Identity Lifecycle Management Between OCI and Okta

Create a confidential application in OCI IAM and activate it.

1. Open a supported browser and enter the Console URL:

   https://cloud.oracle.com

2. Enter your Cloud Account Name, also referred to as your tenancy name, and select Next.
3. Sign in with your username and password.
4. Open the navigation menu and select Identity & Security. Under Identity, select Domains.
5. Select the identity domain in which you want to configure Okta provisioning and select Applications.
6. Select Add Application, and choose Confidential Application and select Launch workflow.
   

7. Enter a name for the confidential application, for example OktaClient. Select Next.
8. Under Client configuration, select Configure this application as a client now.
9. Under Authorization, select Client Credentials.
   

10. Scroll to the bottom, and select Add app roles.
11. Under App roles select Add roles, and in the Add app roles page select User Administrator and select Add.
    

12. Select Next, then select Finish.
13. In the application details page select Activate and confirm that you want to activate the new application.

You need two pieces of information to use as part of the connection settings for the Okta app you create later.

1. Return to the identity domain overview by selecting the identity domain name in the breadcrumbs. Select Copy next to the Domain URL in Domain information and save the URL to an app where you can edit it.
   

   The OCI IAM GUID is part of the domain URL:

   https://<IdentityDomainID>.identity.oraclecloud.com:443/fed/v1/idp/sso

   For example: idcs-9ca4f92e3fba2a4f95a4c9772ff3278

2. In the confidential app in OCI IAM, select OAuth configuration under Resources.
3. Scroll down, and under General Information make a note of the client ID and client secret.
4. Scroll down, and find the Client ID and Client secret under General Information.
5. Copy the client ID and store it
6. Select Show secret and copy the secret and store it.
   
   The secret token is the base64 encoding of <clientID>:<clientsecret>, or

   base64(<clientID>:<clientsecret>)

   These examples show how to generate the secret token on Windows and MacOS.

   In a Windows environment, open CMD and use this powershell command to generate base64 encoding [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes('client_id:secret'))"

   In MacOS, use

   echo -n <clientID>:<clientsecret> | base64

   The secret token is returned. For example

   echo -n 392357752347523923457437:3454-9853-7843-3554 | base64
   Nk0NzUyMzcyMzQ1NzMTc0NzUyMzMtNTQzNC05ODc4LTUzNQ==

   Make a note of the secret token value.

Create an application in Okta.

1. In the browser, sign in to Okta using the URL:

   https://<Okta-org>-admin.okta.com

   Where <okta-org> is the prefix for your organization with Okta.

2. In the menu on the left, select Applications.

   If you already have an application which you created when you went through SSO With OCI and Okta, you can use it. Select to open it and edit it, and go to 5. Change Okta Settings.

3. Select Browse App Catalog and search for Oracle Cloud. Select Oracle Cloud Infrastructure IAM from the options available.
4. Select Add Integration.
5. Under General settings, enter a name for the application, for example OCI IAM, and select Done.

Connect the Okta app to the OCI IAM confidential app using the domain URL and secret token from an earlier step.

1. In the newly created application page, select the Sign On tab.
2. In Settings, select Edit.
3. Scroll down to Advanced Sign-on Settings.
4. Enter the domain URL in Oracle Cloud Infrastructure IAM GUID.
5. Select Save.
6. Near the top of the page, select the Provisioning tab.
7. Select Configure API Integration.
8. Select Enable API Integration.
   

9. Enter the the secret token value you copied earlier in API Token.

10. Select Test API Credentials.

    If you get an error message, check the values that you have entered and try again.

    When you get a message Oracle Cloud Infrastructure IAM was verified successfully!, Okta has successfully connected to the OCI IAM SCIM endpoint.

11. Select Save.

The Provisioning to App page opens, where you can create users, update user attributes, map attributes between OCI IAM and Okta.

To test user and group provisioning for Okta:

1. In the newly created application, choose the Assignments tab.
2. Select Assign and select Assign to People.
3. Search for the user to provision from Okta to OCI IAM.

   Select Assign next to the user.

4. Select Save, and then Go Back.
5. Now provision Okta groups into OCI IAM. In the Assignments tab, select Assign and select Assign to Groups.
6. Search for the groups to be provisioned to OCI IAM. Next to the group name, select Assign.
7. Select Done.
8. Now sign in to OCI:

   1. Open a supported browser and enter the OCI Console URL:

      https://cloud.oracle.com.

   2. Enter your Cloud Account Name, also referred to as your tenancy name, and select Next.
   3. Select the identity domain in which Okta has been configured.
9. Select Users.
10. The user which was assigned to the OCI IAM application in Okta is now present in OCI IAM.
11. Select Groups.
12. The group which was assigned to the OCI IAM application in Okta is now present in OCI IAM.

• You can set users' federated status so that they're authenticated by the external identity provider.
• You can disable notification emails being sent to the user when their account is created or updated.

Congratulations! You have successfully set up user lifecycle management between Okta and OCI.

To explore more information about development with Oracle products, check out these sites:

• Oracle Developers Portal
• Oracle Cloud Infrastructure