The connection is made through PeopleSoft's Component Interface. This results in a full load of relevant identity and account data into Oracle Access Governance each time the load is executed. If this is the first time that the load is made, then relevant identity and account structures are created in Oracle Access Governance as appropriate. On subsequent dataload runs, all data is loaded to Oracle Access Governance and the ingestion process updates any changes since the last dataload in the appropriate identity and account artefacts.

Once the connection and Day0 dataload are completed, you can provision accounts using Oracle Access Governance's provisioning engine which will take any provisioning request and pass it through the agent and onwards to PeopleSoft. Provisioning supports create, update, and revoke operations.

Configure PeopleSoft Orchestrated System

Load Data

Once you have setup and verified your Orchestrated System, you can run dataloads to ingest identity and account details from PeopleSoft, depending on the configuration mode you have selected, Authoritative Source or Managed System.

Data loaded in Authoritative Source mode will consist of user data from the PeopleSoft system. If the user is new, then a new identity is created in Oracle Access Governance. If the identity already exists in Oracle Access Governance, then any updates initiated in the PeopleSoft system will be applied.

Data loaded in Managed System mode comprises account data and roles from PeopleSoft. If the account is new, then a new account is created in Oracle Access Governance together with the associated roles, These roles will be created in Oracle Access Governance as permissions. Accounts and permissions loaded from PeopleSoft can be managed by Oracle Access Governance. You can remediate permissions associated with a managed system account. If the account only has one permission assigned then remediation of this permission will also result in the revoking of the account.

Create Account

For further details about account creation, refer to Request Access.

Assign Permissions

You can assign permissions to a PeopleSoft account using the Request a new access functionality of Oracle Access Governance. This allows you to request an access bundle containing permissions which equate to roles on the PeopleSoft system. When you request an access bundle, either directly or through an Oracle Access Governance role or policy, a provisioning operation is initiated which updates the roles in your PeopleSoft instance with the permissions included in the referenced access bundle.

For further details about permission assignment, refer to Request Access. To learn more about roles and policies, refer to Manage Roles, and Manage Policies.

Remove Permissions

You can remove permissions from an account by revoking the permissions from the role, policy or access bundle to which it is assigned. In this case, the permission assignment is revoked from all users to whom the role, policy or access bundle is applied. Say you had an access bundle with two permissions, PSFT_Admin, and PSFT_Developer which had previously been provisioned to PeopleSoft, you could update the access bundle containing these permissions to remove PSFT_Developer and add PSFT_Composer, resulting in the access bundle containing PSFT_admin, and PSFT_Composer. This change would be reflected following the next provisioning operation by removing the PSFT_Developer role and assigning the PSFT_Composer role. PSFT_Admin would remain assigned.

Another way to remove a permission would be by revoking role, policy or access bundle assignment from a specific account. This would be done using the revoke operation in access reviews.

For further details about permission assignment, refer to Delete a Role, Delete a Policy, or Manage Access Bundles -> Delete an Access Bundle.

Change Password

The ability to change an account password is provided by the My Access functionality in Oracle Access Governance Console. If you change the account password in this page, the details will be sent to the PeopleSoft instance in the next provisioning operation, and the password change is applied you your PeopleSoft account.

For further details about changing passwords, refer to Change Account Password.

Revoke Account

If you select to revoke an account within an access review, provisioning tasks will be created to revoke the account within PeopleSoft. For further details about revoking accounts, refer to Delete a Role, or Delete a Policy.

An Example Account Lifecycle

After some time MyAGIdentity moves into a development role requiring the PeopleSoft developer role. An access bundle PSFTBundle_Developer is created in Oracle Access Governance which contains the development permissions required. This access bundle can be assigned as a result of a policy, role or request. Let's say the user requests the access bundle using the Request a new access option. On approval, the request triggers a provisioning operation which applies the changes to MyPSFT, assigning the PeopleSoft roles corresponding to the permissions contained in PSFTBundle_Developer access bundle.

MyAGIdentity then decides to change his password. Using the My Access functionality in Oracle Access Governance Console, he changes his password, which propagates the change to MyPSFT using Oracle Access Governance provisioning.

If the PeopleSoft Orchestrated System is configured in Authoritative Source mode and you make an identity inactive then the the MyAGIdentity identity, is effectively disabled. In this case a provisioning task will be generated and provisiong to the Managed System.