1. Public
Single Sign-On for EPM Cloud Using Oracle Identity Cloud Service (IDCS)
Question: How can I set up single sign-on (SSO) between EPM Cloud services in different ID domains or data centers?
Question: Does EPM Cloud support SSO with IDCS?
Question: Does EPM Cloud support IDCS?
Question: How can I set up a single point of control to invoke all my EPM Cloud Services in different data centers?
August, 2017

2. Oracle Identity Cloud Service (IDCS)
Oracle’s next generation comprehensive security and identity platform that is cloud-native and designed to be an integral part of the enterprise security fabric, providing modern identity for modern applications
Provides a powerful set of hybrid identity features to maintain a single identity for each user across their on-premise and in the cloud services while delivering a seamless user experience
Question: What is Oracle Identity Cloud Service?
Question: What is IDCS?
IDCS documentation:

3. The value of IDCS for EPM Cloud
IDCS provides a single point of invocation for all Oracle cloud service instances, including EPM Cloud, across all data centers
IDCS provides users ability to sign in once into IDCS and gain one-click access to all Oracle cloud service instances, including EPM Cloud, across all data centers

4. SSO Flow – 2 Options
Access an EPM Cloud instance, and use IDCS to authenticate the user
Access an IDCS instance, and navigate to the EPM Cloud instances from there
Question: How can I connect to EPM Cloud using IDCS?
Question: How can I authenticate EPM Cloud using IDCS?

5. IDCS as the Launch Pad for EPM Cloud Services
Create EPM and non- EPM Cloud Service instances as SAML applications in IDCS, using user-friendly names and icons
Launch these service instances from within IDCS

6. Setting up SSO Between an EPM Cloud Instance and IDCS
Step 1
Step 2
Step 3
Add the EPM Cloud service as a SAML application in IDCS
Create users, and provision them appropriately
Question: How do I set up SSO for EPM Cloud with IDCS?
Question: How is SSO between EPM Cloud and IDCS set up?
EPM Cloud SSO documentation: fa-netsuite pdf
Configure SSO

7. Adding EPM Cloud Service as a SAML Application in IDCS – 1 of 3
Log in to the IDCS instance, and click + next to Applications
Click SAML Application
Enter EPM Cloud information, and click Next
IDCS technical documentation: oracle-cloud-identity-service.pdf

8. Adding EPM Cloud Service as a SAML Application in IDCS – 2 of 3
Enter General SSO information
The Entity ID and Assertion Consumer URL must specify the identity domain for which SSO is being configured.
Enter Advanced Settings
Click Download IDCS Metadata, save it for future use, and click Finish

9. Adding EPM Cloud Service as a SAML Application in IDCS – 3 of 3
Click +Assign to assign selected users to the application
Select EPM Cloud Services application, and click Activate
Click Activate Application

10. Creating Users and Provisioning Them – 2 Options
Adding users one-by-one
Bulk upload of users
Documentation on adding users and assigning roles: started/subscriptions-cloud/csgsg/adding-users-and-assigning-roles.html

11. Adding users one-by-one – 1 of 2
In My Services, log in as Identity Domain Administrator, and click Users
In Users page, click Add
Enter the user information
Documentation on creating a user and assigning a role: started/subscriptions-cloud/csgsg/creating-user-and-assigning-role.html

12. Adding users one-by-one – 2 of 2
Select the EPM Cloud service instance from the drop-down menu, select appropriate roles for the user, and press the arrows
Press Add

13. Bulk upload of users – 1 of 2
In My Services, log in as Identity Domain Administrator, and click Users
In the Users page, click Import
Click Browse to select the local CSV file that has user information in the following format, and click Import
Documentation on bulk upload of users: cloud/csgsg/importing-batch-user-accounts.html

14. Bulk upload of users – 2 of 2
Select Roles tab
Click Batch Assign Role
Select a role for the EPM Cloud service instance from the drop-down menu, click Browse to select the local CSV file that has user information in the following format, and then click Assign
Documentation on assigning a role to many users: started/subscriptions-cloud/csgsg/assigning-one-role-many-users.html

15. Configuring SSO – 1 of 3
In My Services, under SSO Configuration, click Configure SSO
Import the IDCS metadata file that was exported earlier
Under Configure your identity Provider information, select Signing Certificate in the drop-down list of Export Metadata, and then export the SP signing certificate
Oracle Cloud SSO setup documentation: cloud/csimg/managing-oracle-single-sign.html

16. Configuring SSO – 2 of 3
Click Upload under SSO Configuration in IDCS to import the SP signing certificate
In My Services, click Test under Test your SSO
Click Start SSO

17. Configuring SSO – 3 of 3
Ensure that SSO is successful