Migrating Security in Oracle ERP Cloud

As security and Segregation of Duties (SoD) risks are becoming more scrutinized by the Public Company Accounting Oversight Board (PCOAB) and external auditors, it is increasingly important to establish a clean and compliant security role design in your Oracle ERP Cloud application. Whether you develop custom roles as part of your implementation or redesign security in your existing environment, role design and build may come with its own set of technical challenges – one of which includes role migration.

Like most configurations, custom roles are typically required to flow through the hierarchy of Oracle environments during their development lifecycle (e.g. roles are developed in a DEV environment, moved to a QA/UAT environment for testing, and finally migrated to Production only after they are fully vetted and approved). A major issue security teams face is that role migration in Oracle ERP Cloud can be a very tedious and time-consuming task. In fact, historically there was no feasible way to “migrate” roles at all – rather, security teams were forced to manually rebuild roles from the ground up in each environment.

New Role Migration Functionality

Starting with release 19A, Oracle introduced a new feature allowing users to export and import custom role hierarchies. The export function extracts the role hierarchies in three .csv files that together comprise the role to duty role to privilege mapping. Once exported from your source environment, the roles can be uploaded or imported into your target environment through the same navigation path.  This feature has reduced the level of effort required to migrate custom roles from one environment to another. As an added benefit, eliminating the need to manually recreate role hierarchies also reduces the risk of incomplete or inaccurate role configurations through manual error.

Navigation: Setup and Maintenance > Users and Security > Manage Job Roles > Actions > Export to CSV File or Import from CSV File

Items to Note

  • Using this feature does not require any prerequisite setups
  • The IT Security Manager role has access to this feature
  • You can migrate all custom roles or select only specific roles using available filter criteria

What Can’t be Migrated?

While the feature has dramatically increased the efficiency of migrating roles, there are some limitations around what can be exported and imported.  Some examples include:

  • Data Security Policies: Currently, the export and import utility only migrates the role hierarchy. The utility is not capable of migrating data security policies, which are critical for roles to function properly. This is a known Oracle design gap (#29337499). Unfortunately, this means the data security policies still need to be reconfigured manually for each role after migration between environments.
  • Seeded Roles: The export feature only allows the export of custom security artifacts. You cannot export seeded roles or seeded role to seeded privilege mapping. For example, if a custom job role contains a seeded duty role, the export data will include the job role to duty role mapping but will not contain the seeded duty role to seeded privilege mapping. In any case, it is best practice to never modify seeded security artifacts, so there should not be a requirement to migrate changes to these roles.
  • User Role Mapping: This specific feature does not support the export and import of user role assignments. Fortunately for teams going through a security design or redesign, the HCM data loader tool can be leveraged for this time-consuming task.

Conclusion

While the ability to migrate role hierarchies has been improved, the tool’s inability to migrate data security policies leaves significant challenges for organizations that need to build custom roles. Many teams who have leveraged the tool are left feeling as if the feature is incomplete or “half-baked” – and it has been nearly a year since Oracle has revisited the tool’s functionality.

To increase visibility of this issue, security teams who may require this functionality (or just want to help those that do) are encouraged to vote for the enhancement. If you would like to vote, visit the Oracle Cloud Customer Connect page and click the green thumbs up button. (If the link does not take you directly to the idea page, enter the idea number DF96E33E07 into the search box). Hopefully Oracle will hear us and include the functionality in a future release.

To learn more about how Protiviti can help with Oracle security, please visit our Oracle Solutions site or contact us.

 

Sriram Chandran

Senior Manager
Technology Consulting – Enterprise Application Solutions

Kristin Jenison

Senior Manager
Enterprise Application Solutions

Subscribe to Topics

Protiviti Director Kyle Swanson explains how SAP Fiori can help increase user adoption, reduce workload and process complexity and free up time for your resources to focus on higher value tasks http://ow.ly/DACw50D9RWc #SAPblog #SAPFiori

Is your organization managing to the speed of emerging technology? Is its business model at risk of digital disruption? If the board's not sure, it’s time to assess digital readiness http://ow.ly/xlJX50D5MX0 via @cci_compliance
#DigitalReadiness #DigitalDisruption @DeLoachJim

Session voting and registration is OPEN for DynamicsCon, a free, virtual event focused on Microsoft Dynamics and Power Platform! Vote for our sessions and register today!
Vote: https://bit.ly/3oIxS4y
Register: http://bit.ly/3nHTH2Q
#Dynamics365 #PowerPlatform #Microsoft

How are you protecting your data? Join us on February 3rd to see how #Microsoft Information Protection can help your organization protect sensitive data throughout its entire lifecycle. Register now: http://bit.ly/3b9udsz

@Microsoft #MIP #DataProtection

What does #resilience mean for your organization? A key first step is understanding the attributes of a #BCM or Operational Resilience program. Learn more at http://ow.ly/1r9250CShAt
#businesscontinuity #businesscontinuityplanning #operationalresilience #bankingindustry

Load More...