Oracle ERP Cloud

1 Oracle ERP CloudSecuring ERP21 COracle ERP CloudSecuring ERP21 CPart Number F42736-03 Copyright 2011, 2021, Oracle and/or its : Rakhi Banerjee, Alvin Law, Timothy Jayaraj, Abhishek Majumder, P. S. G. V. Sekhar, Angie ShahiThis software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protectedby intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate,broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering,disassembly, or decompilation of this software, unless required by law for interoperability, is information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please reportthem to us in this is software or related documentation that is delivered to the Government or anyone licensing it on behalf of the Government, thenthe following notice is GOVERNMENT END USERS: Oracle programs (including any operating system, integrated software, any programs embedded, installed oractivated on delivered hardware, and modifications of such programs) and Oracle computer documentation or other Oracle data delivered to oraccessed by Government end users are "commercial computer software" or "commercial computer software documentation" pursuant to theapplicable Federal Acquisition Regulation and agency-specific supplemental regulations.

2 As such, the use, reproduction, duplication, release, display,disclosure, modification, preparation of derivative works, and/or adaptation of i) Oracle programs (including any operating system, integratedsoftware, any programs embedded, installed or activated on delivered hardware, and modifications of such programs), ii) Oracle computerdocumentation and/or iii) other Oracle data, is subject to the rights and limitations specified in the license contained in the applicable contract. Theterms governing the Government's use of Oracle Cloud services are defined by the applicable contract for such services. No other rights aregranted to the software or hardware is developed for general use in a variety of information management applications. It is not developed or intended foruse in any inherently dangerous applications, including applications that may create a risk of personal injury.

3 If you use this software or hardwarein dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safeuse. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective and Intel Inside are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarksor registered trademarks of SPARC International, Inc. AMD, Epyc, and the AMD logo are trademarks or registered trademarks of Advanced MicroDevices. UNIX is a registered trademark of The Open software or hardware and documentation may provide access to or information about content, products, and services from third parties. OracleCorporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, andservices unless otherwise set forth in an applicable agreement between you and Oracle .

4 Oracle Corporation and its affiliates will not be responsiblefor any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicableagreement between you and business names used in this documentation are fictitious, and are not intended to identify any real companies currently or previously in ERP CloudSecuring ERPC ontentsPreface i1 Introduction1 Securing Oracle ERP Cloud : Overview .. 1 Overview of ERP Security Implementation .. 2 Role Types .. 3 Role Inheritance .. 4 Duty Role Components .. 4 Aggregate Privileges .. 5 Guidelines for Configuring Security in Oracle Applications Cloud .. 62 Security Console7 Overview of Security Console .. 7 Configure the Security Console .. 8 Retrieve Latest LDAP Changes .. 9 Security Visualizations.

5 10 Options for Viewing a Visualization Graph .. 10 Visualization Table Display Options .. 12 Generate a Visualization .. 13 Simulate Navigator Menus in the Security Console .. 13 Analytics for Roles .. 14 Analytics for Database Resources .. 15 FAQs on Using the Security Console .. 16 Oracle ERP CloudSecuring ERP3 Setting Up Application Security19 Overview of Applications Security Setup Tasks .. 19 User-Name Formats .. 20 Password Policy .. 21 Role Preferences .. 22 User Categories: Explained .. 23 Add Users to a User Category .. 25 User-Name and Password Notifications .. 26 How can I enable notifications for pending workers? .. 27 Why don't I see my user name in the forgot password email notification? .. 28 Why don't I see my user name in the forgot user name email notification?

6 28 Create a Notification Template .. 28 Schedule the Import User and Role Application Security Data Process .. 30 Schedule the Import User Login History Process .. 31 Why You Run the Send Pending LDAP Requests Process .. 31 Schedule the Send Pending LDAP Requests Process .. 32 Retrieve Latest LDAP Changes .. 334 Bridge for Microsoft Active Directory35 Overview of Bridge for Microsoft Active Directory .. 35 Active Directory Synchronization .. 36 User Account Attribute Mapping .. 37 Microsoft Active Directory Bridge Setup .. 38 FAQs on Working with the Bridge for Microsoft Active Directory .. 435 Enabling Basic Access to HCM Data47 Before You Start .. 47 Why You Assign Security Profiles to Roles .. 47 Assign Security Profiles to Roles .. 48 Configure Employee List of Values.

7 50 Oracle ERP CloudSecuring ERP6 Implementation Users53 Implementation Users .. 53 Overview of ERP Implementation Users .. 53 User Accounts .. 54 User Account Details .. 55 Create User Accounts for Implementation Users .. 56 Assign Roles to Implementation Users .. 57 Delete Implementation User Accounts .. 57 Synchronize User and Role Information .. 57 Reset the Cloud Service Administrator Sign-In Details .. 587 Preparing for Application Users59 Before You Start .. 59 Preparing for Application Users .. 59 User and Role-Provisioning Setup Options .. 60 User Account Creation Option .. 60 User Account Role Provisioning Option .. 61 User Account Maintenance Option .. 62 User Account Creation for Terminated Workers Option .. 63 Set the User and Role Provisioning Options.

8 63 Provision Abstract Roles to Users Automatically .. 64 FAQs for Preparing for Application Users .. 658 Application Users Management67 Before You Start .. 67 Users .. 67 Users Accounts .. 70 FAQs on Creating and Managing Application Users .. 75 Oracle ERP CloudSecuring ERP9 Role Provisioning77 Role Mappings .. 77 Create a Role Mapping .. 78 Role Provisioning and Deprovisioning .. 80 Autoprovisioning .. 82 User and Role Access Audit Report .. 83 Data Access .. 85 Assign Data Access to Users .. 87 View Role Information Using Security Dashboard .. 88 Automatic Data Provisioning .. 89 Creating a Data Provisioning Rule .. 90 Automatic Data Provisioning and Deprovisioning .. 91 Roles That Give Workflow Administrators Access .. 91 View Role Information Using Security Dashboard.

9 95 FAQs on Provisioning Roles and Data to Application Users .. 9510 Reporting on Application Users and Roles99 Run the User Details System Extract Report .. 99 User Details System Extract Report Parameters .. 99 User Details System Extract Report .. 100 Person User Information Reports .. 102 User History Report .. 103 View Role Information Using Security Dashboard .. 104 LDAP Request Information Reports .. 104 Inactive Users Report .. 106 User Role Membership Report .. 108 User and Role Access Audit Report .. 109 User Password Changes Audit Report .. 111 View Locked Users and Unlock Users .. 113 FAQs for Reporting on Application Users and Roles .. 11411 Location Based Access115 Overview of Location-Based Access .. 115 How Location-Based Access Works.

10 115 Enable and Disable Location-Based Access .. 116 FAQs on Location Based Access .. 117 Oracle ERP CloudSecuring ERP12 Single Sign-On121 Configure Single Sign-On .. 121 Oracle Applications Cloud as the Single Sign-On (SSO) Service Provider .. 123 FAQs on Single Sign-On .. 12313 API Authentication127 Configure Outbound API Authentication Using JWT Custom Claims .. 127 Configure Outbound API Authentication Using Three Legged OAuth Authorization Protocol .. 127 Configure Inbound Authentication .. 129Is there a recommended format for the public certificate? .. 13014 Export and Import of Security Setup Data131 Export and Import of Security Console Data .. 131 Export and Import of Custom Roles .. 132 Export and Import a Custom Role .. 134 Export and Import of ERP Security Setups .. 13615 Security Configuration141 Data Security Policies.