Cross-Platform Efficiency: Mastering Federation of Azure AD with OCI Identity Domains for SSO Solution

 By federating Azure AD with OCI Identity domains(more on OCI Identity Domains), businesses can centralize user authentication, simplifying access management and reducing administrative overhead. This robust integration enables a single sign-on (SSO) experience, allowing users to securely access resources across both platforms with a single set of credentials. With enhanced security measures and simplified user provisioning, organizations can ensure compliance with regulatory standards while fostering a seamless user experience. Now, with all new tenancies, Oracle has introduced identity domains as a single domain for storing all the users, groups credentials and so the navigations have also changed a bit. Also, the point to be noted that in the background, it is the same IDCS solution running.

Here, OCI act as a service provider (SP) and Microsoft Azure act as an Identity Provider (IdP). The Service Provider (OCI) creates a SAML request and forwards the user and the SAML request to the Identity Provider (Azure AD). Once the user is authenticated, the IdP sends back a SAML response with an assertion to the Service Provider's Assertion Consumer Service endpoint. 

Note: Azure AD  is now Microsoft Entra ID.

Go to the OCI Hamburger menu > Identity and Security

Click on Domains and change the below settings first

get the IDCS url

Copy the IDCS url and add /fed/v1/metadata. Open a browser and save the file as XML.

On the Azure Portal now:-

Create an Enterprise Application. Choose the option as Oracle

Choose the option Oracle Cloud Infrastructure Console

Give it a name and Click on Create

Click on Single Sign on and choose the option for SAML

Upload the OCI downloaded metadata xml file

Download the Federation Metadata XML which has to be uploaded to OCI side.

OCI Side:-

Click on Add SAML IdP

Choose the option Upload metadata xml file

Upload the xml file downloaded from Azure Portal

Review and Create

Test the login

Activate the IdP

Edit the IdP policies and add Azure AD

Test the setup.

Note: User has to be present on both OCI IAM and Azure AD

Login to the OCI console and we will get the IdP icon

Click on Azure AD

Here we are. We have successfully landed to the OCI home page.

This post explains about the integration of Oracle cloud Infrastructure Identity domains with Microsoft Azure AD for a seamless Single Sign on Solution.

I hope, this post will help someone. Till then, enjoy learning cloud.

References:-https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/federation.htm#top

https://docs.oracle.com/en-us/iaas/Content/Identity/tutorials/azure_ad/lifecycle_azure/02-config-azure-iam-template.htm#config-azure-iam-template

local users and IDCS users in simplified way in OCI

 Before jumping into the topic, let me take you to three questions which generally comes into my mind.

1. Is IDCS user and local users are same

2. Is OCI and IDCS same

3. What exactly is IDCS

OCI is Oracle Cloud infrastructure and it's cloud computing solutions same as MS azure or amazon AWS, but offered by Oracle and it's providing various services such as servers, storage, network, applications and services through a global network of Oracle Corporation managed by different data center around the world.

IAM refer to Identity and Access Management this is services allow you to control who can access to cloud resource and even control what type of access they have, and to which specific resource, there is different Components of IAM such as resource, user, group and more you can check Oracle documentation that provide also examples here

IDCS refer to Oracle Identity Cloud Service and it's consider as Identity-as-a-Service (IDaaS) solution, Oracle Identity Cloud Service provides identity management, single-sign-on (SSO) and identity governance for applications on-premise, in the cloud and mobile applications . Oracle IDCS integrates directly with existing directories and identity management system, making it easier for users to access applications. Providing a platform that is robust and secure, allows users to access, develop and deploy their applications.

For details, you can refer the Oracle docs:-https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/overview.htm

Now coming back to the actual demonstration, on how we can create local users and IDCS users and then how we can restrict users to particular resources. I have created the following resources

Compartment TEST

Group TEST_GROUP

A policy TEST_POLICY

Now in the identity federation menu option, create a local user and assign it to the group created above.

Once the user is created, an auto generated mail will be sent and user will be able to reset the password. As there is a policy assigned to this group, user will only be able to create the resources under compartment TEST.

Now coming to IDCS users.

Click on federation>and then click on the identity provider

Create IDCS group

 

Created the TEST group. Now i will create the IDCS users using the option

once the users are created, assign it to the newly created group TEST.

Now we will make the mapping of OCI group and IDCS user group and thus policy attached to the OCI group will also be applicable to IDCS group

Click on group mapping

Note: When we create an IDCS user, it is always advisable to have the local IAM user created also. In cases where if IDCS doesn't work, then atleast users will be able to login via local IAM credentials.