ORACLE - FUSION : Common Lookup DFF Configuration.

 Following steps will let you know how to configure DFF's for common lookups and use them while configuring common lookups. 

Normal common lookups will let you configure lookup code and corresponding meaning.  If you want to configure additional values for a lookup code then you can use DFF's to configure context and use them in lookups. 

MANAGE DFF

• Login into Fusion. 
• Go to Manage and Setup 
• Search for Manage Descriptive Flexfields
• Search for Lookup values descriptive flexfield (Name)
• Edit - Lookup values descriptive flexfield
• Manage Contexts
• Search for existing contexts or Create a new one. 
• Create
• Give a display name  - XXSCM_SHOP_ORG_MAP_LOOKUP
• API Name - XxscmShopOrgMapLookup
• Save
• Under Context Sensitive Segments add segments - ( additional lookup values )
• Give a Name - Ex: Inventory_Organization
• Data Type as Character
• Table Column will auto populated - Attribute1
• Under Value Set : Either select an existing one or create new
• Create a New Value Set
• Value Set Code - XXSCM_INV_ORG_NAME
• Module - Inventory Management
• Validation Type : Table   -- This will allow us to define table, column and where clause. 
•  Under Definition 
• From Clause - Provide Table Name - INV_ORGANIZATION_DEFINITIONS_V
• Value Column Name - Provide Column Name - ORGANIZATION_CODE
• ID Column Name :  ORGANIZATION_ID
• WHERE Clause :  INVENTORY_ENABLED_FLAG = 'Y'
• Save 
• This will validate TABLE and Column Values. 
• Save and Close the value set
• Save and Close the Segment
• Follow the above steps to create a new segment for inventory.
• Save and Close the Context

MANAGE COMMON LOOKUP:

• Go to Manage and Setup 
• Search for Manage Common Lookups
• Add Common Lookup +
• Lookup Type : XXSCM_SHOP_ORG_LOOKUP
• Meaning : Give some valid meaning 
• Description : Give some value Description
• Module : Common
• REST Access Secured :  Authenticated. 
• Lookup Code
• Add 
• Lookup Code : Shop1
• Meaning : Give a Name
• Enable
• Expand the lookup code
• Select the context created earlier
• Select the Org 
• Select the Inventory

Oracle OIC - ERP Adapter Filter Business Events

We can use ERP adapter to consume Business Events from Fusion and process them. Before we need to subscribe the events , we need to create a CSF key or Token based authentication schema in Fusion.  ERP event handler framework will use these key or authentication schema to invoke the OIC integration. 

Integration reactivated after 2021 - May will use the token based authentications. It doesn't require additional settings. 

Use the ERP adapter at trigger point and select Business Events Operations and select the particular business event. 

Example : Invoice Hold Applied. 

This will create a subscriber entry in Fusion.  We can verify subscriber details using following URL. This will ask for credentials and need to provide valid credentials. 

https://xx-vijay.fa.ocs.oraclecloud.com/soa-infra/PublicEvent/subscriptions

All events are triggered from Fusion.  Fusion will use the subscriber details and invoke integrations.  

Sample Invoice Hold Payload:

<ns01:onEvent xmlns:ns01="http://xmlns.oracle.com/cloud/adapter/erp/XXVV_SUBSCRIBE_TO_INVHOLD_REQUEST/types">   <ns0:ApInvHoldAppliedInfo xmlns:ns0="http://xmlns.oracle.com/apps/financials/payables/invoices/transactions/model/entity/events">      <ns0:InvoiceId>         <ns0:newValue value="XXXXXXX00000001"/>         <ns0:oldValue/>      </ns0:InvoiceId>      <ns0:OrgId>         <ns0:newValue value="XXXXXXX00000002"/>         <ns0:oldValue/>      </ns0:OrgId>      <ns0:HoldId>         <ns0:newValue value="72011"/>         <ns0:oldValue/>      </ns0:HoldId>      <ns0:HoldLookupCode>         <ns0:newValue value="AMT REC"/>         <ns0:oldValue/>      </ns0:HoldLookupCode>      <ns0:HoldReason>         <ns0:newValue value="Amount billed exceeds amount received."/>         <ns0:oldValue/>      </ns0:HoldReason>      <ns0:LineNumber>         <ns0:newValue value=""/>         <ns0:oldValue/>      </ns0:LineNumber>      <ns0:HeldBy>         <ns0:newValue value="5"/>         <ns0:oldValue/>      </ns0:HeldBy>      <ns0:HoldDate>         <ns0:newValue value="2021-06-04T06:27:33"/>         <ns0:oldValue/>      </ns0:HoldDate>      <ns0:LineLocationId>         <ns0:newValue value="XXXXXXX00000003"/>         <ns0:oldValue/>      </ns0:LineLocationId>      <ns0:RcvTransactionId>         <ns0:newValue value=""/>         <ns0:oldValue/>      </ns0:RcvTransactionId>   </ns0:ApInvHoldAppliedInfo></ns01:onEvent>

Use the following Filter Expression to filter a specific Hold. 

<xpathExpr xmlns:ns0="http://xmlns.oracle.com/apps/financials/payables/invoices/transactions/model/entity/events">$eventPayload/ns0:HoldLookupCode/ns0:newValue/@value='AMT REC'</xpathExpr>

$eventPayload: Inbuilt variable which will contain the payload. 

Oracle OIC - ERP/HCM Adapter with OAuth Authentication

Oracle has introduced an OAuth authentication mechanism to access ERP and HCM applications using ERP/HCM  adapter respectively in OIC. 

This will solve the following security issues. 

1. Can maintain user credentials in IDCS. 
2. Wont require to reset the passwords during P2T refresh. 
3. Better security compared to basic authentication. 
4. Authentication will work even password will get expired in IDCS or Fusion. 

Set Up Trust Between Oracle Fusion Applications and Oracle Identity Cloud Service.

• Get the JWK signing certificates from the Oracle IDCS of Oracle Integration.
• Get the REST API of the Oracle IDCS endpoint that gives you the signing certificate endpoint.
• <IDCS_HOST_NAME>/admin/v1/SigningCert/jwk
• Note :  Before accessing the key make sure, access certificate is enabled in IDCS . Got to  Settings -> Default Settings and Toggle ON the "Access Signing Certificate"
• Copy the certificates present under "x5c" JSON element.
• Use the following template and save the certificates as .crt files.

-----BEGIN CERTIFICATE-----

 content_of_certificate

. . .

. . .

-----END CERTIFICATE----- 

• Upload the above certificates to the Oracle Fusion/HCM Applications Security Console.
• Note:  Since HCM and Fusion are using IDCS and following Authenticator provider will be in non editable mode. https://identity.oraclecloud.com/
• Raise an SR with Oracle team to upload the certificates and attached to this authentication provider. 

Create an ERP/HCM resource application. 

• Login into IDCS
• On the left Panel , Click the Applications and then click Add
• Select the confidential application option
• Provide a Name
• Go to next page
• Select the option - Configure this application as a resource server now.
• Select Is Refresh Token Allowed.
• In the Primary Audience field, add the Oracle Fusion/HCM Applications URL and port.
• https://FA_URL:443
• In the Scopes section, click Add.
• In the Scope field, enter /.
• In the Description field, enter All.
• Select Requires Consent.
• Click Add, then click Next.
• Click Finish to complete resource application creation.
• Click Activate to activate your client application.

 

Create a confidential Client application 

• In the left navigation pane, select Applications, then click Add to add a client application.
• Select Confidential Application.
• The Add Confidential Application wizard is displayed.
• Provide a Name
• Select Configure as a client application
•  Select appropriate Grant Types

• Provide callback URL 
• https://<OIC_HOST_NAME>/icsapis/agent/oauth/callback
• Select Client Type as Trusted if required and import SaaS certificate (Optional and Not Required)
• Add Scope
• Select ERP/HCM Resource application which we created earlier. 
• Select the scope
• Save changes
• Activate the application
• Collect Client Id and Secret. 

OIC Configurations:

• Login into OIC using admin or developer access.
• Make sure this user has got an access to Oracle Fusion as well. 
• Create ERP/HCM Adapter with Invoke Operation. 
• Provide SaaS URL
• Select Authentication type as OAuth Client Credentials.
• Provide Client Id and Secret which we got above. 
• Provide Authorization  and Token URL.
• https://idcs-<Id>.identity.oraclecloud.com/oauth2/v1/authorize
• https://idcs-<Id>.identity.oraclecloud.com/oauth2/v1/token
• Provide Scope Value (Get it from IDCS client application.)
• Add offline_access to the scope. 
• https://<SaaS_Host_Name>.fa.ocs.oraclecloud.com:443/ offline_access
• Select Provide Consent.
• Provide OIC user credentials. 
• Note : This user must present in Fusion as well. 
• Save and Test the connection.

ORACLE OIC - IDCS SEARCH TO RETRIEVE DATA

 We can IDCS search API to get the required attributes and limited user list using pagination logic. 

Use the following API details to fetch the data from IDCS. 

URL: https://idcs-<id>.identity.oraclecloud.com/admin/v1/Users/.search

Operation : POST

IDCS Scope : urn:opc:idm:__myscopes__

Sample Request Payload:

{

  "schemas" : [ "urn:ietf:params:scim:api:messages:2.0:SearchRequest" ],

  "attributes" : [ "displayName", "userName", "emails", "active", "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber" ],

  "filter" : "((urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber pr))",

  "startIndex" : 1,

  "count" : 100

}

OIC Expression  for Filter: 

filter :   conct("meta.lastModified ge ", '"', $varStartDate, '"', " and meta.lastModified le ", '"', $varEndDate, '"')

ORACLE OCI - Object Storage Multi Part Upload

In some cases we may have to upload larger file and uploading larger file may take more time and bandwidth.  In such cases we can split the file into multi parts and upload them in parallel. 

We can use the following steps to split and upload the files to object storage. 

• First split the file based on the required size using split command. 
• split -b 5M -d /tmp/bigfilename.txt /tmp/bigfilename.split
• Create a multi part upload request. 
• POST
• /n/{namespaceName}/b/{bucketName}/u
• Request Payload

{

  "object": "example_object1"

}

• Response Payload 

{

  "namespace": "ansh8lvru1zp",

  "bucket": "MyBucket",

  "object": "MyObject1",

  "uploadId": "c892336f-ccvb-1bb8-6e75-a5649fd91178"

}

•  Use the above upload Id to upload the files. 
• Loop over each file and upload the files 
• PUT
• /n/{namespaceName}/b/{bucketName}/u/{FinalFileName}?uploadid={UploadID}&uploadPartNum={partNum/SequenceNum}
• After Upload , get all the multi part upload details. 
• GET
• /n/{namespaceName}/b/{bucketName}/u/{FinalFileName}?uploadid={UploadID}
• Sample Response

[

  {

    "partNumber": 1,

    "etag": "3d240a5a-a2b0-45b2-bcvb-2ac6a02b422c",

    "md5": "rvr3UC1SmUw7cvb2NqPN0g==",

    "size": 8

  },

  {

    "partNumber": 2,

    "etag": "15de104e-7cvb-3513-8da1-3b5e75a65ad7",

    "md5": "3poFVtJezCVBOi8RzhUB8Q==",

    "size": 8

  }

]

• Finally commit the upload. 
• POST
• /n/{namespaceName}/b/{bucketName}/u/{FinalFileName}?uploadid={UploadID}
• Request Payload

 

{

  "partsToCommit": [

    {

      "partNum": 1,

      "etag": "3d240a5a-a2b0-45b2-bcvb-2ac6a02b422c"

    },

    {

      "partNum": 2,

      "etag" : "15de104e-7cvb-3513-8da1-3b5e75a65ad7"

    }

  ]

}

ORACLE IDCS - OAUTH2 - Get Token

Use the following details to get the OAuth Token from IDCS and invoke the service. 

Authentication URL:  https://idcs-xxxx.identity.oraclecloud.com/oauth2/v1/authorize

Authentication Token URL:  https://idcs-xxxx.identity.oraclecloud.com/oauth2/v1/token

Scope:  From IDCS application. 

Python - Generate SSL Certificate and Invoke SOAP/REST Using SSL certificate.

Steps to generate Keystore , CSR and Import Signed Certificates. 

• Login into Unix Box 
• Go to Java Home Dir
• cd %JAVA_HOME%/jre/bin
• Run the Keytool Command to Create Kestore - JKS
• keytool -genkey -keyalg RSA -alias <aliasname> -keystore identityKeystore.jks -storepass <replace_with_strong_password> -validity 900 -keysize 2048 
• <aliasName>  = Meaningfull Alias
• <replace_with_strong_password>  = Ketstore Password
• When prompted, change the values provided based on your company's security policy

What is your first and last name?

  [Unknown]:  VijayaKumar

What is the name of your organizational unit?

  [Unknown]:  Development

What is the name of your organization?

  [Unknown]:  ICS

What is the name of your City or Locality?

  [Unknown]:  Bangalore

What is the name of your State or Province?

  [Unknown]:  KA

What is the two-letter country code for this unit?

  [Unknown]:  IN

Is CN=<>, OU=<>, O=<>, L=Redwood Shores, ST=California, C=US correct?

  [no]:  yes 

Enter key password for <aliasName>

        (RETURN if same as keystore password):

 

• List the file generated using ls command. Now you should see jks file
• ls
• Generate CSR file for signing authority. 
• keytool -certreq -alias <aliasName> -keystore identityKeystore.jks -storepass <replace_with_strong_password>  -storetype JKS -file icsclient.csr
• List the files generated using ls command.  Now you should see both jks and csr file. 
• ls
• Share the CSR file with signing authority.  Or generate one using following URL.
• https://ssltools.digicert.com/checker/views/csrCheck.jsp
• In case if you receive the root and intermediate certificates from signing authrity us the followin commands to Import Root Certificates: 
• keytool -import -keystore identityKeystore.jks -file <root_certificate_CA>.crt -alias DigiCertCARoot
• Import Intermediate Certificates : 
• keytool -import -keystore identityKeystore.jks -file <intermediate_certificate_CA>.crt -alias DigiCertCAInter
• keytool -import -keystore identityKeystore.jks -file <my_company_signedcert.crt/pem> -alias icslientcert
• Use the following command to generate Client or Server certificate using Keystore. 
• keytool -export -alias <aliasName> -storepass <replace_with_strong_password> -keystore identityKeystore.jks -file  icsclient.cer/pem 
• keytool -export -alias <aliasName> -storepass <replace_with_strong_password> -keystore identityKeystore.jks -file  icsclient.cer/pem
• List all the certificates from JKS file. 
• keytool -list -keystore identityKeystore.jks

Python Code : 

headers = {'SOAPAction': '<wsdl_action>', 'Content-Type': 'text/text; charset=utf-8'}

requests.post('https://vijayakumarkv/ics/cloud.org', headers=headers,data=body.encode('utf-8'),cert=('/path/client.cert', '/path/client.key'))