Skip to main content

Targeting Oracle NetSuite

For each NetSuite system, add a target system in Bravura Security Fabric (Manage the system > Resources > Target systems):

Type is Oracle NetSuite

In the Type dropdown menu, Oracle NetSuite is located under the Customer Relationship Management Systems category.

Address uses options described in the table below:

Option

Description

URL

The NetSuite API server URL (e.g., suitetalk.api.netsuite.com)

(key: server)

Account ID

NetSuite account ID (e.g., 3456789_sb2 for sandbox, 3456789 for production). The account ID is case-sensitive and must match NetSuite's format exactly.

(key: accountId)

Client ID

OAuth 2.0 client ID from the NetSuite integration record (Consumer Key)

(key: clientId)

Certificate ID

Certificate ID assigned by NetSuite when you upload the public certificate

(key: certificateId)

Private key

Full path to the private key file (e.g., C:\Program Files\Bravura Security\Bravura Security Fabric\certs\netsuite_private_key.pem)

(key: privateKey)

Signature Algorithm

JWT signature algorithm (e.g., PS256 for RSA, ES256 for ECDSA). This field is located in the Advanced section of the target configuration.

(key: signatureAlgorithm)

Only list users with access

When enabled, only employees with Give Access = True are included in user listings. Employees without access are excluded from list results and group membership. Default: off (all employees are listed regardless of access status). This option is located in the Advanced section of the target address configuration. See Only list users with access for more information.

(key: listUsersWithAccess)

The full list of target system parameters is explained in Target System Options .

Setting the administrator credentials

The NetSuite connector uses OAuth 2.0 with JWT bearer tokens for authentication. No traditional username/password credentials are required. The connector will automatically obtain and refresh access tokens using the configured address attributes (Client ID, Certificate ID, and Private Key).

Required: You must configure placeholder credentials to prevent warning messages:

  1. Navigate to the Credentials tab

  2. Set Administrator ID to: oauth

  3. Set Password to: not-used

These placeholder credentials are not validated or used by the connector, but are required to prevent warning messages about missing credentials. All authentication is handled through OAuth 2.0 using the address attributes configured above.

Handling account attributes

You can view the complete list of attributes that Bravura Security Fabric can manage, including native and pseudo-attributes, using the Manage the system (PSA) module. To do this, select Oracle NetSuite from the Manage the system > Resources > Account attributes > Target system type menu.

The following NetSuite attributes are automatically loaded and mapped to profile attributes by the connector:

  • First name (firstname)

  • Last name (lastname)

  • Email (email)

Additional supported NetSuite attributes that can be managed by Bravura Security Fabric:

Bravura Attribute

NetSuite Field

Type

Description

id

id

String

Employee internal ID (primary key)

email

email

String

Employee email address

entityid

entityId

String

Employee entity ID (username)

externalid

externalId

String

External system ID

firstname

firstName

String

First name

giveaccess

giveAccess

Boolean

Access enabled flag

isinactive

isInactive

Boolean

Inactive status flag

lastname

lastName

String

Last name

middlename

middleName

String

Middle name

supervisor

supervisor

String

Supervisor employee ID

title

title

String

Job title

department

department.name

String

Department name

subsidiary

subsidiary.name

String

Subsidiary name

Only list users with access

The following behavior applies when Only list users with access is enabled:

  • List users: Only employees with Give Access = True are returned. The user count is reduced compared to the default (off) behavior.

  • List group members: Group names are still listed, but members with Give Access = False are excluded from group membership results.

  • Supervisor attribute: When listing attributes for a user whose supervisor has Give Access = False, the supervisor attribute is suppressed and not returned.

  • Update with no-access supervisor: If an update operation attempts to set a supervisor to an employee with Give Access = False, the operation fails with the error "Could not resolve 'supervisor'."

  • Group-only listing: Group name listing without members is not affected by this option.

In this section: