I’m looking for advice on implementing both ERP and HCM cloud in the same tenant.
We are implementing Oracle ERP and Oracle HCM. We’re using Identity Security cloud to manage user access in ERP. A decision was made by the Implementation partner to Implement ERP and HCM in the same application identity domain before discussion with integrating with ISC occurred.
We are initially starting with ERP and have the ERP connector installed and configured to only aggregate ERP roles and data access in entitlement aggregation. This allows us to filter the HCM entitlements from aggregation in the ERP source. However, the ERP connector does not give the ability to filter the HCM entitlements in membership aggregation. The result is HCM roles pull into ISC through the ERP source as GUID entitlements and display on user’s access. This is confusing our end users, who are seeing strange entitlements on their current access, and some users are trying to revoke the HCM entitlements.
Is it a better idea to have HCM and ERP in separate identity domains within OCI? It seems like that would play better with the Oracle connectors. Without the ability to filter HCM roles in the ERP source membership aggregation I can’t prevent HCM roles from spilling into the ERP source. I’m assuming I also won’t be able to prevent ERP roles from aggregating into the HCM source as well.
Is there another way to filter entitlements in the membership aggregation on the ERP side? Do I need to challenge the decision to host both HCM and ERP in the same identity domain? What are the other possible ramifications from hosting both HCM and ERP in the same identity domain?