Identity Federation

1. Navigate to the OCI Console at https://cloud.oracle.com.
2. Enter your Cloud Account Name, also referred to as your tenancy name, and click Next.
3. Select the identity domain to sign in to. For OracleDB for Azure, you will use the Default domain.
4. Sign in with your admin user name and password.
5. Open the navigation menu and click Identity & Security. Under Identity, click Domains.
6. In the list of domains, click the name of the domain you want to view. For OracleDB for Azure, you will use the Default domain.
7. On the domain's Overview page, click Applications in list of links under Identity domain.
8. Click Add application and select Confidential Application .
9. Click Launch workflow.
10. In the Add Confidential Application workflow, enter a Name for your application. For example, "AzureSCIMProvisioningApplication".
11. Click Next at the bottom of the page.
12. On the Configure OAuth page, in the Client Configuration section, select Configure this application as a client now.
13. Under Authorization, select Client Credentials.
14. Under Client type, select Confidential.
15. In the Token issuance policy section, select Add App Roles.
16. In the App roles table, click the Add roles button.
17. In Add app roles panel, in the list of app roles, select User Administrator, then click Add.
18. Click Next.
19. On the Configure policy page, under Web Tier Policy, select Skip and do later.
20. Click Finish to create the application.

21. On the details page for the application you just created, in the General Information section, locate the Client ID and Client secret fields. Copy these values into a text editor and format them as follows, using a colon (":") character as a delimiter between them:

    <client_id>:<client_secret>

22. Create a base64 encoded value using this string and store it in a safe place. You will need the base64 encoded value during your federation setup.

OCI allows you to use a special URL to download the SAML service provider metadata. The download URL is formatted as follows:

https://idcs-<Service-Instance-Number>.identity.oraclecloud.com/fed/v1/metadata

1. Sign in to the Azure portal.
2. Under Azure services, click Azure Active Directory.
3. In the left pane, click Enterprise applications.
4. Click + New Application.
5. Click + Create your own application.
6. Provide a name for your application in the name field. For example, "OCI IAM Domain SAML Service Provider".
7. Select the Integrate any other application you don't find in the galley (Non-gallery) radio button.
8. Click Create. It will take few moments for Azure to create the application.
9. On your application's Overview page, click Single sign-on in the left pane under Manage.
10. Select SAML for the single sign-on method.
11. Click Upload metadata file.
12. In the Upload metadata file dialog, click the folder icon, then navigate to the locally-saved OCI ID metadata file (IDCSMetadata.xml)
13. Select the metadata file, and then click Add. The pre-configured metadata from the file is used to create the application.
14. In the Basic SAML Configuration panel, click Save. Close the panel after the save operation completes.
15. Locate the Federation Metadata XML field in the SAML Signing Certificate section and click the Download link. You will use this file to create an Identity Provider resource in OCI. This resource will allow OCI's Identity service to federate with Azure Active Directory.
16. In the left pane, click Users and groups.
17. Click + Add user/group.

18. On the Add Assignment pane, select None Selected under Users and groups or Users.

19. Search for and select the user or group that you want to assign to the application. For example, you can search on a user name such as odsauser1@liilca.com. Search and add additional users or groups, as needed.

20. Review the list of Selected items, then click Select.

21. On the Add Assignment pane, select Assign at the bottom of the pane.

1. Sign into your OCI account at https://cloud.oracle.com.
2. Provide the tenancy name.
3. Select the "Default" domain.
4. Provide the user credentials. Make sure your OCI user has the necessary administrative privileges required to configure identity federation in your OCI account.
5. Open the navigation menu and click Identity & Security.
6. Click Domains under the Identity heading.
7. Select your compartment.
8. In the list of domains, locate the Default domain and click the domain's name.
9. Click Identity providers under Security.
10. Click the Add IdP button and select the Add SAML IdP option.
11. Under Add details, provide a name for the identity provider. Optionally, you can add a description of the identity provider. Then click Next.
12. On the Configure IdP screen, select Import identity provider metadata.
13. Drag and drop the Federation Metadata XML file into the Identity provider metadata box, or click the select one link and navigate to and select the file in your local file system. Then click Next.
14. On the Map attributes screen, select the Name ID as the identity provider user attribute. Select Username as the identity domain user attribute, and Email address as the Requested NameID format.
15. Click Create IdP.
16. Optional. On the Export screen, click the Download button in the Service provider metadata field to download the metadata for your SAML identity provider.
17. Optional. Test the configuration settings for the IdP to confirm that the IdP is working properly. You can use the credentials of the IdP to sign in to the identity domain through an external website.
18. Under Activate IdP, click Activate, then click Finish.

You will need to create policies in OCI IAM to enable authorization for OracleDB for Azure user groups by Azure Active Directory. See Managing Access to Resources for an overview of policies in OCI IAM.

See Oracle Cloud Infrastructure IAM Policy Statements for Oracle Database Service for Azure for example policy statements.

1. Navigate to the OCI Console at https://cloud.oracle.com.
2. Enter your Cloud Account Name, also referred to as your tenancy name, and click Next.
3. Select the identity domain to sign in to. For OracleDB for Azure, you will use the Default domain.
4. Sign in with your admin user name and password.
5. Open the navigation menu and click Identity & Security. Under Identity, click Domains.
6. In the list of domains, click the name of the domain you want to view. For OracleDB for Azure, you will use the Default domain.
7. On the domain's Overview page, click Groups in list of links under Identity domain.
8. Click Create group and enter the group name. For example, odsa-db-family-administrators.
9. Enter a description for the group.
10. Click Create to create the group.
11. Open the navigation menu and click Identity & Security. Under Identity, click Policies.
12. Click Create Policy.
13. Enter a name for the policy. For example: my_odsa_compartment_odsa-db-family-administrators.
14. Enter a description for the policy.
15. For Compartment, select the OracleDB for Azure compartment.
16. In the Policy Builder section, enable Show manual editor, then copy and paste your policy into Policy Builder field.
17. Select Create Another Policy if you want to create another policy after you create the policy you are currently configuring.
18. Click Create.
19. Repeat steps 12 to 18 to create the additional policies you need for your users.

The OCI IAM user groups you created in To create OCI IAM User Groups and Policies for OracleDB for Azure need a corresponding set of user groups in Azure Active Directory to enable OracleDB for Azure user authorization. Create the following groups in Azure and assign your Azure users to them as needed:

• oci-direct-readers

• network-oci-direct-users

• exadb-oci-direct-users

• ocimcs-administrator

1. Sign in to the Azure portal.
2. On the Home page, select Azure Active Directory.
3. On the Active Directory page, select Groups.
4. Click New group.
5. On the New Group page, for Group type, choose Security.
6. Enter a Group name and Group description.
7. Click No owners selected under Owners and select a group owner, then click Select.
8. Click No members selected under Members and select group members, then click Select.
9. Click Create.
10. Repeat steps 4 to 9 to create all the groups discussed in this topic.

1. In your Azure account, navigate to the SAML service principal that your created using the instructions in To create a SAML service principal in your Azure account:
   1. Under Azure services, click Azure Active Directory.
   2. In the left pane, click Enterprise applications.
   3. In the list of Enterprise Applications, click the name of your application. The application's Overview page is displayed.
2. Click Provisioning in the left pane.
3. Click Get Started.
4. On the Provisioning page, select "Automatic" as the Provisioning Mode.

5. In the Admin Credentials section, provide the tenant URL and the base64 secret token discussed in the last two steps of To create a confidential application for OracleDB for Azure in your OCI account.

6. Click Test Connection.
7. If the connection setup is successful, click Save.