Oracle Fusion Cloud EPM

Customer-facing setup instructions: what an Oracle Fusion Cloud EPM administrator must configure in their environment, and which values to enter into Clarity.

Overview

The Clarity Oracle Fusion Cloud EPM connector talks to the EPM Cloud Security REST API at {your EPM instance URL}/interop/rest/security. It reads your EPM users, groups, and roles for access review, and can provision role and group membership.

Why the Role Assignment Report matters. Some EPM role grants originate in the identity layer rather than the application layer, and those are not visible through the user or group listings. Clarity therefore reads role assignments from the Role Assignment Report, which joins both layers — that is the only way to see a user’s complete role picture.

Last login. Clarity requests the User Login Report for the trailing 119 days and records each user’s most recent access as their last login. Oracle retains this audit data for a maximum of 120 days, so 119 is the widest window that reliably returns data. A user who has not signed in within that window has a blank last login in Clarity — blank means “no login in the last 119 days”, not “never logged in”.

Authentication is HTTP Basic with a service-account username and password. There is no browser consent screen, no redirect URL, and no client ID/secret to create — you are supplying a real EPM user account.

OAuth 2.0 is coming. This connector currently authenticates with a service-account username and password (HTTP Basic). OAuth 2.0 support via an identity-domain confidential application is being added as a priority; this guide will be updated with the Oracle-side steps when it ships. If your identity domain enforces MFA or blocks password-based REST access, contact Clarity support before onboarding.

Prerequisites

• An Oracle Fusion Cloud EPM environment (Planning, Financial Consolidation and Close, Tax Reporting, Narrative Reporting, Account Reconciliation, and so on) — the Security REST API is common to all of them.

• Someone with Identity Domain Administrator access in the OCI Console (to create the service account and assign its application role), or an existing Service Administrator who can do the role assignment.

• A service account that will be dedicated to Clarity, holding the Service Administrator predefined role.

• The service account must be able to authenticate with a password over REST — i.e. not subject to an MFA or password-less policy for API access.

Step 1 — Identify your EPM instance URL

Clarity needs the base URL of the EPM environment, and nothing after the hostname. Clarity appends /interop/rest/security itself.

The format is:

https://<tenant>.epm.<dc>.ocs.oraclecloud.com

for example https://mycompany.epm.us6.ocs.oraclecloud.com. Older or differently-provisioned environments may present as https://epm-<identitydomain>.epm.<dc>.oraclecloud.com — either is fine.

The reliable way to get it: sign in to your EPM business process and copy the scheme + host from the browser address bar. Then:

• Keep https://

• Remove everything after the hostname — no /epmcloud, no /HyperionPlanning, no trailing /, and never /interop/rest/security.

Your identity domain name is visible in that same host. For https://epm-exampleDomain.epm.us6.oraclecloud.com the identity domain is exampleDomain (the text between the first - and the next .); for a test environment https://epm-test-exampleDomain.epm.us6.oraclecloud.com it is the text between test- and the next .. You may need it in Step 2.

Step 2 — Create the integration service account and grant Service Administrator

Create a dedicated account for Clarity rather than reusing a person’s login — a named individual’s account will break the integration when they leave, rotate their password, or get MFA enrolled.

Why Service Administrator. Every endpoint Clarity uses lives under the Security REST API, and Oracle gates that surface on the Service Administrator role (or, for some read-only report calls, an application role plus the Access Control — Manage / View granular roles). Both the Role Assignment Report and the User Login Report name Service Administrator as a sufficient role; the provisioning calls (add user, remove user, assign/unassign role, add/remove group members) require it outright. A Power User, User, or Viewer account will authenticate and then fail on the very first sync call.

1. Create the user in the identity domain. In the OCI Console, go to Identity & Security → Domains, open the identity domain backing your EPM environment, and create a user with a working email address. (Exact clicks in the OCI Console vary by tenancy layout and Oracle revises this console — confirm against your own tenant.)

2. Assign the Service Administrator application role. In the IAM interface:

   • Click the Oracle Cloud Services tab — your EPM and EDM environments are listed.

   • Click the name of the EPM environment you are connecting to Clarity.

   • Click the Application roles tab.

   • Click the ellipsis next to Service Administrator and choose Manage users.

   • On Manage user assignments, click Assign users, search for your service account, select it, and click Assign. It should then be listed with member type Direct.

3. Complete first sign-in. Sign in to the EPM environment once as the service account and clear any forced password change or welcome prompt. An account still in “must change password” state will fail Basic auth.

4. Note the username form. Basic authentication accepts either username or identitydomain.username (e.g. exampleDomain.clarity.svc). Plain username works on most environments; if authentication fails with a 401, retry with the identity-domain-prefixed form using the identity domain from Step 1.

You can review who holds which application role from the EPM business process itself: from the Home page click Tools, then Access Control, which opens on Manage Groups and also provides the role and audit reports. (Access Control shows role assignments; creating users and granting predefined roles is done in the OCI Console / IAM interface as above.)

Step 3 — Enter the credentials in Clarity

In Clarity, add a new Oracle Fusion Cloud EPM integration and fill in:

Now hit the Next use Clarity’s Test credentials function before the first sync — it issues a lightweight GET /v2/role/getavailableroles call, which fails fast if the URL, credentials, or role are wrong.

Troubleshooting

What Clarity does NOT do

• No OAuth 2.0 yet. Basic authentication with a service account is the only supported method today; OAuth 2.0 via an identity-domain confidential application is planned.

• No application-level artifact security. Clarity manages predefined and application roles and groups. It does not read or write business-process artifact security — Planning form/dimension access permissions, data grants, approval unit security, Financial Consolidation and Close or Narrative Reporting object permissions. Those stay in the business process.

• No password management. Clarity never resets, rotates, or reads a user’s password. Creating a user sends Oracle’s “reset password” flag so Oracle emails the new account its own credentials; Clarity is not involved beyond that.

• No group or role lifecycle. Clarity can add and remove members, but it does not create, rename, or delete groups or roles in EPM.

• No deactivate / suspend. The connector supports user delete only, and deleting a user removes them from the identity domain — which means from every EPM environment sharing that identity domain, not just this one.

• No attribute write-back. Clarity does not push identity attributes (name, email, manager, department) into EPM.

• Group membership is not marked direct vs inherited. Oracle returns all member users of a group, including those inherited through nested groups, without distinguishing them, so Clarity records membership without that flag. Roles granted via a group are annotated — the Role Assignment Report’s “granted through group” value is captured on the assignment.

• Group-to-role relationships are not currently imported. Clarity requests the group list without the embedded roles payload, so the “this group confers these roles” mapping is not shown today.

• Last login is a 119-day window, not lifetime history. Oracle retains only 120 days of login audit data; Clarity stores the most recent access within that window and nothing earlier.

Need Help?