Mirror of Oracle documentation
Converted for search and offline reading. Authoritative source: Oracle. Diagrams and some complex tables are simplified — check the PDF when in doubt.
4 Merchandising Cloud Service Suite Architecture
Merchandising Cloud Service Suite is a set of ADF-based Java applications deployed on Oracle’s Global Business Unit Cloud Services Foundation Services. The applications are deployed in a highly available, high performance, horizontally scalable architecture. As of release 16.0.030, Merchandising Cloud Services uses either Oracle Identity Cloud Service (IDCS) or Oracle Cloud Infrastructure Identity and Access Management (OCI IAM) as its identity provider (IDP). Information about logical, physical and data architecture in this document focuses on how the architecture supports security.
Architecture Overview
Most customer access to the Merchandising Cloud Service is via the web tier. The web tier contains the perimeter network services that protect the Merchandising applications from the internet at large. All traffic from the web tier continues to the Web Tier Security Server (WTSS), which in turn uses the customer’s Oracle Cloud Infrastructure Identity and Access Management (OCI IAM) tenancy to perform authentication. More information about OCI IAM is available in the Oracle Retail Identity Management for OCI IAM Startup Guide.https:// docs.oracle.com/en/industries/retail/retail-identity-management/latest/idmsg/F75576_01.pdf
The Merchandising applications are containerized and deployed in a Kubernetes cluster. Scheduling of batch processes is provided by Job Orchestration and Scheduling (JOS). Reporting is provided by an OBIEE instance which can connect to the underlying database.
The underlying container DBaaS includes one pluggable database (PDB) for Merchandising. Applications are able to access the Merchandising schema on the Merchandising PDB. Transparent data encryption (TDE) is set during provisioning. Tablespaces that contain personal data are encrypted.
Merchandising Cloud Service Suite applications integrate with external business systems via:
-
Native files upload/download
-
Native Rest Services
-
Retail Integration Cloud Service, which includes Retail Integration Bus (RIB), Retail Service Bus (RSB) and Bulk Data Integration (BDI)
-
Files via service based upload to Object Storage. All inbound files are scanned by antivirus and anti-malware software.
Merchandising Cloud Service Suite authenticates native rest services using OAUTH2.0 via OCI IAM. As a common authentication pattern is used, web service users are subject to the same strong controls as application users. All rest service calls are logged in the application logs.
OAuth2.0 based authentication is the defacto standard to be adopted by all customers. OAuth2.0 is preferred primarily over Basic Auth as it has enhanced security, granular access and also helps customers stay within their OCI IAM service usage limits. Basic Auth is no longer supported.
AuthN, WTSS sends a call to the reverse proxy ingress controller, which routes to the appropriate application component (6).
- Pre Authenticated Request (PAR) service calls can drop/collect files from Object Storage (2).
Access to the underlying DBaaS is only available via the application M-Tier (7). The M-Tier is able to get and place files into object storage (8), which in turn allows the exchange of files with the Retailer (2). Both outbound web service traffic (11) and replication of data (12) are routed through the outbound proxy in the DMZ.
A subset of Oracle Retail AMS has very limited access to the underlying M-Tier (15). This access is limited to a small subset of Oracle employees as described in Oracle’s Cloud Hosting and Delivery policy.
-
-
-
- https://www.oracle.com/assets/ocloud hosting delivery policies 3089853.pdf
-
-