You can integrate Oracle Identity Cloud Service with your On-Premise identities currently
stored in Microsoft Active Directory.
The Identity Bridge component of Oracle Identity Cloud Service enables synchronization of all
identities and groups from Active Directory into its own identity store residing in the
cloud.
In addition, you can implement federated Single Sign-On between Cloud and On-Premise applications
by configuring Active Directory as an Identity Provider, using the SAML 2.0 open standard.
First, let’s synchronize users from your Microsoft Active Directory with the Oracle
Identity Cloud Service by installing the Identity Bridge.
This enables you to setup a unidirectional synchronization from Active Directory to Oracle
Identity Cloud Service.
Log in to the Console as an Administrator, and select ‘Download and Configure’ from
the Directory Integrations section.
After selecting ‘Add a Microsoft Active Directory Bridge’,
you are presented with a Client ID and Secret.
This is the credential which allows the Identity Bridge Agent to communicate securely with
Oracle Identity Cloud Service.
We will use the Client ID and Secret later in the configuration.
Click ‘Download’ to retrieve the Identity Bridge software.
Next we install and configure the Identity Bridge.
In the Specify Oracle Identity Cloud Service Credentials screen Setup Wizard enter the
Oracle Identity Cloud Service URL, and Client ID and Secret that were issued earlier.
Then test the connection.
In the Specify Microsoft Active Directory Credentials screen, enter the username and
password for Active Directory and Test the connection.
Once the bridge is installed, select the Active Directory bridge from ‘Directory Integrations’.
Select the organization units and groups you would like to synchronize from Active Directory.
In this case let’s select the Employees users and groups.
The Include Hierarchy checkbox allows you to include sub groups.
The Filter field allows you to search for an Organizational Unit that meets a specific
criteria, for example you may only want to bring in users that have a last name as Smith,
or from a particular group.
In the Authentication Settings make sure Enable Federated Authentication is selected and save
the configuration.
After saving the configuration, click Import and Import the users and groups from Active
Directory.
Verify that the synchronization has completed successfully by clicking Refresh .
Another way to verify that the synchronization is successful, is to select a user from Active
Directory and ensure that their entry appears in Oracle Identity Cloud Services.
In this case, the user Clarence Saladna exists in both user stores.
Now we have synchronized Active Directory users with Oracle Identity Cloud Service let’s
look at how to implement federated Single Sign-On to applications in this hybrid environment.
Oracle Identity Cloud Service provides out-of-the-box integration with SAML 2.0 identity providers.
The SAML 2.0 specification defines three roles: the Principal (typically a user), the Identity
Provider, and the Service provider.
In this example, the user csaladna at example.com is the principal, the Oracle Identity Cloud
Service Console is the service provider, and Active Directory the Identity Provider.
First, register Active Directory Federation Services, or ADFS, by selecting Add Identity
Provider and giving it a name such as ADIP.
The next step requires us to have downloaded the federation metadata from ADFS and then
to register it in the Oracle Cloud Service Administration Console by clicking Upload.
Select the User Attributes and NameID Format and click Next and Finish.
Download the Service Provider Metadata from this URL, so we can provide this to ADFS later
in the configuration.
Next, register Oracle Identity Cloud Service as a Trusted Relying Party in ADFS, by importing
the metadata downloaded previously from Oracle Identity Cloud Services.
Then, add claim rules.
These define what information about a logged in user is passed from ADFS to Oracle Identity
Cloud Service following a successful authentication.
Here we configure two claim rules for Oracle Identity Cloud Service as a relying party,
Email and Name ID.
The Email rule defines that the email address from logged in users will be sent to Oracle
Identity Cloud Service.
The Name ID rule defines that the email address will be presented as Name ID to Oracle Identity
Cloud Service.
Now the configuration is complete, let’s test the connection to our Identity Provider,
ADFS, in the Oracle Identity Cloud Service Console, by selecting the Test Login option.
Login to ADFS as with a username that you imported into Identity Cloud Service from
Active Directory.
With the Test Login successful we select ‘Activate’ to enable the Active Directory Identity Provider.
Now assign the Active Directory Identity Provider to an Identity Provider Policy by clicking
IDP Policies.
You can assign either to the Default Identity Provider Policy or one you have previously
created.
Here we select the Default policy and under Identity Providers select Assign and then
the Active Directory Identity Provider.
Now when we access the sign in page, we are presented with two login options,
the Oracle Cloud Identity Services login, and the Identity Provider login.
By selecting the Active Directory Identity Provider we are presented with the ADFS login
page and we can login successfully.
Oracle Identity Cloud Service allows you to leverage your existing investment in Active
Directory infrastructure with a hybrid on-premise and Cloud environment.
You can automatically synchronize your Active Directory users with Oracle Cloud Identity
Service and enable Single Sign-On to both on-premise and cloud applications via ADFS.
To learn more about what you have seen in this video, please visit our tutorials.
Thank you for watching.