In the Confirm page, click Finish.

Using Segregation of Duties SoD 27-3 ■ SAP User Management release 9.1.0 and later The SIL also acts as the base for specialized adapters that integrate the SIL with SoD engines. These adapters are called SIL providers. A SIL provider acts as the interface between the SIL and a specific SoD engine. There are predefined SIL providers for the following SoD engines: ■ SIL Provider for SAP GRC This provider is also known as the SAP GRC SIL Provider. The certified versions of SAP GRC are versions 5.2 SP4 or later and 5.3 SP5 or later. ■ SIL Provider for Oracle Application Access Controls Governor OAACG release 8.2.1 or later This provider is also known as the OAACG SIL Provider. ■ SIL Provider for Oracle Identity Analytics OIA release 11.1.1.3. or higher This provider is also known as the OIA SIL Provider. Figure 27–2 shows the architecture of SoD implementation in Oracle Identity Manager. Figure 27–2 Architecture of SoD Implementation in Oracle Identity Manager If required, you can configure any Oracle Identity Manager connector with either the SAP GRC SIL Provider, the OAACG SIL Provider or the OIA SIL Provider. For example, you can use the PeopleSoft User Management connector and the OAACG SIL Provider to automate SoD validation of requests for entitlements on PeopleSoft Enterprise Applications. Note: Install the latest patch set for OAACG before implementing and using SoD in Oracle Identity Manager. Contact Oracle Support for more information. 27-4 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager You can also create and use a SIL provider for a custom SoD engine, along with either one of the preconfigured Oracle Identity Manager connectors or an Oracle Identity Manager connector that you configure for SoD validation.

27.3 Installing the SoD-enabled Connectors

Instructions to install the SoD-enabled connectors listed below can be found in the specific connector documentation. The Oracle Identity Manager Connectors Documentation page is located at the following UR: http:download.oracle.comdocscdE11223_01index.htm ■ Oracle e-Business User Management release 9.1.0 and later ■ SAP CUA release 9.1.0 and later ■ SAP User Management release 9.1.0 and later

27.4 Deploying the SIL and SIL Providers

SIL registration is provided by default for the some target systems and SoD engines. No deployment steps are required for these default combinations of target systems and SoD engines. Target systems for which SIL registration is provided include: ■ EBS and OAACG ■ PSFT and OAACG ■ SAP and SAP-GRC ■ OIA OIA SoD Engine synchronizes data with Oracle Identity Manager rather than any target system so the topology registered for OIA can be used with any connector configured with Oracle Identity Manager. OIA imports all data from Oracle Identity Manager. Therefore, from OIA perspective, Oracle Identity Manager is the target system. You must perform the SIL registration process if you want to use any other combination of target systems or SoD engines. For more information, see Section 27.10, Custom Combination of Target Systems and SoD Engines.

27.5 Configuring the SoD Engine

You must import entitlement data from the target system to the SoD engine. If required, you must also configure SoD validation rules on the SoD engine. The following sections provide these instructions for the preconfigured SoD engines. ■ Configuring Oracle Application Access Controls Governor ■ Configuring SAP GRC ■ Configuring Oracle Identity Analytics

27.5.1 Configuring Oracle Application Access Controls Governor

Configuring Oracle Application Access Controls Governor OAACG involves the following procedures: ■ Installing Oracle Application Access Controls Governor Using Segregation of Duties SoD 27-5 ■ Creating an Oracle Application Access Controls Governor Account for SoD Operations ■ Synchronizing Role and Responsibility Data from Oracle e-Business Suite to Oracle Application Access Controls Governor ■ Defining Access Policies in Oracle Application Access Controls Governor Installing Oracle Application Access Controls Governor OAACG 8.6.x is supported with Oracle Identity Manager 11g Release 1 11.1.1.4 onward. OAACG 8.6.0.203 is the recommended version that must be installed. Further, this must be upgraded to OAACG 8.6.0.219 or OAACG 8.6.0.240. To install OAACG 8.6.0.203: 1. Logon to My Oracle Support.

2. Click the Patches Updates tab.

3. Click Advanced Search.

4. Select Product Family as Oracle Application Access Controls Governor and

release as AACG 8.6.0. Select the appropriate platform, and click Search. 5. Select latest patch. See the Oracle Identity Manager Bundle Patch Readme to confirm if this is 8.6.0.219 or 8.6.0.240. 6. Download the patch or update. 7. Perform the OAACG upgrade by referring to the OAACG upgrade guide. OAACG 8.6.0.203 must be upgraded to OAACG 8.6.0.219 or OAACG 8.6.0.240. To do so: 1. Logon to My Oracle Support.

2. Click the Patches Updates tab.

3. Search for the Patch ID. 4. Select the Patch ID. 5. Download the patch or update. 6. Perform the OAACG upgrade by referring to the OAACG upgrade guide. Creating an Oracle Application Access Controls Governor Account for SoD Operations Create an account of the Basic type for SoD validation operations. While performing the procedure described in Creating an IT Resource to Hold Information about the SoD Engine on page 27-43, provide the user name and password of this account. See Oracle Application Access Controls Governor documentation for information about creating the account. Note: Oracle Identity Manager SoD has been certified against OAACG 8.6.0.219 and OAACG 8.6.0.240. 27-6 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager Synchronizing Role and Responsibility Data from Oracle e-Business Suite to Oracle Application Access Controls Governor You must import synchronize role and responsibility data from Oracle e-Business Suite into Oracle Application Access Controls Governor. After first-time synchronization, you must schedule periodic synchronization of data. See Oracle Application Access Controls Governor documentation for more information. Defining Access Policies in Oracle Application Access Controls Governor After you import role and responsibility data, set up access policies in Oracle Application Access Controls Governor. These access policies are based on various combinations of roles and responsibilities. See Oracle Application Access Controls Governor documentation for more information.

27.5.2 Configuring SAP GRC

SAP GRC uses user, role, and profile data from SAP R3 to validate requests for accounts, roles, and responsibilities. Configuring SAP GRC involves the following procedures: ■ Creating an SAP GRC Account for SoD Operations ■ Generating the Keystore ■ Configuring the Risk Terminator ■ Synchronizing User, Role, and Profile Data from SAP ERP to SAP GRC ■ Defining Risk Policies in SAP GRC Creating an SAP GRC Account for SoD Operations You must create an SAP GRC account for SoD operations. During SoD operations, this account is used to call the SAP GRC Web service. When you create this user account, you must assign it to the following groups: ■ Everyone ■ Authenticated Users You must not assign any roles to this account. Generating the Keystore To generate the keystore: 1. In a Web browser, open the Web Services Navigator page of SAP GRC Access Control. The URL is similar to the following: https:SAP_GRC_HOST:PORT_NUMBERVirsaCCRiskAnalysisServiceConfig1?wsdl 2. Export the certificate. 3. Copy the certificate into the bin directory inside the JDK installation directory of SAP GRC. 4. Run the following command to create the keystore from the certificate file that you download: keytool -import -v -trustcacerts -alias sapgrc -file CERTIFICATE_FILENAME Using Segregation of Duties SoD 27-7 -keystore sgil.keystore -keypass changeit -storepass changeit 5. When prompted for the keystore password, specify changeit. This is the default keystore password. 6. When prompted to specify whether you want to trust the certificate, enter yes. 7. The sgil.keystore file is created in the bin directory. Copy the file to the OIM_HOMEconfig directory. Configuring the Risk Terminator The Risk Terminator is a feature of GRC Access Control. It is the main component of the SoD validation functionality of SAP GRC. Whenever a role is created in the profile generator or assigned to a user, the Risk Terminator verifies if this role creation or assignment would result in an SoD violation. See the Risk Terminator Configuration document for detailed information. Synchronizing User, Role, and Profile Data from SAP ERP to SAP GRC User, role, and profile data must be imported synchronized from SAP ERP into SAP GRC. After first-time synchronization, you must schedule periodic synchronization of data. Defining Risk Policies in SAP GRC After you import role and responsibility data, use the Risk Analysis and Remediation feature of SAP GRC to define risk policies of type Segregation of Duty. See SAP GRC documentation for more information.

27.5.3 Configuring Oracle Identity Analytics

Configuring Oracle Identity Analytics involves the following procedures: ■ Creating an Oracle Identity Analytics Account for SoD Operations ■ Synchronizing Oracle Identity Manager Metadata With Oracle Identity Analytics ■ Defining Identity Audit Policies in Oracle Identity Analytics Creating an Oracle Identity Analytics Account for SoD Operations Create an account on Oracle Identity Analytics and assign to it the SRM Admin role for SoD validation operations. When performing the procedure described in Creating an IT Resource to Hold Information about the SoD Engine on page 27-43, provide the user name and password of this account. See the Oracle Identity Analytics documentation for information about creating the account. Note: In this sample command, the keystore file name is sgil.keystore. Note: The Oracle Identity Analytics Admin account with username rbacxadmin can also used.