Public Single Sign-On for EPM Cloud Using Oracle Identity Cloud Service (IDCS) Question: How can I set up single sign-on (SSO) between EPM Cloud services in different ID domains or data centers? Question: Does EPM Cloud support SSO with IDCS? Question: Does EPM Cloud support IDCS? Question: How can I set up a single point of control to invoke all my EPM Cloud Services in different data centers? August, 2017

Oracle Identity Cloud Service (IDCS) Oracle’s next generation comprehensive security and identity platform that is cloud-native and designed to be an integral part of the enterprise security fabric, providing modern identity for modern applications Provides a powerful set of hybrid identity features to maintain a single identity for each user across their on-premise and in the cloud services while delivering a seamless user experience Question: What is Oracle Identity Cloud Service? Question: What is IDCS? IDCS documentation: https://www.oracle.com/cloud/paas/identity-cloud-service.html

The value of IDCS for EPM Cloud IDCS provides a single point of invocation for all Oracle cloud service instances, including EPM Cloud, across all data centers IDCS provides users ability to sign in once into IDCS and gain one-click access to all Oracle cloud service instances, including EPM Cloud, across all data centers

SSO Flow – 2 Options Access an EPM Cloud instance, and use IDCS to authenticate the user Access an IDCS instance, and navigate to the EPM Cloud instances from there Question: How can I connect to EPM Cloud using IDCS? Question: How can I authenticate EPM Cloud using IDCS?

IDCS as the Launch Pad for EPM Cloud Services Create EPM and non- EPM Cloud Service instances as SAML applications in IDCS, using user-friendly names and icons Launch these service instances from within IDCS

Setting up SSO Between an EPM Cloud Instance and IDCS Step 1 Step 2 Step 3 Add the EPM Cloud service as a SAML application in IDCS Create users, and provision them appropriately Question: How do I set up SSO for EPM Cloud with IDCS? Question: How is SSO between EPM Cloud and IDCS set up? EPM Cloud SSO documentation: http://www.oracle.com/technetwork/middleware/bi-foundation/epm-sso- fa-netsuite-3711060.pdf Configure SSO

Adding EPM Cloud Service as a SAML Application in IDCS – 1 of 3 Log in to the IDCS instance, and click + next to Applications Click SAML Application Enter EPM Cloud information, and click Next IDCS technical documentation: http://docs.oracle.com/en/cloud/paas/identity-cloud/uaids/administering- oracle-cloud-identity-service.pdf

Adding EPM Cloud Service as a SAML Application in IDCS – 2 of 3 Enter General SSO information The Entity ID and Assertion Consumer URL must specify the identity domain for which SSO is being configured. Enter Advanced Settings Click Download IDCS Metadata, save it for future use, and click Finish

Adding EPM Cloud Service as a SAML Application in IDCS – 3 of 3 Click +Assign to assign selected users to the application Select EPM Cloud Services application, and click Activate Click Activate Application

Creating Users and Provisioning Them – 2 Options Adding users one-by-one Bulk upload of users Documentation on adding users and assigning roles: http://docs.oracle.com/en/cloud/get- started/subscriptions-cloud/csgsg/adding-users-and-assigning-roles.html

Adding users one-by-one – 1 of 2 In My Services, log in as Identity Domain Administrator, and click Users In Users page, click Add Enter the user information Documentation on creating a user and assigning a role: http://docs.oracle.com/en/cloud/get- started/subscriptions-cloud/csgsg/creating-user-and-assigning-role.html

Adding users one-by-one – 2 of 2 Select the EPM Cloud service instance from the drop-down menu, select appropriate roles for the user, and press the arrows Press Add

Bulk upload of users – 1 of 2 In My Services, log in as Identity Domain Administrator, and click Users In the Users page, click Import Click Browse to select the local CSV file that has user information in the following format, and click Import Documentation on bulk upload of users: http://docs.oracle.com/en/cloud/get-started/subscriptions- cloud/csgsg/importing-batch-user-accounts.html

Bulk upload of users – 2 of 2 Select Roles tab Click Batch Assign Role Select a role for the EPM Cloud service instance from the drop-down menu, click Browse to select the local CSV file that has user information in the following format, and then click Assign Documentation on assigning a role to many users: http://docs.oracle.com/en/cloud/get- started/subscriptions-cloud/csgsg/assigning-one-role-many-users.html

Configuring SSO – 1 of 3 In My Services, under SSO Configuration, click Configure SSO Import the IDCS metadata file that was exported earlier Under Configure your identity Provider information, select Signing Certificate in the drop-down list of Export Metadata, and then export the SP signing certificate Oracle Cloud SSO setup documentation: https://docs.oracle.com/en/cloud/get-started/subscriptions- cloud/csimg/managing-oracle-single-sign.html

Configuring SSO – 2 of 3 Click Upload under SSO Configuration in IDCS to import the SP signing certificate In My Services, click Test under Test your SSO Click Start SSO

Configuring SSO – 3 of 3 Ensure that SSO is successful