HCM/ERP Cloud Release 12 - Security Console

Oracle Cloud Applications Release 12 included many new areas of functionality.  One in particular has had a major impact (positive) on those of us who implement the product for our customers.   This feature is called the  "Security Console".

Since the earliest releases of Oracle Cloud, the security has been managed by the Fusion Middleware products Oracle Identity Manager (OIM) and Oracle Authorization Policy Manager (APM).  Whilst extremely powerful tools for managing user accounts and role based access, the tools required a level of knowledge beyond standard application configuration.  They were also displayed through a separate UI to the main applications and configuration of security rules involved using multiple screens and UIs.

Leading up to Release 12, Oracle have done a lot of work to transition onto a tool called the "Security Console".  This tool is embedded in the application and is intended as a "one-stop shop" for security configuration.   By Release 12, this transition is virtually complete.

Now, the Security Console allows us to see the holistic view of all aspects of functional and data security using a visual tool.   We can focus on parts of the security configuration and drill down towards detailed privileges or up towards users.  The Security Console includes functionality to copy roles and create custom versions, to add/remove functional data data privileges and to view detailed analytics about roles and role usage.

This image shows a typical view of roles in the Security Console, complete with colour coding to indicate what type of role each role is (seeded or custom), and to distinguish between roles, privileges and users.



It has simplified the management of users and roles into a single UI and is a great advance for implementors and system administrators alike.

Fusion HCM Release 9

Over the last few weeks, I've been fortunate to have been a part of the Early Adopters programme for Fusion Applications Release 9.

This has enabled me to take a sneak preview at some of the new functionality which is being releases as part of R9.

The main area of new functionality which has caught my eye is the Security Console.  This allows you to manage roles from within Fusion HCM rather than having to navigate the somewhat convoluted screens of OIM and APM.

The Security Console is navigated to via the Simplified User Interface (SUI).  It's the only way of getting there.  Is this symptomatic of the way Oracle is going with the Fusion UIs?  Soon, will the SUI be the only way in?

The security console will allow you to view the current setup and hierarchy of Job Role, Duty Roles and Privileges.  It will also allow you to copy roles.  This is going to be a huge time saver.

I'm going to be looking at this in more detail in a later blog post.  But for now, Happy Christmas and I wish all my readers a prosperous New Year!

Lessons from Fusion HCM Implementations

At this years OHUG conference we had the opportunity to hear from some organizations who have been through the Fusion HCM implementation process.  These may still be few and far between, but their experiences are really useful for those of us currently involved in implementations.

This blog entry summarises a number of those experiences.

The HR2HR process for maintaining data synchronization between the 'system of record' and the Fusion Apps co-existence environment is now being replaced by File Based Loaders (FBL).  FBL is a much more flexible solution which allows data to be mapped from any system, not just EBS or PeopleSoft.  FBL deals with a wider range of fields than HR2HR did, but still has some shortcomnings - extensible flexfields, for example, are not catered for.

Some people have implemented compensation management.  This seems to be a very robust product, but there are some methods you need to follow to get the best results.  For example, compensation allocation worksheets can contain calculated fields - make sure that any dynamic calls are done in the right sequence to ensure the calculations are correct.  Monetary fields must be defined as 'monetary' otherwise exchange conversions will not work.  If values are global, write a global fast formula because default values can only be managed by one fast formula.

Many organizations who had implemented emphasized the need to be realistic on timescales.  They recommended limiting the scope and implementing in phases - walking before you run.  Also, don't be afraid of pulling the plug on functionality that doesn't work well.  In the long term this will save time.

The question of 'Read Only' roles came up frequently.  This is a common requirement, but there is no out of the box role whichdelivers this functionality.  Much debate has been had as to whether you can or can't do this and different ways to 'work round' the issue.  We know you can create read-only roles, but it's complicated. 

Things to watch out for:

Seeded roles have lots of functions you probably won't want.  If you create custom roles these will need to be monitored carefully when patches and upgrades are applied.  Oracle may well change the underlying roles and privileges you based your custom roles on.

Transfers between legal entities in the same country can be problematic. 

Be cautious about the number of RDS you have.  The more you have, the bigger the maintenance overhead.

Pending worker functionality was introduced to fill the gap when there was no Fusion recruitment solution.  In the future this will be filled by Taleo integration.  But in the meantime, there are gaps in the pending worker functionality - e.g. salary is not carried forward into the hire.

OTBI is great when using a single folder, but there are problems if you try to create reports from multiple folders.  Remember, BIP is available and is a good solution for more complex reports.

Workflow notifications can be controlled via FSM and BPM, but the content is fairly locked down - you can't change the wording.  Also, many people reported workflow notifications as being 'buggy'.  Recommendation is to test notifications early in the cycle.

FBL was seen as a useful loading tool.  But, the business rules (validation) doesn't always work the same as the application.

Some key issues which were identified at upgrade time:

Watch out for approval rules changing!

Pages change, so make sure you check your personalizations work.  Take screen shots of personalised pages before an upgrade so you have a reference back to the original.

Keep a note of patches applied.  Sometimes these patches are not available after upgrades.

Role Based Access - Useful Info

As part of my job, I need to keep abreast of developments in Fusion Applications.  Consequently, I do a lot of research into articles published by consultants, users and Oracle. 

I recently came across a couple of useful articles published in Oracle's 'My Oracle Support' (the support site previously known as MetaLink).  They relate to Role Based Access Control (RBAC), which underpins the security of all Fusion Applications.

Fusion Applications 'out of the box ' includes a reference implementation of RBAC consisting of  hundreds of Job Roles across its product families. Every Job Role comprises a series of privileges called Duty Roles.  These Duty Roles grant access to Applications functionality. 

At the beginning of any Fusion Applications implementation, there will be a task to analyse the predefined Job Roles and map them to roles which are relevant to their own enterprise.  Whilst Oracle recommends that the out of the box Roles are sufficient for most scenarios, as implementation consultants and customers become more familiar with the product, there will increasingly be a case for creating your own Roles and Privileges.

Oracle has recently released two spreadsheets showing the relationships between Roles, Duty Roles and Privileges; and a cross reference of top-level menus (on the navigator) to Duty Roles.

For in formation on these spreadsheets, see MOS articles 1460486.1 and 1459828.1

Back to the research.....