Oracle Cloud Infrastructure IAM
Oracle Cloud Infrastructure IAM
Single sign-on (SAML 2.0)
In the portal, choose Oracle Cloud Infrastructure IAM under Enterprise SSO and Start with Oracle Cloud Infrastructure IAM. Then, in Oracle Cloud Infrastructure IAM:
- In the identity domain, select Integrated applications, then Add application, choose SAML Application and select Launch workflow.
- Enter a Name and select Next.
- In Configure single sign-on, enter the Entity ID and Assertion consumer URL below and set Name ID value to Primary email address, then select Finish.
- Activate the application and assign the users or groups who should sign in.
- Select Download identity provider metadata — or, with Configure client access enabled under Access signing certificate, give us https://<domain-url>/fed/v1/metadata.
The values the portal shows
| Oracle Cloud Infrastructure IAM field | Value |
|---|---|
| Entity ID (Configure single sign-on → General) | The portal's entity ID (https://…/sso/saml/…) |
| Assertion consumer URL (Configure single sign-on → General) | The portal's ACS URL (https://…/sso/saml/…/acs) |
| Name ID value (Configure single sign-on → General) | Primary email address |
| Single logout URL (Configure single sign-on → Additional configurations), optional | The portal's Single Logout URL (https://…/sso/saml/…/slo) |
What to bring back
Copy Download identity provider metadata — the URL, or the XML — and paste it into the portal's Metadata URL or XML. Prefer the URL.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
Oracle Cloud Infrastructure IAM's own guide: https://docs.oracle.com/en-us/iaas/Content/Identity/applications/add-saml-application.htm.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Directory Sync (SCIM)
In the portal, choose Oracle Cloud Infrastructure IAM under Directory sync and Create directory; copy the bearer token now, it is shown once. Then, in Oracle Cloud Infrastructure IAM:
- In Integrated applications, select Add application, then Application Catalog, and launch the app catalog.
- Under Types of integration choose Provisioning, and pick GenericScim - Bearer Token.
- Name it and select Next.
- In Configure connectivity, enter the Host Name, Base URI and Access Token below — Oracle asks for our SCIM URL in two halves.
- Select Test connectivity and confirm the connection succeeds.
The values the portal shows
| Oracle Cloud Infrastructure IAM field | Value |
|---|---|
| Host Name (Configure connectivity) | The host of the portal's SCIM base URL |
| Base URI (Configure connectivity) | The path of the portal's SCIM base URL (/scim/v2) |
| Access Token (Configure connectivity) | The bearer token the portal shows once |
Oracle Cloud Infrastructure IAM's own guide: https://docs.oracle.com/en-us/iaas/Content/Identity/scim/add-application-using-generic-scim-app-template.htm.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.
- Directory Sync — the portal's SCIM setup.