Federating with Microsoft Azure Active Directory

Summary: The Oracle Cloud Infrastructure Console Federation page displays a link to the Oracle Cloud Infrastructure federation metadata document. Before you set up the application in Azure AD, you need to download the document.

1. Go to the Federation page: Open the navigation menu and click Identity & Security. Under Identity, click Federation.

2. On the Federation page, click Download this document.

   

   After you click the link, the metadata.xml document opens in your browser window. Use your browser's Save page as command to save the xml document locally where you can access it later.

1. In the Azure portal, on the left navigation panel, select Azure Active Directory.

2. In the Azure Active Directory pane, select Enterprise applications. A sample of the applications in your Azure AD tenant is displayed.

3. At the top of the All applications pane, click New application.
4. In the Add from gallery region, enter Oracle Cloud Infrastructure Console in the search box.

5. Select the Oracle Cloud Infrastructure Console application from the results.

6. In the application-specific form, you can edit information about the application. For example, you can edit the name of the application.

7. When you are finished editing the properties, select Create.

   The getting started page is displayed with the options for configuring the application for your organization.

1. Under the Manage section, select Single sign-on.

   

2. Select SAML to configure single sign-on. The Set up Single Sign-On with SAML page is displayed.

3. At the top of the page, click Upload metadata file.

   

4. Locate the federation metadata file (metadata.xml) you downloaded from Oracle Cloud Infrastructure in Step 1, and upload it here. After you upload the file, these Basic SAML Configuration fields are automatically populated:

   • Identifier (Entity ID)
   • Reply URL (Assertion Consumer Service URL)

5. In the Basic SAML Configuration section, click Edit. On the Basic SAML Configuration pane, enter the following required field:

   • Sign on URL: Enter the URL in the following format:

     https://cloud.oracle.com

     

6. Click Save.

The Oracle Cloud Infrastructure Console enterprise application template is seeded with the required attributes, so you don't need to add any. However, you do need to make the following customizations:

1. In the User Attributes & Claims section, click Edit in the upper-right corner. The Manage claim panel is displayed.

2. Next to the Name identifier value field, click Edit.

   • Under Required claim, select Unique User Identifier (Name ID) .
   • Select Email address and change it to Persistent.
   • For Source, select Attribute.

   • For Source attribute, select user.userprincipalname.

     

   • Click Save.

3. Click Add a group claim.

4. In the Group Claims panel, configure the following:

   • Select Security groups.
   • Source attribute: Select Group ID.
   • Under Advanced Options, select Customize the name of the group claim.

   • In the Name field, enter: groupName.

     Ensure that you enter groupName with spelling and case exactly as given.

   • In the Namespace field, enter: https://auth.oraclecloud.com/saml/claims

     
   • Click Save.

1. In the SAML Signing Certificate section, click the download link next to Federation Metadata XML.

2. Download this document and make a note of where you save it. You will upload this document to the Console in the next step.

To enable Azure AD users to sign in to Oracle Cloud Infrastructure, you need to assign the appropriate user groups to your new enterprise application.

1. On the left navigation pane, under Manage, select Users and Groups.
2. Click Add at the top of the Users and Groups list to open the Add Assignment pane.

3. Click the Users and groups selector.

4. Enter the name of the group you want to assign to the application into the Search by name or email address search box.

5. Hover over the group in the results list to display a checkbox. Select the checkbox to add the group to the Selected list.

6. When you are finished selecting groups, click Select to add them to the list of users and groups to be assigned to the application.

7. Click Assign to assign the application to the selected groups.

Summary: Add the identity provider to your tenancy. You can set up the group mappings at the same time, or set them up later.

1. Go to the Console and sign in with your Oracle Cloud Infrastructure username and password.
2. Open the navigation menu and click Identity & Security. Under Identity, click Federation.
3. Click Add identity provider.

4. Enter the following:

   1. Display Name: A unique name for this federation trust. This is the name federated users see when choosing which identity provider to use when signing in to the Console. The name must be unique across all identity providers you add to the tenancy. You cannot change this later.
   2. Description: A friendly description.
   3. Type: Select SAML 2.0 compliant identity provider.
   4. XML: Upload the FederationMetadata.xml file you downloaded from Azure AD.
   5. Click Show Advanced Options.

   6. Encrypt Assertion: Selecting the checkbox lets the IAM service know to expect the encryption from IdP. Do not select this checkbox unless you have enabled assertion encryption in Azure AD.

      To enable assertion encryption for this single sign-on application in Azure AD, set up the SAML Signing Certificate in Azure AD to sign the SAML response and assertion. For more information, see the Azure AD documentation.

   7. Force Authentication: Selected by default. When selected, users are required to provide their credentials to the IdP (re-authenticate) even when they are already signed in to another session.
   8. Authentication Context Class References: This field is required for Government Cloud customers. When one or more values are specified, Oracle Cloud Infrastructure (the relying party), expects the identity provider to use one of the specified authentication mechanisms when authenticating the user. The returned SAML response from the IdP must contain an authentication statement with that authentication context class reference. If the SAML response authentication context does not match what is specified here, the Oracle Cloud Infrastructure auth service rejects the SAML response with a 400. Several common authentication context class references are listed in the menu. To use a different context class, select Custom, then manually enter the class reference.
   9. If you have permissions to create a resource, then you also have permissions to apply free-form tags to that resource. To apply a defined tag, you must have permissions to use the tag namespace. For more information about tagging, see Resource Tags. If you're not sure whether to apply tags, skip this option or ask an administrator. You can apply tags later.

5. Click Continue.

   Note
   
   

   If you don't want to set up the group mappings now, you can simply click Create and come back to add the mappings later.

Summary: Set up the mappings between Azure AD groups and IAM groups in Oracle Cloud Infrastructure. A given Azure AD group can be mapped to zero, one, or multiple IAM groups, and vice versa. However, each individual mapping is between only a single Azure AD group and a single IAM group. Changes to group mappings take effect typically within seconds in your home region, but may take several minutes to propagate to all regions. Note that the Azure AD groups that you choose to map must also be assigned to the enterprise application in Azure AD. See Step 6: Assign user groups to the application.

Before you begin: Have your Azure AD groups page open. From the Azure Dashboard, under Manage, select Groups. From the list of groups, select the group you want to map to an Oracle Cloud Infrastructure group. In the group's details page, click the Copy icon next to the Object ID for the group.

To create a group mapping:

1. For Identity Provider Group, enter (or paste) the Object ID of the Azure AD group. You must enter the Object ID exactly, including the correct case. An example Object ID looks like: aa0e7d64-5b2c-623g-at32-65058526179c

   

2. Choose the IAM group you want to map this group to from the list under OCI Group.

3. Repeat the preceding steps for each mapping you want to create, and then click Create.

The identity provider is now added to your tenancy and appears in the list on the Federation page. Click the identity provider to view its details and the group mappings you just set up.

Oracle assigns the identity provider and each group mapping a unique ID called an Oracle Cloud ID (OCID). For more information, see Resource Identifiers.

In the future, come to the Federation page if you want to edit the group mappings or delete the identity provider from your tenancy.

If you haven't already, set up IAM policies to control the access the federated users have to your organization's Oracle Cloud Infrastructure resources. For more information, see Getting Started with Policies and Common Policies.

The federated users need the URL for the Oracle Cloud Infrastructure Console (for example, Console) and the name of your tenant. They'll be prompted to provide the tenant name when they sign in to the Console.