Oracle Fusion Security Context

[gregorycarlson]

I've found previous posts on this topic, but I've not seen an answer.

For some Job Roles in Oracle Fusion, we also require a Security Context to control data access. So, for example, you might have the "Buyer" role but only for a specific Business Unit security context.

The Fusion integration in Saviynt only seems to support the "Job Role" entitlement type (e.g. Buyer). Has anybody extended this to add Security Context as a dependent entitlement for the roles which need it?

Apparently there is an API for Security Context - so it seems feasible. REST API for Oracle Fusion Cloud Risk Management - Get security context list

In my prior experience with SAP Security, the use of "enabler" roles/entitlements were used to assign the data access - examples of Security Context:

https://docs.oracle.com/en/cloud/saas/applications-common/23c/facsa/data-access.html#s20052512

Has anyone used this method? I'm working with our Oracle implementation team, but they are manually creating/updating users until we take over provisioning through Saviynt EIC.

[sudeshjaiswal]

Hello @gregorycarlson,

Please refer the below document,
https://docs.saviyntcloud.com/bundle/AAG-Guide/page/Content/AAG_for_Oracle_Enterprise_Resource_Plann...

Thanks.

[ganimkt]

Hi @sudeshjaiswal 

I am working on mapping the security context and security context values to the Roles as a child entitlements.

Request you to provide me ImportAccountEntJson for the same. 

I was getting 403 error, when I tried to access the below API's but the client is telling he has already assigned the IT Security Manager Role to the service account. any suggestion which role needs to be assigned to access these API's.

/fscmRestApi/resources/11.13.18.05/advancedAccessUsers/{userGUID}

/fscmRestApi/resources/11.13.18.05/advancedAccessRequests/action/getSecurityContextLOV

/fscmRestApi/resources/11.13.18.05/advancedAccessRequests/action/getSecurityValue 

[rushikeshvartak]

403 is API permission Issue

[gregorycarlson]

We have Oracle as a connected system (not disconnected as the link provided) - My goal would be to not have hands-on-keyboard manually updating/pressing buttons to update. I've seen, in previous ERP implementations, using an "Enabler" role to provide the data access. Has anyone used a solution like this?