X

Oracle Customer Engineering & Advocacy Lab (CEAL) Blog covers Oracle Analytics Cloud, Oracle Analytics Server and...

Prerequisites for Implementing Fusion HCM Analytics

Ravi Guddanti
Principal Member of Technical Staff

Run HCM Diagnostics
    Add Necessary User Access for Running Diagnostics Test
    Example: Running Master Report - Person Diagnostic
    List of Recommended Diagnostic Tests to be Run
Schedule ESS Jobs
    Refresh Manager Hierarchy
    Run Reassign Pending Approvals for Terminations and Correct Invalid Supervisor Assignments Process
FAWService User
    Reset Password for FAWService User
    Password maintenance - Recommendation
Verify LBAC Setting
    Is LBAC Enabled on your Fusion pod?
    How LBAC affects Fusion HCM Analytics Provisioning and Pipeline Activation?
    Create Custom Roles and Assign to FAWService User

Data Pipeline Configurations 
    Pipeline Parameters
    Report Parameters


Many thanks for providing valuable input:
    Manisha Gupta, Senior Director, Product Management, Fusion HCM Analytics
    Nupur Joshi, Senior Product Manager, Fusion HCM Analytics

 

Run HCM Diagnostics
Fusion Cloud provides a prebuilt set of diagnostic tests that can be used, to identify cases beforehand and corrective diagnostics to correct most of the data inconsistencies observed in Fusion data that may lead to data pipeline omitting the records either completely or partially. In this Section we list all such diagnostic tests that are advised to run manually or automated before every pipeline run to avoid any data related issues cropping up as inconsistencies in data across FAW.

Add necessary user access for running diagnostics test
FA user must be assigned Application Diagnostics Administrator role in Fusion Cloud. Without this role assigned, the user can not view the Run Diagnostic Tests link from the Settings and Actions menu on global header. 

  • Log in with a user account with access to Security Console 
  • From the user accounts tab, search for the user who needs to be granted access to diagnostics framework. 
  • Click Edit button to edit User Account Details and assign the required role
  • Click Add Role and search for Application Diagnostics Administrator role. Click Add Role Membership button
  • Click Done, then Save and Close

Log in as the user who has been assigned with Application Diagnostics Administrator role and confirm that the user can see Run Diagnostics Tests link in the dropdown:

  • Click Run Diagnostics Tests 

Example – Running Person Diagnostic Auto Correct

  • Launch Run Diagnostics Tests dashboard page
  • Search for Person Diagnostic Auto Correct in the Search for Tests section. Select the check box on the test name and click Add to Run. 
  • Add input parameters 
    • Run Mode: The two options for this parameter are Validate and Commit. If the diagnostic test is run in Validate mode, the changes made by the diagnostic test will be rolled back at the end instead of being committed to the database. If the diagnostic test is run in Commit mode, the changes made by the diagnostic test will be committed to the database.
    • Corruption Type: Reference My Oracle Support Note: 
      Fusion Global HR: Corruption Type in Person Diagnostic Auto Correct Report (
      Doc ID 2619978.1)
  • Enter a name in the Run Name box, then click Run. Run Name is helpful for tracking, it is not mandatory though.
  • Once the test run is completed, the execution status changes to Completed. 
  • Click on the icon under Report column in the Diagnostic Test Run Status table. A detailed page is displayed. 
  • Click the link under Exeuction ID column to load the execution output of the test.    

List of Recommended Diagnostic Tests to be Run

  1. Person Diagnostic Autocorrect
    Purpose: To correct any overlapping records in the legislative information data table on Fusion Cloud.
    How it helps: These are considered as erroneous records and hence do not get synced to FAW data warehouse, resulting in a data mismatch between Fusion and FAW.
  2. Complete list of Employment, Person & workforce data integrity diagnostic test
    Example: Employment Data Integrity Report, Person Search Keywords Integrity 
    Purpose: Data integrity issues and any possible data fixes in a faster and more efficient manner. To achieve this objective, you can run various diagnostic tests to view and correct the records having data integrity issues. 
    Reference Oracle Support document - Self-Service Data Integrity Framework for Global Human Resources Flows (Doc ID 
    2408220.1)
    How it helps: Proactive measure to identify data inconsistencies between FAW and source. 

Schedule ESS Jobs
Refresh Manager Hierarchy
In Fusion Cloud, Navigate to Tools -> Scheduled Processes. Search for Refresh Manager Hierarchy


For performance reasons, the complete manager hierarchy for each person is extracted from live data tables and stored in a separate manager-hierarchy table, known as the denormalized manager hierarchy. For populating manager hierarchy dimension, FAW architecture refers to underlying application hierarchy tables being refreshed by this process. In event of this process not run on Fusion HCM application before data is loaded in to the warehouse (pipeline activation), it may lead to erroneous data being imported to the warehouse or missing data. 

References:
https://cloudcustomerconnect.oracle.com/posts/a0d51da0ec

My Oracle Support Note: 
Fusion Global HCM: How to run Refresh Manager Hierarchy process (Doc ID 
2529816.1

Run Reassign Pending Approvals for Terminations and Correct Invalid Supervisor Assignments Process
Here's what the process does:  

  • It reassigns the direct reports of a terminated manager to that person's line manager and also assigns any pending notifications to the line manager. Only actionable notifications will be reassigned.  
  • It reassigns pending approval notifications based on the number of days you specify using the Past Period in Days Considered for Reassigning Pending Approvals parameter.

Reference:
Video tutorial on how to schedule job processes in Fusion:
https://docs.oracle.com/en/cloud/saas/applications-common/20c/oacpr/scheduled-processes.html#OACPR1517340

FAWService – Seeded User:
The FAWService user is a predefined user provisioned in Oracle Applications Cloud and is used by the data pipeline functionality in Fusion HCM Analytics. This user account has the appropriate data security privileges granted on the Oracle Applications Cloud view objects to bulk extract data from Oracle Applications Cloud into FAW.
Reset password


If this user account is inactivated in your pod, please activate and reset its password. 

  • Login to Fusion with a user who has Security Admin role/IT Security Manager)
  • Then, go to Tools -> Security Console 
  • Search for user FAWService (Note: This user is already seeded in Fusion)
  • Under actions for this user - Select Reset Password
  • Choose to manually reset the password

Reference: 
https://docs.oracle.com/en/cloud/get-started/subscriptions-cloud/mmocs/resetting-user-passwords.html

FAWService user password – recommendations
Either Fusion Applications cloning or Fusion Applications Production to Test (P2T) refresh could reset FAWService user password. When this happens, data pipeline jobs fail due to invalid Fusion credentials. To resolve this, FAWService password needs to be updated in OCI console.

  • Sign into OCI Console (https://console.<dataregion>.oraclecloud.com/)
  • From the left navigation menu, go to Analytics -> Fusion Analytics Warehouse
  • Click on the instance name
  • Click on Update Fusion Connection 
  • Enter the new password for FAWService, test connection and save changes. 

Important: 
To avoid performing this manual step each time FAWService user in Fusion Application gets reset due to P2T or Cloning or password expiry – you can rather choose to maintain the same password between both Fusion Applications (source and target).  
Verify LBAC Setting
Location Based Access Control (LBAC) is a method which allows users connecting from an approved IP address to access the Fusion HCM application with their "full roles and rights". The approved IP addresses are listed in the "IP Address Whitelist" section of the Security Console (see screenshot below). If the Fusion HCM application URL (<podname>.<dataregion>.oraclecloud.com) is accessed from an IP address which is not listed in the "IP Address Whitelist" section of the Security Console, then by default that user will only be given access to public roles. When LBAC is configured, roles can be marked as public from the security console. These public roles will take effect when logging in from an unlisted IP address.
Is LBAC enabled on your Fusion pod?
Navigate to Security Console -> Click on Administration, go to Location Based Access tab.

Reference:
https://blogs.oracle.com/fusionhcmcoe/enabling-lbac-location-based-access-control
How LBAC affects Provisioning and Pipeline Activation for Fusion HCM Analytics?

Provisioning and Data Pipeline use FAWService user for orchestrating Fusion extract jobs. Most of the seeded roles assigned to FAWService are private, which means, FAWService user when accessing/connecting to Fusion from a location that is unlisted (IP is not whitelisted), the private roles that the user is associated with, get filtered out and won't get assigned. Unless the connection is made from a server whose IP address is whitelisted/approved, FAWService won't get assigned full roles & rights. This causes following issues during provisioning of FAW instance and during pipeline execution.  

  1. During provisioning:
  2. During Pipeline Execution: 
    Data pipeline jobs fail due to authentication issues with FAWService. 

Resolution
Important: This section applies only if Fusion instance has lbac enabled.
Mark required roles for FAWService – Public
Create copies of following predefined roles and enable them for access from all IP addresses: 

  1. Rest API Extract Privilege (role code: BICC_REST_EXTRACT_PRIV)
  2. Upload and download data from on-premise system to cloud system (role code: OBIA_EXTRACTTRANSFORMLOAD_RWD)

Steps for Creating Custom Roles

  1. Log in to Fusion Cloud and navigate to Security Console -> Roles 
  2. Click on Create Role
  3. Create a new custom role, provide a name and code. Example:
    Name: CustomCopy Rest API Extract Privilege
    Code: COPY_BICC_REST_EXTRACT_PRIV

  4. Click Next, on Role Hierarchy step add seeded role membership Rest API Extract Privilege (role code: BICC_REST_EXTRACT_PRIV) 


  5. Click Next, on Users step – add FAWService user to the role

  6. Save and close

Important: 
Repeat steps above, from a) till f) and create another custom role:
Role name:  CustomCopy Upload and download data from on-premise system to cloud system
Role code:   COPY_OBIA_EXTRACTTRANSFORMLOAD_RWD
Add seeded role membership Upload and download data from on-premise system to cloud system (role code: OBIA_EXTRACTTRANSFORMLOAD_RWD) to this new role.

FAWServer user would have 2 new public roles added:

Configuration
Global Parameters 
Set values for global pipeline parameters:

  • Log in to FAW Home (https://<tenancy>.data.analyticsapps.<dataregion>.ocs.oraclecloud.com/ui/oax/
  • From left navigation menu, go to Console 

  • Click on Data Pipeline tile
  • Click on Pipeline Parameters.
  • Set values for the three global parameters. 
    For example:

Reference: https://docs.oracle.com/en/cloud/saas/analytics/fawag/configure-oracle-analytics-applications-data.html

Report parameters
Note: Report parameters can be modified, if needed, as many times as required. Changes take effect after the subsequent data load has been run.
On Data Pipeline configuration page, click on Report Parameters tile:


Following screenshots show bands configuration:

  1. Worker Age Band
  2. Tenure Band
  3. Performance Band
  4. Potential Band

    Reference: 
    https://docs.oracle.com/en/cloud/saas/analytics/fawag/configure-oracle-analytics-applications-data.html#GUID-5101519D-4D99-4FF7-AC17-A218EA12A52F

Join the discussion

Comments ( 1 )
  • Manisha Gupta Friday, August 21, 2020
    Beautifully done Ravi. Thank you
Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.