.

      To add a permission, perform the following actions after selecting any of the subtabs:

      1. Select a permission from the PERMISSION drop-down field.
      2. Select an access level for the permission from the LEVEL field.
      3. Click Add.

         To provide TBA permissions to the new role, you must add the User Access Token permission to the role with full access. This permission is present on the Setup subtab under the Permissions tab.

         You can add other permissions to the role depending on the tasks you want to allow the users assigned this role to perform. For any custom role, you must specifically add the SOAP web services permission with the Full level. See Assigning the SOAP Web Services Permission to a Role.

   5. After you've added all the necessary permissions, click Save to create the new role.

Create a User Account for Oracle Integration

Create a user account for Oracle Integration and assign this account to the TBA role you created previously. You'll use the credentials associated with this user account to connect to NetSuite from Oracle Integration.

If you have already created a user account for Oracle Integration, you can assign the existing account to the new TBA role. See Assign an Existing User Account to a Role. This way, you don't have to consume another open user-account license.

If you require to create a new user and assign it to the TBA role, follow the procedure provided here:

1. On the NetSuite home page, select Lists, then Employees, then Employees, and then New.
2. On the Employee page:
   1. In the NAME fields, enter a first name and last name for the user, for example, Integration User05.
   2. In the EMAIL field, enter a valid email address.
   3. In the SUBSIDIARY drop-down field, select a subsidiary of your choice.
   4. Scroll down and click the Access tab to perform additional configurations.
      1. Select the GIVE ACCESS and MANUALLY ASSIGN OR CHANGE PASSWORD check boxes.
      2. In the PASSWORD field, enter a password for the user account.
      3. Re-enter the password in the CONFIRM PASSWORD field.
      4. To assign this user to the TBA role created previously:
         • With the Roles subtab selected, select the TBA role from the ROLE drop-down field; for example, Oracle Integration Role.
         • Click Add.
   5. Click Save to create the new user record.

Note:

To assign an existing Oracle Integration user account to the new role:

1. From the NetSuite home page, navigate to the Employees page: Lists, then Employees, and then Employees.
2. Click Edit next to the name of the Oracle Integration user account.
3. On the account's page, scroll down and click the Access tab.
4. With the Roles subtab selected, select the role created previously from the ROLE drop-down field; for example, Oracle Integration Role.
5. Click Add, and then click Save.

Create an Integration Record for Oracle Integration

Before you can create and assign API tokens (for TBA) to a user account, you must create an integration record for the application that will use this user account to access NetSuite.

Create an integration record for the Oracle Integration application.

Note:

If you have already created a TBA-enabled integration record for Oracle Integration, you can skip this section. Reuse the existing record to generate new access tokens. This way, you don't have to maintain multiple integration records and associated consumer keys and secrets for the same application.

1. On the NetSuite home page, select Setup, then Integration, then Manage Integrations, and then New.
2. On the Integration page:
   1. Enter a name for the integration record, for example, Oracle Integration TBA.
   2. Optionally, enter a description for the record.
   3. Leave the Enabled option selected in the STATE drop-down field.
   4. On the Authentication tab:
      1. Leave the TOKEN-BASED AUTHENTICATION check box selected.
      2. Deselect the TBA: AUTHORIZATION FLOW and AUTHORIZATION CODE GRANT check boxes.
   5. Click Save.

   The confirmation page displays the client credentials for this integration record or application.

3. Note down the Consumer Key / Client ID and Consumer Secret / Client Secret values. You'll use these credentials to connect to NetSuite from Oracle Integration.

   Note:

   The system displays the client credentials only the first time you save the integration record. If lose or fail to store these credentials, you'll have to reset the credentials. Edit the integration record and click Reset Credentials to generate a new set of client credentials.

Create an Access Token for the User Account

Create and assign an access token to the Oracle Integration user account.

1. On the NetSuite home page, select Setup, then User/Roles, then Access Tokens, and then New.
2. On the Access Token page:
   1. In the APPLICATION NAME field, select the integration record created previously.
   2. In the USER field, select the Oracle Integration's user account.
   3. In the ROLE field, select the appropriate TBA role.
   4. Leave the TOKEN NAME field unchanged.
   5. Click Save.

   The confirmation page displays the token values for the user account.

3. Note down the Token ID and Token Secret values. You'll use these credentials to connect to NetSuite from Oracle Integration.

   Note:

   This is the only time the token ID and token secret values are displayed. If lose or fail to store these values, you'll have to create a new token and obtain a new set of values.

Make a Note of the NetSuite Account ID

Along with other credentials, you'll require the NetSuite Account ID to connect to NetSuite from Oracle Integration.

To view your account ID:

1. On the NetSuite home page, select Setup, then Integration, and then SOAP Web Services Preferences.
2. Note down the Account ID displayed at the top of the page.
3. Click Cancel to exit the page.