> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup.md).
# JD Edwards Integration Setup
## Table of contents
1. [Overview](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup.md#overview-balkanid-jd-edwards-agent)
* [Where the agent runs](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup.md#where-the-agent-runs)
2. [How JD Edwards security works](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup.md#how-jd-edwards-security-works)
3. [What is extracted](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup.md#what-is-extracted)
4. [Insights and Segregation of Duties](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup.md#insights-and-segregation-of-duties)
5. [Requirements](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/installation-and-configuration.md#requirements)
6. [Installation & configuration](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/installation-and-configuration.md)
* [Required database access](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/installation-and-configuration.md#required-database-access)
* [Configuration reference](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/installation-and-configuration.md#configuration-reference)
* [Verify the connection](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/installation-and-configuration.md#verify-the-connection)
7. [Database authentication](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/database-authentication.md)
* [Option A: SQL Server login](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/database-authentication.md#option-a-sql-server-login)
* [Option B: gMSA](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/database-authentication.md#option-b-gmsa)
* [Option C: domain service account](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/database-authentication.md#option-c-domain-service-account)
8. [Running the agent](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/running-the-agent.md)
* [Using the TUI (Terminal User Interface)](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/running-the-agent.md#using-the-tui-terminal-user-interface)
* [Running as a service (headless)](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/running-the-agent.md#running-as-a-service-headless)
* [Provisioning (write-back)](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/running-the-agent.md#provisioning-write-back)
9. [Service management and troubleshooting](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/service-management-and-troubleshooting.md)
***
### Overview: BalkanID JD Edwards Agent
The BalkanID JD Edwards Agent is a cross-platform service that extracts identity-governance data from **Oracle JD Edwards EnterpriseOne 9.2** and uploads it to the BalkanID identity governance platform. It runs inside your network, on a Linux (systemd) or Windows host.
* Ships as a **single static binary**: no Oracle client, no JDBC, and no JD Edwards middleware to install.
* Extracts **users, roles, environments, objects, and the permissions between them**.
* The **database connection is read-only**. The account created by the shipped grant scripts carries an explicit `DENY` on `INSERT`, `UPDATE`, `DELETE`, `EXECUTE` and `ALTER`.
* Makes **outbound connections only**, to the JD Edwards database and to BalkanID over HTTPS. It listens on no port.
* Takes a **full snapshot every 2 hours** by default (`server.extraction_interval`).
* **Write-back is optional and disabled by default.** When enabled, every change goes through **AIS / Orchestrator**, never through the database. See [Provisioning (write-back)](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/running-the-agent.md#provisioning-write-back).
* JD Edwards World is not supported.
```mermaid
flowchart LR
subgraph net["Your network"]
agent["BalkanID JD Edwards Agent
any Linux or Windows host"]
db[("JD Edwards database
SQL Server or Oracle")]
ais["AIS server"]
end
balkanid["BalkanID"]
release["BalkanID release host"]
agent -- "TCP 1433 SQL Server
or 1521 Oracle, read-only" --> db
agent -. "HTTPS, only when
write-back is enabled" .-> ais
agent == "HTTPS 443 outbound" ==> balkanid
agent == "HTTPS 443 outbound,
update checks" ==> release
```
Every arrow starts at the agent. Nothing connects to it, and no inbound firewall rule is required. The two thick arrows are the only traffic that leaves your network. The BalkanID and release hostnames are listed under [Requirements](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/installation-and-configuration.md#requirements).
#### Where the agent runs
The agent can run on the database server, on an EnterpriseOne server, or on a host of its own. Any host that meets these three conditions will do:
* Linux with systemd, or Windows.
* Network reachability to the JD Edwards database listener.
* Outbound HTTPS on `443`.
The binary is self-contained, so the host needs no Oracle client, no JDBC and no JD Edwards middleware. A host that is not the database server usually needs a firewall rule opened to the database port.
***
### How JD Edwards security works: deny by exception
The Security Workbench table (`F00950`) stores **exceptions**, not entitlements. **No record at any level means permitted**. A user who was never granted anything is unrestricted.
For any user, object and operation, the first match wins:
1. A record keyed on the **user**.
2. A record on one of the user's **roles**. The lowest role sequence number wins.
3. A record on **`*PUBLIC`**.
4. No record anywhere: **permitted**.
EnterpriseOne does not support multilevel roles. Objects with no Security Workbench record are reported once as the [insight](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup.md#insights-and-segregation-of-duties) *"Objects permitted by absence of any Security Workbench record"*, carrying the counts of objects holding a record, objects in the catalogue, and objects open to everyone.
***
### What is extracted
| BalkanID output | Source | Key detail |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| Users | `F0092` (rows not marked `*GROUP`), Address Book | JD Edwards id, Address Book link, language / time zone / date format, default role |
| Roles | `F0092` (rows marked `ULUGRP = '*GROUP'`), described by `F00926` | `*PUBLIC` is always emitted as a role |
| Environments | `F0094` + `F00941` (path code) + `F00942` (release) | Classified production / non-production by name prefix, with the classification method recorded |
| Objects | `F9860`, plus every object named by a Security Workbench record | `*ALL` is one entity, never expanded against the catalogue |
| User → role | `F95921` | Effective and expiration dates, never-expires flag, sequence, default-role flag. Expired grants are dropped |
| User → environment | `F0093` | One edge per conferring path: the direct grant and each conferring role separately |
| Role → environment | `F0093` | Direct grants only |
| Role → object | `F00950` rows keyed on a role, including `*PUBLIC` | One edge per object and security type, carrying that type's named privileges together |
| User → object | resolved through user → role → `*PUBLIC` | Inherited decisions name the winning role; permitted-by-absence is marked as such |
| Sign-on state | `F98OWSEC`, status columns only | Enabled, last sign-on, failed attempts, password change frequency. Never password material |
| [Insights](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup.md#insights-and-segregation-of-duties) | derived from the rows above | One entity per observation, linked to the users, roles, objects and environments it names |
| [Segregation of Duties violations](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup.md#insights-and-segregation-of-duties) | derived from the rows above | A 38-rule matrix evaluated on effective access, emitted as one insight per rule per environment |
Privileges are named rather than generic: `run`, `install`, `add`, `change`, `delete`, `view`, `copy`, `select`, `promptForValues` and `promptForVersion`, scoped per security type (action, column, application, row, processing option, tab, exclusive application, external call, Solution Explorer, media object).
No business data is read: no transactions, vouchers, journal entries, payroll, purchase orders or GL.
***
### Insights and Segregation of Duties
An **insight** is a security observation the agent derives from the data it extracted. Each one is emitted as its own entity and linked to the users, roles, objects and environments it concerns, alongside a severity, a description, suggested mitigations and notes for your instance.
Four of the observations the agent reports:
* *"Security Workbench (P00950) Accessible Outside CNC"*
* *"Development And Design Tools Runnable In Production"*
* *"Seeded Default Account Enabled"*
* *"Stale Privileged Account"*
A **Segregation of Duties violation** is one kind of insight, raised where a single principal can reach two applications that should be held apart. There are 38 rules, covering Procure-to-Pay, Order-to-Cash, Record-to-Report, HR / Payroll, Inventory, Fixed Assets and ITGC. Two of them:
* *"Supplier Master + Payment Processing"*, pairing supplier master maintenance (`P04012`) with payment processing (`R04570` / `P04571` / `P0413M`).
* *"Journal Entry + General Ledger Post"*, pairing journal entry (`P0911`) with general ledger post (`R09801`).
A violation is raised once per rule per environment, so the same person can be clean in Development and in violation in Production. Outside a production environment the severity drops one level. Other insights carry every environment they concern.
Both can be turned off in the `security` block of the configuration, with `disable_insights` and `disable_sod`.
***
Continue with [Requirements](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/installation-and-configuration.md#requirements) and [Installation & configuration](/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup/installation-and-configuration.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.balkan.id/getting-started/setting-up-your-tenant/application-integrations/direct-application-integration/jd-edwards-integration-setup.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.