Certified Components in Authoritative Source Configuration Mode

Certified Components in Managed System Configuration Mode

Certified Components in both Modes

1. Log in to the Oracle database as a database administrator using SQL*Plus or similar. Create a service account using the following statements:

   create user <DBService Schema user account name> identified by <password>;
   grant create session to <DBService Schema user account name>;
   grant create synonym to <DBService Schema user account name>;
   grant create view to <DBService Schema user account name>;

   For example:

   create user psftagsvc identified by mypw;
   grant create session to psftagsvc;
   grant create synonym to psftagsvc;
   grant create view to psftagsvc;

2. Grant permission to PeopleSoft schema components to the service account you created, where <PSFT> is the name of the PeopleSoft schema for your environment:

   grant select on <PSFT>.PSOPRDEFN to <DBService Schema user account name>;
   grant select on <PSFT>.PSROLEDEFN_SRCH to <DBService Schema user account name>;
   grant select on  <PSFT>.PSCLASSDEFN to <DBService Schema user account name>;
   grant select on  <PSFT>.PS_CURRENCY_CD_TBL to <DBService Schema user account name>;
   grant select on  <PSFT>.PS_PERSONAL_DATA to <DBService Schema user account name>;
   grant select on  <PSFT>.PS_PERSONAL_PHONE to <DBService Schema user account name>;
   grant select on  <PSFT>.PS_EMAIL_ADDRESSES to <DBService Schema user account name>;
   grant select on  <PSFT>.PS_JOB to <DBService Schema user account name>;
   grant select on  <PSFT>.PS_JOBCODE_TBL to <DBService Schema user account name>;
   grant select on  <PSFT>.PS_LOCATION_TBL to <DBService Schema user account name>;

3. Logout of the database and reconnect as the service account you created. Create synonyms for the schema components you granted access for:

   create synonym PSOPRDEFN for <PSFT>.PSOPRDEFN;
   create synonym PSROLEDEFN_SRCH for <PSFT>.PSROLEDEFN_SRCH;
   create synonym PSCLASSDEFN for <PSFT>.PSCLASSDEFN;
   create synonym CURRENCY_CD_TBL for <PSFT>.PS_CURRENCY_CD_TBL;
   create synonym PS_PERSONAL_DATA for <PSFT>.PS_PERSONAL_DATA;
   create synonym PS_PERSONAL_PHONE for <PSFT>.PS_PERSONAL_PHONE;
   create synonym PS_EMAIL_ADDRESSES for <PSFT>.PS_EMAIL_ADDRESSES;
   create synonym PS_JOB for <PSFT>.PS_JOB;
   create synonym PS_JOBCODE_TBL for <PSFT>.PS_JOBCODE_TBL;
   create synonym <PSFT>.PS_LOCATION_TBL for <PSFT>.PS_JOBCODE_TBL;

4. Remain connected as the service account and create views to allow Oracle Access Governance to retrieve employee and person of interest (POI) information. There are two views, Job_data_view.sql for job data, and Personal_data_view.sql for personal data. These support the following features:
   • Enables reconciliation of employee data, including those employees who do not have a user profile in PeopleSoft.
   • Enables reconciliation of persons of interest (POI) such as contractors, where no PeopleSoft user profile is present.
   • Supports attributes such as multiple job profiles, and manager department hierarchy.
   • Allows for complex customizations when applying transformations during attribute reconciliation, such as having different attributes for employees versus POIs.

   You can download the latest version of these scripts from GitHub at https://github.com/oracle/docker-images/tree/main/OracleIdentityGovernance/samples/scripts/PEOPLESOFT/1.0.

   Note:

   If you have used a previous version of Oracle Access Governance where these views have not been created then you will see an error on the next data load. To rectify this, create the views as described and resubmit your data load.

   Note:

   Where a select field is set to null, you are able to substitute this with a value of your choice, allowing for customization of the view results.

You can create a service user to connect to the PeopleSoft application with, by executing the following steps.

1. Invoke the Peoplesoft PIA Web interface in a browser and navigate to Permission Lists.

   People Tools → Security → Permission Lists

2. Add a new value: AGCS_PERMLIST
3. In the permission list add and assign access to the following Component Interfaces according to the values given in the table:

   Table - Component Interface Permissions

   Component Interface	Method	Method Access
   USER_PROFILE
   	Cancel	Full Access
   	Get	Full Access
   	Create	Full Access
   	Save	Full Access
   	ResetPassword	Full Access
   	ResetPassword_Alpha	Full Access
   	SetPassword	Full Access
   	SetDescription	Full Access
   DELETE_USER_PROFILE
   	Cancel	Full Access
   	Find	Full Access
   	Get	Full Access
   	Save	Full Access
   ROLE_MAINT
   	Cancel	Full Access
   	Find	Full Access
   	Get	Full Access
   	Create	No Access
   	Save	No Access
   CURRENCY
   	Cancel	Full Access
   	Find	Full Access
   	Get	Full Access
   	Create	No Access
   	Save	No Access
   CI_PERM_LIST
   	Cancel	Full Access
   	Find	Full Access
   	Get	Full Access
   	Create	No Access
   	Save	No Access

4. Navigate to Roles.

   People Tools → Security → Roles

5. Add a new value: AGCS_ROLE
6. Add AGCS_PERMLIST to the Permission List.
7. Navigate to User Profile

   People Tools → Security → User Profiles → User Profile

8. Add a new value: AGCSSA
   • Add Symbolic ID as SYSADM1.
   • Set and confirm the password.
   • Set ID Type as NONE.
   • From Roles, select AGCS_ROLE.
   • Save your changes.

Supported Modes

PeopleSoft Orchestrated System supports the following modes:

• Authoritative Source

  You can use PeopleSoft HRMS as an authoritative (trusted) source of identity information for Oracle Access Governance.

• Managed System

  You can manage PeopleTools-based PSOPRDEFN user profile records in PeopleSoft applications including Role and Permission List assignments to these records.

The default matching rule for PeopleSoft orchestrated system is: