Run HCM Diagnostics on Cloud HCM
    Add Necessary User Access for Running Diagnostics Test
    Example – How to run a diagnostic test?
    Recommended Diagnostic Tests to Run
         Overlapping Line Managers
         Manager Hierarchy Loop Detection
         Person Diagnostic Auto Correct
Schedule ESS Jobs
    Refresh Manager Hierarchy
    Run Reassign Pending Approvals for Terminations and Correct Invalid Supervisor Assignments Process
Verify LBAC Setting
    Is LBAC Enabled on your Fusion pod?
    How LBAC affects Fusion HCM Analytics Provisioning and Pipeline Activation?
    Create Custom Roles and Assign to FAWService User


Many thanks for providing valuable input:
    Manisha Gupta, Senior Director, Product Management, Fusion HCM Analytics
    Nupur Joshi, Senior Principal Product Manager, Fusion HCM Analytics

Run HCM Diagnostics on Cloud HCM
Oracle Cloud HCM provides a prebuilt set of diagnostic tests that can be used to identify data inconsistencies beforehand and corrective diagnostics to fix most of the inconsistencies observed in Fusion data. In the event the inconsistencies in Fusion data are left unresolved then it would lead to data pipeline rejecting the records (either fully or partially) from loading into the warehouse base tables. In this section we list all such diagnostic tests that are advised to be run either manually or automated before every pipeline execution to avoid any data related issues in Fusion HCM Analytics. 

Add necessary user access for running diagnostics test
User must be assigned Application Diagnostics Administrator role in Cloud HCM. Without this role assigned, the user cannot view the Run Diagnostics Tests link from the Settings and Actions menu on global header. 

  • Log in with a user account with access to Security Console 
  • From the user accounts tab, search for the user who needs to be granted access to diagnostics framework. 
  • Click Edit button to edit User Account Details and assign the required role
  • Click Add Role and search for Application Diagnostics Administrator role. Click Add Role Membership button
  • Click Done, then Save and Close

Log in as the user who has been assigned with Application Diagnostics Administrator role and confirm that the user can see Run Diagnostics Tests link in the dropdown:

  • Click Run Diagnostics Tests 

Example – Running Person Diagnostic Auto Correct 

  • Launch Run Diagnostics Tests dashboard page
  • Search for Person Diagnostic Auto Correct in the Search for Tests section. Select the check box on the test name and click Add to Run. 
  • Add input parameters 
  • Enter a name in the Run Name box, then click Run. Run Name is helpful for tracking, it is not mandatory though.
  • Once the test run is completed, the execution status changes to Completed. 
  • Click on the icon under Report column in the Diagnostic Test Run Status table. A detailed page is displayed. 
  • Click the link under Exeuction ID column to load the execution output of the test.    

Recommended Diagnostic Tests to Run
Following diagnostics tests are recommended to be run in Cloud HCM before running “Refresh Manager Hierarchy” scheduled process in case Fusion Analytics pipeline detects rejected records in below mentioned data warehouse tables. This information can be retrieved from “Common – Warehouse Refresh Statistics” subject area. 

Details of Cloud HCM Diagnostics Test

  • Overlapping Line Managers – Reports: This diagnostic test is dealing with cases where an assignment has more than one Line Manager present at a given point of time. This is a corruption because an assignment can only have a single Line Manager at a time. This constraint does not apply to other types of managers.  
  • Manager Hierarchy Loop Detection – Report: This diagnositc test is dealing with Manager Hierarchy loop related corruptions. Suppose following line manager hierarchy is already present in the system A-> B-> C. If line manager relationship as C-> A is also present in the system, then it is called a Manager Hierarchy loop. If there are one or more manager hierarchy loops present in the source data, such corrupted data can lead to issues with submitting/completing employment transactions. 
  • Post above two processes are run and corrective measures have been taken, if any required then please schedule one ad-hoc run for “Refresh Manager Hierarchy” schedule processes. Otherwise also, this process should be scheduled to run at a regular inverval. ​​​​​​
  • Person Legislative Information Data Corruption: Following diagnostics test is recommended to be run in Cloud HCM when below mentioned table(s) have rejected records in Fusion Analytics pipeline run:

Person Diagnostics Auto Correct: This diagnostic test is dealing with Person related data corruptions that can be resolved without needing to take any “decision related input” from the user..

Additional Reference – Oracle Support document – Self-Service Data Integrity Framework for Global Human Resources Flows (Doc ID 2408220.1)

Schedule ESS Jobs
Refresh Manager Hierarchy
In Fusion Cloud, Navigate to Tools -> Scheduled Processes. Search for Refresh Manager Hierarchy


For performance reasons, the complete manager hierarchy for each person is extracted from live data tables and stored in a separate manager-hierarchy table, known as the denormalized manager hierarchy. For populating manager hierarchy dimension, Fusion Analytics architecture refers to underlying application hierarchy tables being refreshed by this process. In event of this process not run on Fusion HCM application before data is loaded in to the warehouse (pipeline activation), it may lead to erroneous data being imported to the warehouse or missing data. 

Refresh Manager Hierarchy Process model options


Run Reassign Pending Approvals for Terminations and Correct Invalid Supervisor Assignments Process
Here’s what the process does:  

  • It reassigns the direct reports of a terminated manager to that person’s line manager and also assigns any pending notifications to the line manager. Only actionable notifications will be reassigned.  
  • It reassigns pending approval notifications based on the number of days you specify using the Past Period in Days Considered for Reassigning Pending Approvals parameter.


Verify LBAC Setting
Location Based Access Control (LBAC) is a method which allows users connecting from an approved IP address to access the Fusion Cloud HCM application with their “full roles and rights”. The approved IP addresses are listed in the “IP Address Whitelist” section of the Security Console (see screenshot below). If the Cloud HCM application URL (<podname>.<dataregion>.oraclecloud.com) is accessed from an IP address which is not listed in the “IP Address Whitelist” section of the Security Console, then by default that user will only be given access to public roles. When LBAC is configured, roles can be marked as public from the security console. These public roles will take effect when logging in from an unlisted IP address.

Is LBAC enabled on your Fusion pod?
Navigate to Security Console -> Click on Administration, go to Location Based Access tab.


Reference:
https://blogs.oracle.com/fusionhcmcoe/enabling-lbac-location-based-access-control

How LBAC affects Provisioning and Pipeline Activation for Fusion HCM Analytics?

Provisioning and Data Pipeline use FAWService user for orchestrating Fusion extract jobs. Most of the seeded roles assigned to FAWService are private, which means, FAWService user when accessing/connecting to Fusion Cloud HCM from a location that is unlisted (IP is not whitelisted), the private roles that the user is associated with, get filtered out and won’t get assigned. Unless the connection is made from a server whose IP address is whitelisted/approved, FAWService won’t get assigned full roles & rights. This causes following issues during provisioning of Fusion Analytics instance and during pipeline execution.   

  1. During provisioning:
  2. During Pipeline Execution: 
    Data pipeline jobs fail due to authentication issues with FAWService. 

Resolution
Important: This section applies only if Cloud HCM instance has LBAC enabled.

Mark required roles for FAWService – Public
Create copies of following predefined roles and enable them for access from all IP addresses: 

  1. Rest API Extract Privilege (role code: BICC_REST_EXTRACT_PRIV)
  2. Upload and download data from on-premise system to cloud system (role code: OBIA_EXTRACTTRANSFORMLOAD_RWD)

Steps for Creating Custom Roles

  1. Log in to Fusion Cloud and navigate to Security Console -> Roles 
  2. Click on Create Role
  3. Create a new custom role, provide a name and code. Example:
    Name: CustomCopy Rest API Extract Privilege
    Code: COPY_BICC_REST_EXTRACT_PRIV
  4. Click Next, on Role Hierarchy step add seeded role membership Rest API Extract Privilege (role code: BICC_REST_EXTRACT_PRIV) 


  5. Click Next, on Users step – add FAWService user to the role

  6. Save and close

Important: 
Repeat steps above, from a) till f) and create another custom role:
Role name:  CustomCopy Upload and download data from on-premise system to cloud system
Role code:   COPY_OBIA_EXTRACTTRANSFORMLOAD_RWD
Add seeded role membership Upload and download data from on-premise system to cloud system (role code: OBIA_EXTRACTTRANSFORMLOAD_RWD) to this new role.

FAWService user would have 2 new public roles added:


 

To learn more about Oracle Fusion HCM Analytics,  Click Here 
Follow us on Twitter@OracleAnalytics