Audit Reporting Configuration Guide b1308 (August 2013) Release Supported Data Centers=DC4, DC2, DC8

Overview and Pre-requisites This guide describes how to implement the Analytics Audit Reporting solution As of the b1308 release Analytics Audit Reporting is available for all BizX customers with the latest Platform bundle (including talent insights and the Online Report Designer). The customers BizX instance must be hosted in one of the following Data Centers: Arizona (DC4), Amsterdam (DC2), Ashburn (DC8). When Analytics Audit Reporting is available in other Data Centers this guide will be updated to reflect these changes. Who implements Audit Reporting? If the customer is marked in Service on Demand (SeOD) with a Live Status of “Not Live” then Professional Services will implement Analytics Audit Reporting. If the customer is marked with a Live Status of “Live” then Customer Success will implement Analytics Audit Reporting. See the screenshot at left showing where to find this information in SeOD. To request Analytics Audit Reporting is implemented by Customer Success please create a case in SeOD and assign it to the global WFA&P team ‘Queue – T3 WFP&A’ Please review the Analytics Audit Reporting Factsheet in the Professional Services SharePoint site. Before you start: Do not commence configuration until you have all of the information outlined in the Analytics Audit Reporting datasheet. Typically you would start by implementing the customers TEST instance first before implementing any PROD instances Customers are entitled to implementation of a single test instance. Some customers have multiple test instances and because of the overhead required to implement each one please ask the customer to choose the most stable and reliable test instance

Summary of Implementation Steps Completed By Purpose 1 BizX Instance Configuration Tool=BizX Provisioning CS (Queue – T3 WFP&A) To create the Audit Reporting instance to enable SSO between the BizX instance and the Audit Reporting instance 2 Analytics Audit Reporting Enablement Tool=WST Admin Tools CS To enable the Audit Reporting data connection and schemas 3 Analytics Audit Reporting Instance Configuration Tool=WFA Admin Tools - Org Local Configuration To enable the instance for Audit Reporting 4 Portal Page and Standard Report Transfer Tool=WFA Admin Tools To transfer the default Portal Page and the set of standard reports to the instance and verify that the portal/reports are working 5 To enable the default Audit Reporting roles To enable Audit Reporting role based permissions 6 Languages Enablement (optional step) Optional step to enable international languages for customer if required 7 BizX User Configuration BizX Admin Tools To enable the appropriate BizX permissions per user or role to allow access to Audit Reporting 8 BizX User Test Login Tool=BizX Application To check that a test user can now successfully login to BizX and access Audit Reporting 9 Analytics Audit Reporting Bulk User Load (optional step) Tool=WFA Admin Tools - Bulk User Load Optional step to bulk load a group of users 10 Troubleshooting

Step 1: BizX Instance Configuration

Provisioning > Service Provider Settings See https://confluence.successfactors.com/display/PRODINFO/Workforce+Analytics+Workforce+Planning+talent+insight+-+Single+Sign+On+Configuration+Guide to complete this section. See confluence guide If you see other entries here (eg. LMS), select “Add another Service Provide ACS”

Provisioning > Company Settings See https://confluence.successfactors.com/display/PRODINFO/Workforce+Analytics+Workforce+Planning+talent+insight+-+Single+Sign+On+Configuration+Guide to complete this section. See confluence guide See confluence guide See confluence guide <leave this field empty> Note it is very important to get the Company Identifier right because this will be the name of the Analytics Audit Reporting instance that will be created. Once created you cannot change this identifier. For the company identifier enter the name of the BizX instance that is in the Company ID field. When the Provisioning settings are saved the Analytics Audit Reporting instance creation process is started. Within 15 minutes the instance should have been created and the configuration process can continue.

Provisioning > Company Settings While accessing Company Settings check the Reverse Proxy URL setting. If this field is not blank then record the URL and you will need this in Step 4.

Step 2: Analytics Audit Reporting Enablement

Analytics Audit Reporting (ODS) Enablement: High Level Process The workflow below describes the high level process for Analytics Audit Reporting enablement that is documented in this section Create JIRA for BizX CO to provide the BizX audit schema name and user id Create a JIRA for WFA CO to set up audit reporting for the customer Test Analytics Audit Reporting functionality Working? CS/PS Yes Close JIRA No Provide the audit schema name and user id WFA CO set up audit reporting for the customer Troubleshoot Audit Reporting functionality Cloud Operations

Create JIRA for BizX audit schema name and audit user This step in the process sources the BizX audit schema name and audit user identifier You will need to create a Jira to request this information for the BizX customer. You will need this information before you can proceed with the remainder of the ODS Enablement. Create the Jira using the information below. Use the default assignee for this Jira (Level 1 / NOC [ sfalerts]) Project: Cloud Operations Service Request (COSR) Issue Type: Database Script Request Customer Name: Use the <BizX customer identifier> Product Module/s: BizX Core Environment Type: Production Datacentre Location: Choose the name of the data centre that matches the customer you are working on CS Ticket Number: Enter the ticket number if available otherwise enter N/a Summary: Provide the Audit Schema Name and Audit User Identifier for the instance <BizX customer identifier> Description: Please provide BizX audit schema name and audit user identifier for the instance <BizX customer identifier> SLA: P3 Customer Region: Choose the region that matches the customer you are working on Request Source: Choose Customer Success

Create JIRA to find Source schema Database Pool This step in the process requests the activation of the audit framework in Analytics for the customer. You will need to create a Jira to request this be done by the Analytics Cloud Operations team. You will need the information from the previous Cloud Operation Jira for this step. Create the Jira using the information below. Use the default assignee for this Jira (Level 1 / NOC [ sfalerts]) Project: Cloud Operations (CO) Issue Type: Customer Request Customer Name: Use the <BizX customer identifier> Product Module/s: Workforce Analytics & Planning Environment Type: Production Datacentre Location: Choose the name of the data centre that matches the customer you are working on CS Ticket Number: Enter the ticket number if available otherwise enter N/a Summary: Provide Enable the Audit Reporting Framework for the customer <BizX customer identifier> Description (Notes: copy the parameters into the description using the table on the following slide. Take care to use the information for the right data center) For the BizX customer the Audit Schema Name is <BizX audit schema name> and the Audit User is <BizX audit user>. Please run the program OracleOdsSetup using the parameters below to create the audit reporting schema: Org Id=<BizX customer identifier> Host= Port= SID= Schema= User Id= Password = SLA: P3 Customer Region: Choose the region that matches the customer you are working on Request Source: Choose Customer Success

Oracle Audit parameters per BizX Data Centre DC4 (Arizona) DC2 (Amsterdam) DC8 (Ashburn) DC12 (ROT) Org Id=<WFA customer identifier> BizX audit server support planned for post the b1308 release Host=dc4crspc1.phx.sf.priv or 10.4.40.101 Host=dc2prdcrs1.successfactors.eu (Bosch, BoschTrain, NestleCOMP, NestleQA, NestleTST, DBITest) Host=dc8orapc2 or 10.8.40.61 Port=1521 SID=dc4aud01 SID=dc2aud01 SID=dc8aud01 Schema=<BizX audit schema name> User Id=<BizX audit user id> Password=use the standard password for this data centre (same as for Akebono Brake on COSR-751) Password=use the standard password for this data centre (same as for NestleTST on CO-9500) Password=use the standard password

Step 3: Analytics Audit Reporting Instance Configuration

Enable the Revolution UI and Detailed Reporting Admin > SuccessFactors Admin > Org Local Config Admin “Use Rui” = enables the latest version of the V12 user interface. This is needed for Analytics Audit Reporting. “Use Detailed Reporting” = enable Analytics Audit Reporting Notes: This step enables the latest user interface (Revolution) and the Detailed Reporting feature. Later in this guide you will return to this screen to enable additional features here but other steps must be completed first.

ODS Table Security Editor – enable all tables for testing Admin > SuccessFactors Admin > Detailed Reporting Security Editor Select the Roles Tab Select the System role Tick the checkbox next to “Tables” Select OK Notes: This step turns on access to all tables for the System role. This will allow testing of reports (step 4) to ensure data is being generated.

Detailed Reporting testing Tools > Detailed Reporting Expand the Miscellaneous category Drag on the table called Audit Txn Log If data is returned then this confirms that the data connection between BizX and Analytics is working If no data is returned then there may be an issue with the connection string setup. Refer to the troubleshooting section at the end of this PowerPoint for assistance.

Step 4: Portal Page and Audit Standard Report Transfer

Create the default Portal page Admin  SuccessFactors Admin  Report Transfer  Transfer button “From” Organization – In DC2 (Amsterdam) choose Akebonotest and in DC4 (Arizona) choose NestleTST Select the report called 00 Audit Reporting Portal Page in Available Reports and double click it so that it appears in Selected Reports In “To” Organizations double click on the customer instance so that it appears under Selected Organizations Select Transfer Notes: The instructions on this step apply if you are implementing a customer in DC4 (Arizona). If you are implementing a customer in another Data Centre download a copy of the Portal Page from DC4 (EESALES) and upload the report to the customer instance you are working on.

Audit Standard Report Transfer A series of tasks are required to transfer the bundle of Audit Standard Reports to the new Analytics Audit Reporting customer instance. It is important that all of these tasks are completed to ensure that the reports are working correctly for the customer. Steps: At this link in Confluence there is a report package zip file containing the Audit Standard Reports. Analytics Audit Reporting Bundle: Download this package because these reports are going to be loaded on the customer’s site. Package contains 2 individual XML reports and 1 XML file containing all reports Note that as of the b1308 release there are only two standard audit reports available: 1) Proxy Report 2) Permissions Report for Non RBP.  This list will grow over time and the Platform Product management team are working on this. Unzip the bundle onto your PC. You will need them for future implementations of other customers so keep them in a safe place for next time Use the Report Transfer administration tool (Admin  SuccessFactors Admin  Report Transfer  Upload) to upload the bundle to the customers site using the single XML file containing all xx reports. Take note of any reports that failed during the upload. The reports should typically upload without errors because the audit schemas are very similar across customers.

Audit Report Publication Steps (continued): Publish the reports to the Reporting menus. This is so that end users can see the reports If you are implementing the customer in DC2 (Amsterdam) refer to the customer called Akebonotest or in DC4 (Arizona) to the customer called NestleTST for examples of how the published menus should be set up. We recommend you have the Akebono Brake or NestleTST site open in a separate browser so that you can copy and paste the appropriate text/folder names when setting up a new customer. This might be faster and ensure consistent naming conventions for folders etc across customers. Below is a screenshot of the standard reports and folder naming conventions.

Manually add the joins required for the reports Due to a current issue with the schema creation process the joins are not created automatically so this needs to be done manually at the moment to allow the reports to work. Admin > SuccessFactors Admin > Detailed Reporting Schema Editor The below joins are required to make the reports work. See the following screens for the detailed steps. TABLE FROM TABLE TO DEFAULT JOIN TYPE BI-DIRECTIONAL AUTO-JOIN COLUMN FROM COLUMN TO USER_REL_MAP AUDIT_TXN_LOG Left Outer Yes No TXN_ID GRPPERM_MAP USRGRP_MAP USERS_GROUP_ID

Manually add the joins required for the reports (USER_REL_MAP table) Click on the USER_REL_MAP table in the Tables list In the Joins panel (bottom left) select Add. Join To = AUDIT_TXN_LOG Default Join Type = left Outer Join Tick Bidirectional Select OK In the Joins From/To panel (bottom right) select Add. Join From = TXN_ID Join To = TXN_ID

Manually add the joins required for the reports (AUDIT_TXN_LOG table) Click on the AUDIT_TXN_LOG table in the Tables list In the Joins panel (bottom left) select Add. Join To = GRP_PERM_MAP Default Join Type = left Outer Join Tick Bidirectional Select OK In the Joins From/To panel (bottom right) select Add. Join From = TXN_ID Join To = TXN_ID

Manually add the joins required for the reports (GRPPERM_MAP table) Click on the GRPPERM_MAP table in the Tables list In the Joins panel (bottom left) select Add. Join To = AUDIT_TXN_LOG Default Join Type = left Outer Join Tick Bidirectional Select OK In the Joins From/To panel (bottom right) select Add. Join From = TXN_ID Join To = TXN_ID

Manually add the joins required for the reports (GRPPERM_MAP table continued) Click on the GRPPERM_MAP table in the Tables list In the Joins panel (bottom left) select Add. Join To =USRGRP_MAP Default Join Type = left Outer Join Tick Bidirectional Select OK In the Joins From/To panel (bottom right) select Add. Join From = USERS_GROUP_ID Join To = USERS_GROUP_ID

Audit Report Publication Steps (continued): Publish the reports to the Reporting menus. This is so that end users can see the reports If you are implementing the customer in DC2 (Amsterdam) refer to the customer called Akebonotest or in DC4 (Arizona) to the customer called NestleTST for examples of how the published menus should be set up. We recommend you have the Akebono Brake or NestleTST site open in a separate browser so that you can copy and paste the appropriate text/folder names when setting up a new customer. This might be faster and ensure consistent naming conventions for folders etc across customers. Below is a screenshot of the standard reports and folder naming conventions.

Report testing Confirm that the reports return results. Select them from the Reporting menu.

Environment Table configuration This step is required if the customer has a Reverse Proxy URL established (refer to slide 7). Admin > SuccessFactors Admin > Environment Admin In the Available Orgs selector choose the name of the customer To complete the fields in the tables please refer to the Environment Table Guide (link here) for the correct selections. Example of the settings for Arizona Akamai customer.

Step 5: Analytics Audit Reporting Instance Configuration

Create standard role for Analytics Audit Reporting users One standard role is created for Analytics Audit Reporting customers End User – Audit Reporting. This role has access to view audit reports that have been created by SuccessFactors. As of the b1308 release Analytics Audit Reporting customers cannot create their own reports.

Role: End User – Audit Reporting Navigate to Admin  Role Maintenance Select Tools and Add New Role. Name the End User – Audit Reporting. This will become the default role that will be assigned later in this section. In the Settings section select Edit. Under the Start Page section select the Report Book option and then in the [FOLDERS] structure choose the report called 00 Audit Reporting Portal Page under Audit Reporting in the (Default) folder. Under the Menu section select the Audit Reporting menu SAVE Under the Measure Restrictions section select the Show Restricted Measures button and then tick the Inputs section and SAVE

End User – Audit Reporting role When the user logs in it should look similar to the below. Users assigned to this role will have no permissions to any tools however they will be able to view audit reports. gives access to

Enable the Default Role Admin > SuccessFactors Admin > Org Local Config Admin “Default Auto Create User Role” set this to be End User - Audit Reporting and SAVE. This will be the role that all new users are created in.

ODS Table Security Editor – enable all tables for end users Admin > SuccessFactors Admin > Detailed Reporting Security Editor Select the Roles Tab Select the End User - Audit Reporting role Tick the checkbox next to “Tables” Select OK Important Note: This step turns on access to all tables for the End User - Audit Reporting role and will allow testing of reports by and customer audit reporting users. Only perform this step if the customer only has Audit Reporting and does not have Online Report Designer or Advanced Reporting (ODS) If the customer has any of these other products then this step will have to be performed per user

Step 6: Languages Enablement - Optional step

Enable languages through the Cloud DBI Workforce Support Tool (WST ) The recommended browser for using the WST application is Chrome. Login to the WFA application Depending on the data centre you are working in navigate to one of the following URLs DC4: https://analytics4.successfactors.com/Production/wstwebapp DC8: https://analytics8.successfactors.com/Production/wstwebapp DC2: https://analytics2.successfactors.eu/Production/wstwebapp DC12: https://analytics012.successfactors.eu/Production/wstwebapp Select DBI Org Select in the Front Office section

Adding Languages In the company list on the left select the company. Choose the Org Editor link under the Actions section.

Adding Languages (continued) Select the Languages link

Adding Languages (continued) In the Languages section select the language from the Supported Languages panel that the customer should have enabled and use the >> button to move that language to Org Languages panel. Save the changes with the Save button at the bottom of the page.

Step 7: BizX User Configuration

For customers using OneAdmin and the RBP Permission Framework OneAdmin > Set User Permissions > Manage Permission Roles > choose role > Select Permission button > Reports Permission > select Inform Reports > Done If you do not see this option, then Provisioning (Company Settings and Assertion Consumer Settings) has not been set up correctly.

For customers using the old Admin Tools and the RBP Permission Framework Admin Tools > Manage Security > Manage Permission Roles > choose role > Select Permission button > Reports Permission > select Inform Reports > Done If you do not see this option, then Provisioning (Company Settings and Assertion Consumer Settings) has not been set up correctly.

Step 8: BizX User Test Login

Accessing Analytics from BizX

Analytics Audit Reporting user creation and login In the BizX Application login with the appropriately permissioned BizX user Navigate to Analytics in the module picker and then navigate to the Analytics sub-tab You should now be logged in to Analytics Audit Reporting correctly. See example login below. The user can select a report to run it.

Sample Report Report Page – user can view the report online, or click on the excel buttons to export each list to excel

Step 9: Analytics Audit Reporting Bulk User Load - Optional step

Bulk User Load (optional step) The prior procedures (especially step 5) describe how users, needing access to Analytics Audit Reporting, can have their user accounts created “on demand”. It is also however possible for user accounts to be created in advance of their first access attempt. Doing so will ensure that these uses, prior to their first login attempt to BizX, will have already been pre-configured with the correct permissions and in the right role. This process requires the running of a bulk user load process. See next slide for details on performing this load.

Bulk Upload to link accounts Admin  SuccessFactors Admin  Bulk User Upload Using the Bulk User Load Template excel file: Columns A to F: Enter in the details of the users per the instructions in the template Columns N to O: insert SFSF details obtained from the Employee/User Export feature in Admin Analytics Audit Reporting User Maintenance Info SFSF Employee Export Note: Upload as .xls file type as .xlsx will produce error: “The uploaded file was of an incorrect file type 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'. The file must be a Microsoft Excel spreadsheet. Please try again.”

Step 10: Troubleshooting

Detailed Reporting shows no records for the Audit Txn Log table A user see the message “Role based security prevents the viewing of this component”. It is likely that the default role has not been given the permissions to see the audit table. This was done in Step 5 in the slide title ODS Table Security Editor – enable all tables for end users

Missing data in Audit Tables Either running a report or accessing a table via Detailed Reporting shows no data and you would reasonably expect there to be data in the table. Also you can’t see data in the AUDIT_TXN_LOG table. This may be because when BizX Audit Reporting was set up the customer Comprehensive (all tables) auditing was not turned on. To confirm this a Jira ticket will need to be raised for Cloud Operations to check the setup for the customer. Alternatively check the next slide for an additional troubleshooting tip.

Detailed Reporting returns no rows for the Audit Txn Log table Reproduce the issue in Detailed Reporting by dragging on the Audit Txn Log table If no rows appear check the application logs to see if the error below is appearing Admin > SuccessFactors Admin > Log Viewer > Error Log ************************************************************ 9/24/2013 6:06:30 AM, lbolwell@infohrm.com, BoschTrain Error: System.Exception: Query failed (refer to inner exception) ---> System.InvalidOperationException: OracleConnection.ConnectionString is invalid at Oracle.DataAccess.Client.OracleConnection.Open() at Hrml.DataObjects.OdsReporting.QueryEngine.HrmlOdsQueryRunner.ExecuteSql(HrmlOdsQuery query, DbCommand cmd) in c:\PWS\FrontOffice\b1308\HrmlDataObjV9\OdsReporting\QueryEngine\HrmlOdsQueryRunner.cs:line 132 ……. ************************************************************ If this error is appearing perform these steps Admin > SuccessFactors Admin > Detailed Reporting Schema Editor Select the Edit button under the Tables list.

Detailed Reporting returns no rows for the Audit Txn Log table (continued) Under Datasource select the Edit Datastores button. In the table at the bottom of the screen click on the information in the table under the Connection String heading. This should populate the values in the form and it should look similar to the screehshot shown below. In particular if the Connection String or Schema Name are missing or if the Connection Type is not Oracle then there is an issue with the connection string. Refer to WFA Engineering or Product management for assistance to correct this issue.