Quantcast
Channel: ATeam Chronicles
Viewing all 987 articles
Browse latest View live

Oracle Service Cloud – Getting Started With Bulk APIs

$
0
0

Introduction

Oracle Service Cloud (henceforth referred to as OSvC) provides a complete customer service solution that offers cross-channel service delivery, web customer service, self-service, knowledge management, and a host of other features.

Besides its functional capabilities, OSvC provides a robust, API based integration and extension framework.

In this and a few upcoming blogs we’ll focus on the Integration Framework and explore the Connect Web Services (CWSS) APIs in detail. This blog in particular is about bulk data inserts/updates using CWSS.

A basic knowledge of OSvC is assumed; if not, the tutorials available here are a great place to start.

Connect Web Services – Basics

The CWSS APIs provide SOAP based services that can create, modify or get OSvC data. The API is described by the WSDL https://{your_site}/cgi-bin/{your_interface}.cfg/services/soap?wsdl=typed , where ‘your_site’ is the name of the OSvC site and ‘your_interface’ is the name of the specific interface. The WSDL has two ports, viz. RightNowSyncBinding which allows WS-UsernamePassword Token based authentication, and RightNowFedAuthSyncBinding which allows SAML based authentication. Both ports expose the same set of operations.

Further CWSS documentation is available here.

Batch Operation

The WSDL operation that enables bulk functionality —which is the topic of this blog— is ‘Batch’. The Batch operation supports sending bulk, heterogeneous requests to the server. Following is a sample input payload (only key XML tags shown) :

<Batch>
	<BatchRequestItem>
		<CreateMsg>
			<RNObjects xsi:type="{Incident,Contact,etc.}"/>
			<RNObjects/>
			<!--n times-->
			<ProcessingOptions>
				<SuppressExternalEvents/>
				<SuppressExternalRules/>
			</ProcessingOptions>
		</CreateMsg>
		<!--17 such 'operations' exist. Only one allowed per BatchRequestItem-->
		<CommitAfter>{true/false}-defaults to false</CommitAfter>
	</BatchRequestItem>
	<BatchRequestItem>
		<GetMsg>
			<RNObjects/>
			<RNObjects/>
			<!--n times-->
			<ProcessingOptions/>
		</GetMsg>
		<CommitAfter/>
	</BatchRequestItem>
        <BatchRequestItem>
		<UpdateMsg>
			<RNObjects/>
			<RNObjects/>
			<!--n times-->
		</UpdateMsg>
		<CommitAfter/>
	</BatchRequestItem>
        <BatchRequestItem>
		<DestroyMsg>
			<RNObjects/>
			<RNObjects/>
			<!--n times-->
		</DestroyMsg>
		<CommitAfter/>
	</BatchRequestItem>
	<BatchRequestItem/>
	<BatchRequestItem/>
  <!--max 100 such BatchRequestItems-->
  <!--max 10,000 total RNObjects in a given SOAP request-->
</Batch>

Let’s dive in.

  1. BatchRequestItems represent a transaction boundary, i.e. they can be used to separate a Batch into multiple transactions by setting the CommitAfter attribute to true. Transactions can span across BatchRequestItems as well if the CommitAfter flag is not set. The default value of the flag is false.
  2. Within a BatchRequestItem, an ‘operation’ such as CreateMsg, UpdateMsg (up to 17 allowed) etc. can be embedded. Operation represents the specific task to be performed, such as CRUD, ROQL query, etc. A BatchRequestItem can have only one operation, but multiple BatchRequestItems with various operations are permitted. This enables heterogeneous behavior within a transaction boundary.
  3. Each such operation can have a number of RNObjects.
    OSvC data model includes a number of standard objects like Incidents, Contacts etc. , as well as custom objects. Each such object translates to a database table at the back-end. An RNObject abstractly represents the individual rows of the table. Thus, RNObject is a super class of all OSvC Object instances. The xsi:type attribute of the RNObject XML refers to the actual sub-class instance. CWSS deals only with RNObjects, thus exhibiting polymorphic behavior.
  4. Processing Options: These are set at the operation level(CreateMsg, GetMsg etc.) and vary depending on the operation. For example, for a Create/Update operation these can be used to enable or disable OSvC Business Rules and Events.
    It might be a good idea to disable Events and Business rules for bulk load scenarios because these cause extra performance overhead on the OSvC Server.

A sample successful Batch invocation response is provided below (only relevant XML tags shown):

<BatchResponse>
	<BatchResponseItem>
		<CreateResponseMsg>
			<RNObjectsResult>
				<RNObjects xsi:type="Incident">
					<ID id="sample_id_1"/>
				</RNObjects>
				<RNObjects xsi:type="Incident">
					<ID id="sample_id_2"/>
				</RNObjects>				
			</RNObjectsResult>
		</CreateResponseMsg>
	</BatchResponseItem>
	<BatchResponseItem>
		<UpdateResponseMsg/>
	</BatchResponseItem>
	<BatchResponseItem>
		<GetResponseMsg>
			<RNObjectsResult>
				<RNObjects xsi:type="Contact">
					<!--details-->
				</RNObjects>
			</RNObjectsResult>
		</GetResponseMsg>
	</BatchResponseItem>
</BatchResponse>

 

Transaction Boundaries

As explained above, the CommitAfter flag can be used to separate a given Batch payload into multiple transactions.
Given below are two examples(BatchRequestItem is abbreviated as BRI).
Screen Shot 08-18-15 at 11.47 AM

It should be obvious by now that a given SOAP payload is processed sequentially, in the XML-order it is received. This allows for a clean separation of transaction boundaries.

Batch Upper Limits

Following upper limits are imposed on a given input payload for the Batch operation:

  • Up to 100 BatchRequestItems
  • Up to 1000 RNObjects in a given BatchRequestItem
  • Up to 10,000 total RNObjects in a given SOAP payload

It must be noted that these are only numerical limits, and the server can reject lower sized messages as well if the memory/cpu consumption is high.

Error Handling

Errors can happen for a number of reasons :

  • The input XML was ill-formed
  • The batch upper limits specified above were crossed
  • The business data within an RNObject was bad, for example an email address like first.last.company.com

Checks for ill-formed XML and numerical upper limits are performed first, before the payload is processed. For such errors a SOAPFault is returned. For example :

    <soapenv:Fault>
         <faultcode>soapenv:Sender</faultcode>
         <faultstring>Data element in the Message is NULL</faultstring>
         <detail>
            <fault>NULL returned from the Batch deserializer due to missing or invalid XML</fault>
         </detail>
    </soapenv:Fault>

      <soapenv:Fault>
         <faultcode>soapenv:Sender</faultcode>
         <faultstring>Too many items in Batch - exceeds internal limit of 100 items per Batch.</faultstring>
         <detail>
            <n0:RequestErrorFault xmlns:n0="urn:faults.ws.rightnow.com/v1_2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
               <n0:exceptionCode>INVALID_REQUEST</n0:exceptionCode>
               <n0:exceptionMessage>Too many items in Batch - exceeds internal limit of 100 items per Batch.</n0:exceptionMessage>
            </n0:RequestErrorFault>
         </detail>
      </soapenv:Fault>

Things get interesting for bad data within RNObjects. Whenever such an error is encountered :

  1. OSvC stops processing the current transaction any further.
  2. An error message is returned for the specific BatchRequestItem.
  3. The current transaction being processed is rolled back. Any previously committed transactions (due to CommitAfter being true) remain committed.
  4. The server moves on to the next transaction in the request, if any.

The following example demonstrates a batch with a bad RNObject(shown in red) and the corresponding output (You can open the image in a new tab if needed).

Screen Shot 08-17-15 at 01.00 PM

CWSS Timeout

OSvC manages the CWSS timeout settings in the front-end Apache Server. There isn’t a Web Service timeout per se, but there’s an idle timeout value of 300 seconds (by default). That is, if the TCP connection with the Server remains idle for more than 300 seconds, a timeout error occurs.

For example, if a large and DB intensive payload is sent, it is possible that the invocation will time out. When that happens, the current transaction being processed is rolled back, previously committed transactions remain committed, and pending transactions are not processed.
The response message only contains the timeout exception, and it is upon the caller to ensure committed transactions are rolled back.

Throughput Considerations

Following factors should be taken into account when developing bulk load interfaces using CWSS Batch:

Custom Fields and Attributes

Custom fields and attributes associated with an OSvC object have a direct impact on the object’s Create/ Update throughput time. I.e. , as more and more attributes are added, the API throughput time increases. Hence, it’s a good idea to keep the number of custom fields and attributes as less as possible.

 

Parallel Invocations

CWSS scales very well with multiple parallel threads invoking the API. Hence, bulk data-load processes should be designed to use concurrent threads, and the degree of concurrency should be controllable.
We ran a series of tests, using an Oracle SOA 12c instance as client, increasing the number of parallel threads exponentially from 2 all the way up to 128, and observed the net API throughput to remain consistent. We’ll publish a separate blog detailing the tests and the results, but for now it should suffice to say that the bulk data-load process should be concurrent.

Number of Transactions

From a design/error-handling perspective, it’s a good practice to limit transactions( discussed above ) to one per SOAP message.

That way, irrespective of whether the the transaction succeeds within OSvC or errors out(due to business faults, timeouts, and other systems errors), the client is rightly intimated and the client’s transaction and OSvC’s transaction remain in sync.
Otherwise, the client would have to code logic to figure out which transactions succeeded, which failed, and which weren’t processed.

Also, transactions in a single batch payload are processed sequentially. It’s a lot faster if the same transactions are sent in parallel using multiple threads, as described above.

Batch Size

As seen above, the Batch Size for a given SOAP payload can vary from 1 RNObject all the way up to 10,000. So the question arises, what’s the ideal batch size ? The answer isn’t as simple as one magic number. It depends on the specific object, number of attributes being created/updated, and if the client is invoking CWSS in parallel threads.

For example, for creating the Contact object with about 25 Custom Attributes(along with all the standard attributes), with 4-32 parallel threads, we found 100 RNObjects in a batch in a single transaction to be a good number, when compared against 1, 500 and 1000 RNObjects (More details on the testing methodology in a separate blog). This DOES NOT imply that 100 is the ideal number. Some testing may be necessary to find the optimal batch size.

Also, it is almost always a bad idea to program one commit per RNObject, for example sending only one RNObject in a payload, or having CommitAfter set to true for each RNObject. This is because commits are a highly costly database operation, and the last thing we need in bulk load scenarios is multiple parallel hits on the DB.

Conclusion

In this blog we discussed the CWSS Batch API in some detail, a few do’s and dont’s, and throughput considerations while performing bulk data-loads.

Other A-Team blogs in the series on OSvC Integration APIs :
Implementing Upsert for OSvC APIs


Eloqua OOTB Integrations Cheat Sheet

$
0
0

For those not familiar with Eloqua, there are a large number of potential productized integrations available some of which are free, some of which require licenses, and some of which require access to 3rd party applications (both on-prem and cloud). To keep it simple, this blog post focuses on those productized integrations that are free as well as those that integrate with existing Oracle products (both on-prem and cloud). I have organized the integrations into the following table to assist you in identifying what is “out of the box” which is useful to know if you are putting together a POC or demo.

Cloud Integrations
Eloqua integration & direction
Description Link to more info
Eloqua ↔ Compendium
While in Eloqua, the Oracle Marketing Calendar app opens in a separate browser tab. The calendar can be accessed by all users of your Eloqua instance and respects your security settings and permissions to only show campaigns and emails that users have access to view. Compendium Advanced Calendar
Eloqua ← Compendium After linking your Eloqua account, you can begin pushing content to Eloqua from Compendium so that it can be stored, and used to build campaigns. Promote Content
Eloqua ← Oracle Service Cloud The Service Cloud app allows you to make decisions on Eloqua contacts based on information stored in Service Cloud. This includes things like “Does this contact have an open case?” or “Has this contact called into support 5 or more times in the last 30 days?” Service Cloud App
Eloqua → SRM SmartCap takes the content from an Eloqua landing page and pushes it to SRM. This allows you to schedule a post on a variety of social networks, such as Twitter and Facebook. Smart Create a Post
Eloqua ← SRM View click throughs on Oracle SRM published social links within Eloqua. Dynamic Link Tracking
Eloqua → SRM Send your Eloqua contacts to Oracle SRM to target them through Facebook Custom Audiences. Custom Audiences
Eloqua → BlueKai ID swapping occurs when a contact opens an Eloqua email, or a visitor visits a site that includes an Eloqua tracking script. The tracking script retrieves anonymized data and passes it to BlueKai DMP.
ID Swapping
Eloqua → Oracle Push Cloud
The integration between Eloqua and Oracle Push Cloud allows marketers to push messages to their integrated mobile apps as an outbound channel within Eloqua, just like email. Oracle Push Cloud App
  
Oracle PaaS Integrations
Eloqua integration & direction Description Link to more info
Eloqua ← ICS Push Contacts & Objects to Eloqua Oracle Eloqua Cloud adapter
   
Social/Web Integrations
Eloqua integration & direction Description Link to more info
Eloqua → Various Social
Add social sharing buttons to your Eloqua landing pages for Facebook, Twitter, LinkedIn, Google+, and Reddit  Social Sharing Buttons
Eloqua ← Webex Register contacts for WebEx events and meetings as part of your campaigns. This integration also enables decisions based on attendance or registration without needing to bring WebEx data into Eloqua.  Webex App
Eloqua ← GoToWebinar Register contacts for GoToWebinar events as part of your campaigns. This integration also enables decisions based on attendance or registration without needing to bring GoToWebinar data into Eloqua.   GoToWebinar App
Eloqua ← YouTube Include YouTube videos in Eloqua emails and landing pages YouTube Embed App
Eloqua ← Twitter Add a Sign in with Twitter button to Eloqua landing pages Twitter Signon
Eloqua ← Twitter Enhance Eloqua landing pages by leveraging the following widgets: Embedded Tweet, Twitter Card, Twitter Follow Button, Twitter Timeline. Twitter Widgets
Eloqua ← Facebook Add a Log in with Facebook button to their landing pages Facebook Sign On
Eloqua ← Facebook Enhance Eloqua landing pages by leveraging the following widgets: Like/Recommend Button & Embedded Comments Facebook Widgets
Eloqua ← LinkedIn
place an AutoFill with LinkedIn button on your landing page. Note: you must be part of the LinkedIn lead accelerator program.
LinkedIn Auto Fill
Eloqua ↔ LinkedIn Synchronize LinkedIn Lead Accelerator programs with their Eloqua email nurture programs. Note: you must be part of the LinkedIn lead accelerator program.
LinkedIn Lead Accelerator
On-Prem & Cloud CRM Integrations
Eloqua integration & direction Description Link to more info
Eloqua ↔ Sales Cloud, CRMOD, etc. Both outbound and inbound sync of customer data OOTB CRM integrations
Eloqua ↔ Sales Force Associate a Sales Force contact to a campaign directly from within the campaign canvas using a Cloud Action service. Sales Force campaign association app
Other On-Prem Integrations
Eloqua integration & direction Description Link to more info
Eloqua ← WebCenter Sites 11g R1 Publish content to Eloqua to make it available for campaigns WCS 11g R1, Push Content to Eloqua
Eloqua → WebCenter Sites 11g R1 Using Eloqua Forms on WCS-rendered pages WebCenter Sites 11g R1, Forms in Sites

 

Note: there are many more productized integrations planned in the pipeline. I will be updating this page every few months in an attempt to keep it fresh. Additionally, there are a plethora of 3rd party integrations which add features, enhancements, and power to Eloqua. These are available from the AppCloud store: Oracle Cloud Marketplace

If you know of other productized/free integrations, please inform me and I will add them here.

And finally, Eloqua plans to deprecate their existing SOAP interfaces later in 2015. Thus, going forward, any bespoke integrations should be done via their REST API or their BULK 2.0 API.

Creating Event Based E-Mail and Text Notifications for BICS using Apex

$
0
0

Introduction

Event Based notification functionality for Oracle’s BI Cloud Service (BICS) will be available later this year, but until that time some of the same functionality can be created through Apex.

This article will walk through a process for creating notifications, both e-mail and SMS text message, based on a data event within BICS.  The article will also demonstrate how these can be scheduled to run automatically.  While written with a BICS audience in mind, it is also relevant to standalone Apex users looking to implement event based notifications.

Some possible use cases for this:

– Notify administrators if row counts in fact or dimension tables change outside of norms, possibly suggesting data load or other data quality issues

– Notify report consumers if business related thresholds are crossed, possibly suggesting opportunities, or areas that need attention

 

Main Article

Alert Condition Statement

In a previous blog, using Apex RESTful services to extract data from BICS, the SQL behind a report in the Sample Apps dashboard was examined.  This will be re-used in this article to demonstrate a notification based alert.

On the Sample Dashboard is a tabular report that shows the Top Product Performers based on revenue, highlighted below:

Dashboard-1024x815

Using the ‘Administration’ option, and then ‘Manage Sessions’, the SQL that the BI Server runs can be located and examined. With a little re-work and some testing within SQL Workshop, the SQL statement can be recreated.

select
extract(year from c.time_bill_dt) as year,
sum(c.revenue) as revenue,
sum (c.cost_fixed + c.cost_variable) as cost,
sum(1) as orders,
p.product,
g.region,
o.channel_name
from cloud_f_cost c
join cloud_d_products p on p.prod_item_key=c.prod_item_key
join cloud_d_geography g on g.addr_key = c.addr_key
join cloud_d_orders o on o.order_key = c.order_key
group by
extract(year from c.time_bill_dt),
p.product,
g.region,
o.channel_name

In this example, an alert will be created for whenever the on-line revenue in the Pocket Fun ES product line for Europe drops below $3,500,000 for the current year (which in the sample app data is 2013).  The ‘where’ statement for this condition would be.

where product=’PocketFun ES’ and year=2013 and Region=’EMEA’ and Channel_name=’Online’ and revenue<3500000;

This SQL statement will be built into a Stored Procedure.  If the SQL statement is TRUE – so the conditions of the WHERE statement are met – then a row will be returned.  This row will include the E-Mail address details for the recipients of the alert. This row will then be passed into an Apex e-mail function and an e-mail generated.

If the conditions of the SQL statement are not met, then no row will be returned, and nothing will be passed to the Apex e-mail function.

The SQL statement could be as simple as counting the number of rows of data in a table, or replicate a complex set of queries as in this example. The only requirement is that when the condition is true – a row of data be returned.

 

Constructing the Stored Procedure

Please note – cutting and pasting from this HTML article can cause some incorrect characters to be copied.  To remedy this, use this link for a plain text version of the code.  

The structure of the Stored Procedure is broken out below.  The Stored Procedure can be created in the SQL Workshop of Apex.

The first section creates the procedure, named ‘EMAIL_POCKETFUN_PERFORMANCE’ and defines variables that will be used.

CREATE OR REPLACE PROCEDURE “EMAIL_POCKETFUN_PERFORMANCE”
AS
EMAIL_TO VARCHAR2(255);
EMAIL_FROM VARCHAR2(255);
EMAIL_CC VARCHAR2(255);
EMAIL_BCC VARCHAR2(255);
BEGIN
begin

The next section begins the ‘SELECT’ statement, that will include the Alert recipients if the condition is met.

Most cell phone companies allow an e-mail to be sent directly as an SMS message, so if these alerts need to be received as a text message, the e-mail address of the phone could be used.  This table shows the 4 main US carriers and the e-mail format.  Similar syntax is used by most global cell phone carriers.  For specifics, check with the carrier.

 

Cell Phone Carrier E-Mail Format
Sprint phonenumber@messaging.sprintpcs.com
Verizon phonenumber@vtext.com
T-Mobile phonenumber@tmomail.net
AT&T phonenumber@txt.att.net

select
‘joe.salesmanager@oracle.com’ as EMAIL_TO,
‘john.smith@oracle.com’ as EMAIL_FROM,
‘3031234567@vtext.com’ as EMAIL_CC,
‘bigboss@oracle.com’ as EMAIL_BCC
INTO EMAIL_TO,EMAIL_FROM,EMAIL_CC,EMAIL_BCC
from

The next section contains the Condition in the form of a SQL sub-select statement.  In this example is the SQL described earlier that calculates whether the revenue for ‘PocketFun ES’, for European OnLine sales in 2013 is under $3,500,000.

If the condition is true, the select statement returns a row of data.  If it is false, no data is returned.  The data itself is not important, only whether a row is returned or not.

(select
extract(year from c.time_bill_dt) as year,
sum(c.revenue) as revenue,
sum (c.cost_fixed + c.cost_variable) as cost,
sum(1) as orders,
p.product,
g.region,
o.channel_name
from cloud_f_cost c
join cloud_d_products p on p.prod_item_key=c.prod_item_key
join cloud_d_geography g on g.addr_key = c.addr_key
join cloud_d_orders o on o.order_key = c.order_key
group by
extract(year from c.time_bill_dt),
p.product,
g.region,
o.channel_name)
where product=’PocketFun ES’ and year=2013 and Region=’EMEA’ and Channel_name=’Online’ and revenue<3500000;

If data is returned, the alert recipient information will be passed into the apex_mail.send queue.  If no data is returned, the above select will return nothing, and so no recipient information will be added to the send queue.

The final piece of the statement calls the ‘APEX_MAIL.PUSH_QUEUE’ command to actually send the e-mail.

end;
apex_mail.send(
p_to => EMAIL_TO,
P_FROM => EMAIL_FROM,
P_BODY => ‘Message’,
p_body_html => ‘ALERT – PocketFun ES EMEA 2013 Online Underforming’,
P_SUBJ => ‘ALERT – PocketFun ES EMEA 2013 Online Underforming’,
p_cc => EMAIL_CC,
p_bcc => EMAIL_BCC,
p_replyto => ”
);
APEX_MAIL.PUSH_QUEUE;
END;

 

Repeating the whole Stored Procedure in it’s entirety:

CREATE OR REPLACE PROCEDURE “EMAIL_POCKETFUN_PERFORMANCE”
AS
EMAIL_TO VARCHAR2(255);
EMAIL_FROM VARCHAR2(255);
EMAIL_CC VARCHAR2(255);
EMAIL_BCC VARCHAR2(255);
BEGIN
begin
select
‘joe.salesmanager@oracle.com’ as EMAIL_TO,
‘john.smith@oracle.com’ as EMAIL_FROM,
‘3031234567@vtext.com’ as EMAIL_CC,
‘bigboss@oracle.com’ as EMAIL_BCC
INTO EMAIL_TO,EMAIL_FROM,EMAIL_CC,EMAIL_BCC
from
(select
extract(year from c.time_bill_dt) as year,
sum(c.revenue) as revenue,
sum (c.cost_fixed + c.cost_variable) as cost,
sum(1) as orders,
p.product,
g.region,
o.channel_name
from cloud_f_cost c
join cloud_d_products p on p.prod_item_key=c.prod_item_key
join cloud_d_geography g on g.addr_key = c.addr_key
join cloud_d_orders o on o.order_key = c.order_key
group by
extract(year from c.time_bill_dt),
p.product,
g.region,
o.channel_name)
where product=’PocketFun ES’ and year=2013 and Region=’EMEA’ and Channel_name=’Online’ and revenue<3500000; end; apex_mail.send( p_to => EMAIL_TO,
P_FROM => EMAIL_FROM,
P_BODY => ‘Message’,
p_body_html => ‘ALERT – PocketFun ES EMEA 2013 Online Underforming’,
P_SUBJ => ‘ALERT – PocketFun ES EMEA 2013 Online Underforming’,
p_cc => EMAIL_CC,
p_bcc => EMAIL_BCC,
p_replyto => ”
);
APEX_MAIL.PUSH_QUEUE;
END;

Testing the Stored Procedure

Once compiled, the Procedure can be tested:

begin
EMAIL_POCKETFUN_PERFORMANCE;
end;

If the Condition is TRUE – which in this case it is, since in the SAMPLE APP data the revenue for this combination is $3,450,000 – an alert will be generated.

 

Scheduling the Stored Procedure

The procedure can be scheduled to run using the Apex Cloud Scheduler.  The job_action value must equal the name of the Stored Procedure created previously.  In this example a scheduled job is created to run Daily, starting at 7am.  More details of how to use the scheduler can be found in the ‘Further Reading’ section below.

BEGIN
cloud_scheduler.create_job(
job_name => ‘POCKETFUN_PERFORMANCE_EMAIL’,
job_type => ‘STORED_PROCEDURE’,
job_action => ‘EMAIL_POCKETFUN_PERFORMANCE’,
start_date => ’28-AUG-15 07.00.00.000000 AM -07:00′,
repeat_interval => ‘FREQ=DAILY’,
enabled => TRUE,
comments => ‘POCKETFUN_PERFORMANCE_EMAIL’);
END;

To confirm the schedule:

SELECT * FROM user_scheduler_jobs;

To delete the scheduled job:

BEGIN
cloud_scheduler.drop_job(
job_name => ‘EMAIL_POCKETFUN_PERFORMANCE’);
END;

 

Summary

This article demonstrated how a Stored Procedure can be used and scheduled to trigger an Event Based Alert for BICS.

 

Further Reading

Apex Mail

https://docs.oracle.com/cd/E14373_01/apirefs.32/e13369/apex_mail.htm#AEAPI341

Scheduler

http://docs.oracle.com/cd/B28359_01/server.111/b28310/scheduse004.htm

Using an Applink to integrate Oracle Documents Cloud with a SaaS or on-premise application

$
0
0

 

Oracle Documents Cloud is an enterprise level file sync and share Cloud service that allows you to easily and securely share documents with members of your team. These Documents can be accessed using a browser or a smart phone. In this context, the people associated with the team are relatively static. The team is formed and exists for a longer period of time and collaborates around a number of activities on shared Folders and Files.

 

Documents Cloud

 

But there is another common use case for people to collaborate and share folders and files, not within the context of a team but within the context of an application and usually for a shorter period of time. The application can be an Oracle Cloud Saas service like Oracle Sales Cloud where a team would share documents relating to the sales opportunity for the duration of the sales opportunity. The file sharing and collaboration would only be within the context of the Sales Cloud service and the files would not be accessible directly from Documents Cloud.

It could also be an on-premise application like Oracle Siebel CRM or an insurance claims system where a group of people, the customer, a claims adjuster and a body shop work together to share documents to report, approve, and get a car that was involved in a collision repaired. Again the collaboration is done within the claims system and the documents can only be accessed through the claims system and not directly through Documents Cloud.

For this use case, the people working together in the context of the SaaS or on-premise application are authenticated and their access control is managed by the application.

Oracle Documents Cloud provides a rich set of REST API’s to allow you to easily integrate Documents Cloud with your application.

A Documents Cloud Service user is used to allow the application to connect to Documents Cloud on behalf of the Application users using credentials stored in a keystore. This service user will be the only user who can access the Documents Cloud folders and files belonging to the application.

The first time Documents Cloud is accessed in a specific context, the related folder in Documents Cloud can be created dynamically. In the sales Cloud example, a new sales opportunity can be created and, the first time the Documents Cloud folder associated with that opportunity is accessed, a new Documents Cloud folder can be created for that opportunity. The GUID for the newly created folder is then stored in the Application for that opportunity to be used to access the folder in the future.

Example of the REST code from the Doc needed to create a new folder:

POST .../folders/FF4729683CD68C1AFB1AE87DT0000000000100000001

Request

{
    "name": "Claim No 156234",
    "description": "Documentation for Claim No 156234
}

Response

{
    ...
    "id": "FB4CD874EF94CD2CC1B60B72T0000000000100000001",
    ...
    "parentID": "FF4729683CD68C1AFB1AE87DT0000000000100000001",
    "type": "folder"
}

When the application needs to surface the folder and files for the specific application context, the service user connects to Oracle Documents Cloud and requests a Applink for the associated GUID. The Applink returns a URL that gives temporary access to the Oracle Documents Cloud folder or document to the application user with the appropriate viewer, downloader or contributor access.

Example of the code from the Doc needed to create a temporary Applink to allow a user to access the folder:

POST ...applinks/folder/F3399E673E5B93B3774531E7T0000000000100000001

Request

{
    "assignedUser": "U0EAA20910FAF3052ACB79E4T00000000001"
}

JSON response

{
    "accessToken": "_qVnD42Et8KwZrBUqveiqn1sw-RLpfZQdIPPi_fd17-gt60FP6-IuCApyLFw32EL",
    "appLinkID": "LFwi1u1E9vZC_3pQhK5C4qxigAC4o1eUuMnv3dZbo6_OiaZx-yte-xIrxWdDJCA_jEgfVHe1At-26KX-M9mi9BaI7B0UX3Gx-QufREHWcHakby0_V9n8_C1pT7P_CKYlSqFU0rudQ8Q81M67-3fLffMA==",
    "appLinkUrl": "http://www.example.com/documents/embed/link/app/LFwi1u1E9vZC_3pQhK5C4qxigAC4o1eUuMnv3dZbo6_OiaZx-yte-xIrxWdDJCA_jEgfVHe1At-26KX-M9mi9BaI7B0UX3Gx-QufREHWcHakby0_V9n8_C1pT7P_CKYlSqFU0rudQ8Q81M67-3fLffMA==/folder/F3399E673E5B93B3774531E7T0000000000100000001",
    "errorCode": "0",
    "id": "F3399E673E5B93B3774531E7T0000000000100000001",
    "refreshToken": "ctOCKm4mtpayp__jUlQsfdFEd52vSn2Pd4QxOTcSZ1Wch0f9JP7EFSaXmDLKZdql",
    "role": "viewer",
    "type": "applink"
}

The embeddable URL can then be used to display the Documents Cloud Folder and related Documents in an iFrame.  Here is an example of a Documents Cloud Applink embedded within Siebel CRM.

Siebel CRM Documents Cloud

 

More information can be found in the the Oracle Documents Cloud Documentation

The Siebel CRM Documents Cloud integration mentioned above is described in this white paper

 

 

Implementing OAuth 2 with Oracle Access Manager OAuth Services (Part III)

$
0
0

Introduction

This post is part of a serie of posts about OAM’s OAuth implementation.

Other posts can be found here:

Part I – explains the proposed architecture and how to enable and configure OAM OAuth Services.

Part II – describes a Business to Business use-case (2-legged flow);

Part III  – deals with the Customer to Business use-case (3-legged flow), when the client code is running in the application server;

Part IV – describes the Customer to Business use-case (3-legged flow), when the client application runs on the browser, embedded as Javascript code;

Part V  – provides the source code and additional information for the use case implementation.

This post will cover the C2B (Customer to Business) Use Case, when the Client Application is running on the Server.

In this case, an end user accesses an Application, which needs to fetch data from a Resource Server in behalf of the end user, but without the end user providing his credentials to the Application.

The user has to provide his consent for the client application to access his resources in the Resource Server.

In this use case, all the code resides in the server and it is not visible to the end user.

Use Case Flow

The following picture shows the flow between the different components

C2B1

 

1. A User Agent, usually a browser, accesses the Application, starting the OAuth flow.

2. The Application detects that the user have not presented an Authorization Code, then it redirects the user to the OAM/OAuth authorization URL.

The redirect is a standard HTTP browser redirect that looks like this:

https://oxygen.mycompany.com:14101/ms_oauth/oauth2/endpoints/oauthservice/authorize?client_id=customerClient&response_type=code&redirect_uri=https://oxygen.mycompany.com:7502/ClientWebApp/CustomerClient&scope=Customer.Info%20UserProfile.me

Some things to note here:

The Application identifies itself with its ID, client_id=customerClient;

The expected response type is the authorization code, response_type=code;

The redirect URI, to where the OAuth server will redirect the request with the authorization code as URL parameter after the user successfully logs in;
And lastly the requested Scope, Customer.Info and UserProfile.me

In this step the OAuth server checks if the requesting client is correctly registered, if it has the correct grant type enabled, in this case Authorization Code, if the redirect_uri is matches the one defined in the client configuration and if it is requesting a scope allowed for this client.

If the conditions above are not met, the OAuth server send and error back and does not proceed to the user authentication.

3. OAuth Server redirects the user to OAM Login Page.

4. User logs in with his credentials.

5. Since the user has started an OAuth flow in step 1, the OAuth server needs the user consent to provide a token to this application which will be used to access the user resource on the Resource Server.

6. OAuth server redirects the user to the consent page so the user can consent or reject the Application access to his resources.

The consent page looks like this:

C2B2

7. The user grants access to the CustomerClient Application

8. The OAuth server returns the Authorization Code the the URI defined in the redirect_uri as an URL parameter.

The response looks like this:

https://oxygen.mycompany.com:7502/ClientWebApp/CustomerClient?code=eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCIsImtpZCI6Im9yYWtleSJ9.eyJvcmFjbGUub2F1dGgucmVkaXJlY3QtdXJpIjoiaHR0cHM6Ly9veHlnZW4ubXljb21wYW55LmNvbTo3NTAyL0NsaWVudFdlYkFwcC9DdXN0b21lclNlcnZsZXQiLCJvcmFjbGUub2F1dGgudXNlcl9vcmlnaW5faWRfdHlwZSI6IkxEQVBfVUlEIiwib3JhY2xlLm9hdXRoLnVzZXJfb3JpZ2luX2lkIjoicGF1bG8iLCJpc3MiOiJ3d3cub3JhY2xlLmV4YW1wbGUuY29tIiwib3JhY2xlLm9hdXRoLnN2Y19wX24iOiJPQXV0aFNlcnZpY2VQcm9maWxlIiwiaWF0IjoxNDMxMTAyNjIyMDAwLCJvcmFjbGUub2F1dGgudGtfY29udGV4dCI6ImF6YyIsImV4cCI6MTQzMTEwMzUyMjAwMCwicHJuIjpudWxsLCJqdGkiOiI2OTkwNDRlZi0zM2IwLTRhNDUtYjI4MS1jYTNjMTc2NzhkNTciLCJvcmFjbGUub2F1dGguY2xpZW50X29yaWdpbl9pZCI6ImN1c3RvbWVyQ2xpZW50Iiwib3JhY2xlLm9hdXRoLnNjb3BlIjoiQ3VzdG9tZXIuSW5mbyIsInVzZXIudGVuYW50Lm5hbWUiOiJEZWZhdWx0RG9tYWluIiwib3JhY2xlLm9hdXRoLmlkX2RfaWQiOiIxMjM0NTY3OC0xMjM0LTEyMzQtMTIzNC0xMjM0NTY3ODkwMTIifQ.Y7fyCqKR6eY95SET9ddXmpCa8acLWSYoRCsZUqMadZ-eUA6GV11zfHJKUUdTcLER3TxjVb8NXLV9Hl_aTFPPxqcf6rVW_yxKrWpW6m18cDeZsmln015AZjJNdGzxrYtOBrrMuLAA58hk1h2CDplagOTDhypT_rAJGD6uDgmRrMM&state=abc

9. The Application then is able to extract the Authorization Code from the URL parameter and request the OAuth Server for an Access Token. The request would look like this in curl:

curl -i -H ‘Authorization: Basic YnJvd3NlckNsaWVudDpnOGFHZ2xaRHJQRGw3ZQ==’ -H “Content-Type: application/x-www-form-urlencoded;charset=UTF-8″ –request POST https://oxygen.mycompany.com:14101/ms_oauth/oauth2/endpoints/oauthservice/tokens -d ‘redirect_uri=https://oxygen.mycompany.com:7502/ClientWebApp/CustomerServlet&grant_type=authorization_code&code=eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCIsImtpZCI6Im9yYWtleSJ9.eyJvcmFjbGUub2F1dGgucmVkaXJlY3QtdXJpIjoiaHR0cHM6Ly9veHlnZW4ubXljb21wYW55LmNvbTo3NTAyL0NsaWVudFdlYkFwcC9DdXN0b21lclNlcnZsZXQiLCJvcmFjbGUub2F1dGgudXNlcl9vcmlnaW5faWRfdHlwZSI6IkxEQVBfVUlEIiwib3JhY2xlLm9hdXRoLnVzZXJfb3JpZ2luX2lkIjoicGF1bG8iLCJpc3MiOiJ3d3cub3JhY2xlLmV4YW1wbGUuY29tIiwib3JhY2xlLm9hdXRoLnN2Y19wX24iOiJPQXV0aFNlcnZpY2VQcm9maWxlIiwiaWF0IjoxNDMxMTAyNjIyMDAwLCJvcmFjbGUub2F1dGgudGtfY29udGV4dCI6ImF6YyIsImV4cCI6MTQzMTEwMzUyMjAwMCwicHJuIjpudWxsLCJqdGkiOiI2OTkwNDRlZi0zM2IwLTRhNDUtYjI4MS1jYTNjMTc2NzhkNTciLCJvcmFjbGUub2F1dGguY2xpZW50X29yaWdpbl9pZCI6ImN1c3RvbWVyQ2xpZW50Iiwib3JhY2xlLm9hdXRoLnNjb3BlIjoiQ3VzdG9tZXIuSW5mbyIsInVzZXIudGVuYW50Lm5hbWUiOiJEZWZhdWx0RG9tYWluIiwib3JhY2xlLm9hdXRoLmlkX2RfaWQiOiIxMjM0NTY3OC0xMjM0LTEyMzQtMTIzNC0xMjM0NTY3ODkwMTIifQ.Y7fyCqKR6eY95SET9ddXmpCa8acLWSYoRCsZUqMadZ-eUA6GV11zfHJKUUdTcLER3TxjVb8NXLV9Hl_aTFPPxqcf6rVW_yxKrWpW6m18cDeZsmln015AZjJNdGzxrYtOBrrMuLAA58hk1h2CDplagOTDhypT_rAJGD6uDgmRrMM’ -k

Note that the Application passes its credentials enconded as 64Base in the Authorization header, the redirect URI, the grant type and the Authorization Code.

10. The OAuth Server checks the Authorization Code, if the grant type is enabled for this client and if its credentials are correct before issuing the Access Token.

11. OAuth Server send the Access Token back to the Application in the following format:

{“expires_in”:3600,”token_type”:”Bearer”,”access_token”:”eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCIsImtpZCI6Im9yYWtleSJ9.eyJzdWIiOiJwYXVsbyIsIm9yYWNsZS5vYXV0aC51c2VyX29yaWdpbl9pZF90eXBlIjoiTERBUF9VSUQiLCJvcmFjbGUub2F1dGgudXNlcl9vcmlnaW5faWQiOiJwYXVsbyIsImlzcyI6Ind3dy5vcmFjbGUuZXhhbXBsZS5jb20iLCJvcmFjbGUub2F1dGguc3ZjX3BfbiI6Ik9BdXRoU2VydmljZVByb2ZpbGUiLCJpYXQiOjE0MzExMDM5OTgwMDAsIm9yYWNsZS5vYXV0aC5wcm4uaWRfdHlwZSI6IkxEQVBfVUlEIiwib3JhY2xlLm9hdXRoLnRrX2NvbnRleHQiOiJyZXNvdXJjZV9hY2Nlc3NfdGsiLCJleHAiOjE0MzExMDc1OTgwMDAsInBybiI6InBhdWxvIiwianRpIjoiMjQ4YjAyOTgtNWQ1Yy00ZjFkLTkzNjctZTgyYTcwY2ZiOTk5Iiwib3JhY2xlLm9hdXRoLmNsaWVudF9vcmlnaW5faWQiOiJjdXN0b21lckNsaWVudCIsIm9yYWNsZS5vYXV0aC5zY29wZSI6IkN1c3RvbWVyLkluZm8iLCJ1c2VyLnRlbmFudC5uYW1lIjoiRGVmYXVsdERvbWFpbiIsIm9yYWNsZS5vYXV0aC5pZF9kX2lkIjoiMTIzNDU2NzgtMTIzNC0xMjM0LTEyMzQtMTIzNDU2Nzg5MDEyIn0.M-OFxBY6XzPRfW295tikNl2rj_M7IqPO1RUOLoj2IyHkcYRxRlFd0kc7le4eAK0oxYSrhhNNbwrzEq25fAdDF9H8nWeMXRec69WRyDi53-BdCB8NPgrYyVcsYVcS5l5XKieMBM7Mnl0AVb3oZ77N0sRQCWkJn2S-wgYoGjHcOOE”}

12. The application is able now to make a call to a remote service – The Resource Server – using the Access Token.

13. As in the same case of the B2B, the Resource Server is another OAuth client, with the particularity that is does not have any grant or scope defined to it.

It just needs to validate the token passed by remote clients. The only detail here is that this client needs to have the option to “Allow Token Attributes Retrieval” enabled, if it wants to perform Token Introspection, that is, return additional values, rather than just receiving a “valid” status from the OAuth Server.

14. The OAuth Server validates the Token and returns additional attributes.

The validation would look like this:

{“successful”:true,”oracle_token_attrs_retrieval”:{“oracle.oauth.tk_context”:”resource_access_tk”,”exp”:1431108481000,”oracle.oauth.user_origin_id_type”:”LDAP_UID”,”oracle.oauth.user_origin_id”:”paulo”,”iss”:”www.oracle.example.com”,”prn”:”paulo”,”oracle.oauth.client_origin_id”:”customerClient”,”oracle.oauth.scope”:”Customer.Info”,”jti”:”78fc3b08-b12a-4fbc-bad8-a7e5b7041332″,”oracle.oauth.svc_p_n”:”OAuthServiceProfile”,”iat”:1431104881000,”oracle.oauth.id_d_id”:”12345678-1234-1234-1234-123456789012″}}

Note that the token, in a C2B use case, represents both the OAuth client (“oracle.oauth.client_origin_id”:”customerClient”) and the end user (“prn”:”paulo”).

15. The Resource Server returns the requested resource to the Client Application

16. The Client Application presents the results to the user agent.

 

C2B Use Case Implementation

To implement the C2B use case, a standard Java Servlet will be used, CustomerClient.java, that is very similar with the B2B use case, but it requires the user consent to allow the client application to access the user resources in its behalf.

This servlet, will obtain an Authorization Token, result of the end user authentication.

If this Servlet is protected by a OAM policy, and the user has already authenticated, the redirect to the authorization end point will provide the authentication token without the user having to login again.

With the Authorizaition Token, the Servlet can obtain and Access Token using the Authorization Code grant type, and will pass this Access Token to the Resource Server, when making the call to the Customer REST endpoint.

The Resource Service is implemented in a plain Java class using the Jersey framework to expose the Customer Service as a RESTful webservice.

The Resource Server also implements a Servlet Filter, that intercepts all incoming requests to validate the incoming Access Token before giving access to the REST Endpoint.

The relevant classes for this use case are:

  • CustomerClient.java
  • TokenProxyService.java
  • CustomerService.java
  • OAuthTokenValidationFilter.java
  • OAuthTokenValidator.java

Simplified Role Hierarchy in R10

$
0
0

Introduction

Our teammate Jack Desai published an article last year about Fusion Application Roles Concept. It gives you a great overview about the design to grant access to certain functionalities to specific users. His article familiarizes you with the concepts of Abstract Roles, Duty Roles, Job Roles or Data Roles and how they are used in a Role Based Access (RBAC) model in Fusion Applications.

Starting with the current Fusion Apps Release 10 further improvements in the role concept have been implemented resulting in flatter role hierarchies. More detailed information about the Simplified Reference Roles Models can be found in Oracle Support DocId 2016990.1.

The following article below will give a short introduction and overview about the changes and perform a brief comparison of features between role hierarchies in R10 and pre-R10.

Role Hierarchy Changes in R10

As shown in the drawing below the main change is a simplification of complex structures in pre-R10 releases. For this purpose the old Duty Roles have been deprecated and replaced by newer versions with different and leaner assignments. These assignments can be other roles or even privileges. The previous model sometimes had many Duty Roles assigned to Job Roles. As a result creating custom Job Roles could become a challenge.

1_Overview_Slide_Role_Model_1

By introducing a simplified reference model the following benefits were achieved in R10:

  • New model provides a clean reference
  • For customers not using any customized roles the new features have been seamlessly activated, so customers won’t even notice these changes as the new features were installed during the R10 upgrade or provisioning process.
  • For Oracle Applications Cloud some new capabilities have been implemented to allow new features in an isolated model
  • Last but not least with R10 we’re having a reduced number of roles compared to the role model pre-R10

The most visible aspect of the Release 10 simplification is the introduction of an Application Job Role and a reduced number of duty roles when compared to the role model in the previous release. Also worth to mention is that newly created Application Role Names start with a prefix “ORA_”.

2_Overview_Slide_Role_Model_2

As shown in figure above these changes in R10 include also an evolutionary process of modifications in terms of privilege assignments to duty and/or application roles. However the new role reference model doesn’t necessarily affect the setup details of these privileges (i.e. Entitlements, Resources etc). If there are changes for privileges in R10, theses might have been caused by functional and technical requirements in Fusion Application. Almost obvious to say that these changes in R10 are valid for entire Fusion Applications and work the same way for on-premise and Oracle Cloud instances.

Comparison of sample roles Pre-R10 vs R10

When comparing the both role models we should start with the similarities between pre-R10 and R10 role models as they are:

  • The set of privileges to control assignment of features or functionality is the same in both role models
  • In case of using an existing privilege that Oracle Application Cloud has modified to improve existing functionality, then both models benefit from the improvement.
  • The duty roles are organized by application sources (i.e. Product Pillars), such as Customer Relationship Management (CRM), Human Capital Management (HCM) and Financial Supply Chain Management (FSCM) in both role models.

As mentioned above the main differences are the hierarchical organization of roles under the Enterprise Job Role level. The figure below illustrates these changes for the sample of Sales Enterprise Job Role:

  • Every Duty Role named “Sales Representative Duty” in pre-R10 is an individual implementation per Application Source like CRM, FSCM etc
  • It is also possible to assign different duty roles in the context of an Application Source to the Enterprise Job Role

As shown in our sample below the Sales Representative Duty role exists for various application sources and could give the impression they refer to the same role as they are sharing almost the same display name in pre-R10 releases. In reality these are different roles! For instance the Sales Representative Duty role for CRM can be found under a role name ZBS_ENT_SALES_REPRESENTATIVE_DUTY while the role with same display name exists in HCM with the name ZBS_ENT_SALES_REPRESENTATIVE_DUTY_HCM.

In R10 we see that there are also Sales Representative roles assigned to Sales Representative Enterprise Role, but we notice the following differences:

  • The suffix “Duty” as part of the displayed name is gone as these are Application Job Roles assigned at top level now
  • All these same visible names refer also to the same role ORA_ZBS_SALES_REPRESENTATIVE_JOB
  • As mentioned above the internal names of these new roles start with a prefix “ORA” and can be easily identified as a new role by its name
  • By the suffix “JOB” these roles can be identified as an Application Job Role while Duty Roles are registered with a suffix “DUTY”

3_Overview_Slide_Role_Model_3

As said the Application Job Role with the display name “Sales Representative” refer to the same role with name ORA_ZBS_SALES_REPRESENTATIVE_JOB across all Application Sources. Furthermore the usage of Role Categories has been introduced. These role category assignments put roles into a dedicated context and can be used for isolation in Cloud. In our sample the “Sales Representative” role is assigned to a Role Category named “CRM_ENTERPRISE_DUTY”. The Application Role Hierarchy might differ for roles with same names (like “Sales Representative”) across the various Application Sources. For instance the “Sales Representative” role for HCM has the following Application Role Hierarchy assigned :

  • “Sales Party Management” (ORA_ZCM_SALES_PARTY_MANAGEMENT_DUTY_HCM)

The same Application Job Role for FSCM contains a different Application Role Hierarchy used in that specific application context:

  • “Sales Party Management” (ORA_ZCM_SALES_PARTY_MANAGEMENT_DUTY_FSCM)
  • “Sales Party Review” (ORA_ZCM_SALES_PARTY_REVIEW_DUTY_FSCM)

For a better illustration of differences between these both role models pre-R10 vs R10 sample screenshots of Fusion Apps Authorization Policy Management (APM) are shown below.

4_Channel_Account_Manager_ExtRole_GeneralTab_R10

Starting point is the External Role “Channel Account Manager” in a pre-R10 instance with the internal name ZPM_CHANNEL_ACCOUNT_MANAGER_JOB as shown above. The screenshot below highlights the Application Role Mapping with various different Duty Roles assigned.

5_Channel_Account_Manager_ExtRole_AppRoleMapping_old

In R10 this External Role is unchanged (means: same name) but Application Role Mapping is different as shown in screenshot below. As mentioned previously there are Application Job Roles assigned in R10. Only a few duty roles for OBI are reused for technical reasons to provide continuity for some features. These are roles used by internal systems, such as role codes that end with _PRIV_OBI, which are used to secure reports. These roles don’t have the ORA_ prefix in the role code. You must never modify these roles.

6_Channel_Account_Manager_ExtRole_AppRoleMapping_R10

In pre-R10 releases Duty Roles had the term “DUTY” included in internal name and also in display name (see screenshot below).

7_Channel_Account_Manager_AppRole_GeneralTab_old

This role setup changes in R10 (below) as the prefix ORA has been added for newly created roles. As screenshot below indicates, the term JOB is added as suffix for Application Job Roles.

8_Channel_Account_Manager_AppRole_GeneralTab_R10

Another new feature is the assignment of Job and Duty Roles to specific Role Categories as shown below. The existing assignment is not to be changed by an user for standard roles.

9_Role_Categorization_Usage_R10

As shown in the screenshot below the pre-R10 Duty Role has a dedicated layout in Application Role Hierarchy

10_Channel_Account_Manager_AppRole_ItemInquiry_old

In R10 the Application Role Hierarchy looks different as it has been reworked and flattened.

11_Channel_Account_Manager_AppRole_ItemInquiry_R10

Duty Roles in R10 follow the name scheme with ORA as prefix and DUTY as suffix as shown below.

13_Item_Inquiry_General_R10

Policies assigned to these Duty Roles in R10 might be the same as those in pre-R10. Any changes between releases will have been caused by functional or technical requirements in various Application Sources during release changes (being done automatically when upgrading a certain release).

14_Item_Inquiry_Duty_Policies_Overview_R10

Screenshot below shows the detailed privileges (Entitlements) at the lowest level to grant access to pages, page flows, data or interfaces (all of then are called “Resources”). As said these structures are not affected in R10 by switching to a simplified role reference.

15_ViewItem_Entitlement_R10

Upgrade of role customization in R10

In case any custom job roles have been created in pre-R10 instances a migration to the simplified reference role model is necessary. As shown in the figure below the links to old duty roles must be removed and another link to the according Application Job Role in R10 created. Detailed instructions can be found in various documents under Oracle Support DocID 2016990.1.

16_Overview_Slide_Role_Model_2

Conclusion

This post provides an introduction to recent changes in the Role Model in R10. It is supposed to be seen in the context of the previous post about RBAC in Fusion Applications. Some more changes have been seen in R10 for security related topics and more posts on this site will follow to cover those.

PaaS – Database as a Service

$
0
0

PaaS – Developer Cloud Service


SaaS – Human Capital Management

$
0
0
  • Human Capital Management
  • Global Human Resources
  • Talent Management
  • SaaS – Human Capital Management – Global Human Resources

    SaaS – Human Capital Management – Talent Management

    SaaS – Supply Chain Management – Product Value Chain

    SaaS – Supply Chain Management – Transportation and Global Trade Management

    SaaS – Supply Chain Management

    $
    0
    0
  • Supply Chain Management
  • Inventory and Costing
  • Product Value Chain
  • Transportation and Global Trade Management
  • SaaS – Enterprise Resource Planning

    $
    0
    0
  • Enterprise Resource Planning
  • Accounting Hub Reporting
  • Financials
  • Procurement
  • Project Financial Management
  • Project Management
  • Revenue Management

  • SaaS – Enterprise Resource Planning – Project Financial Management

    SaaS – Enterprise Resource Planning – Procurement

    SaaS – Enterprise Resource Planning – Project Management

    SaaS – Enterprise Resource Planning – Accounting Hub Reporting

    SaaS – Enterprise Resource Plannings – Revenue Management

    Viewing all 987 articles
    Browse latest View live