Welcome to Oracle Cloud Infrastructure!
This tutorial covers the details on how to use the Oracle Cloud Infrastructure Console
to create a new Administrator for your account.
When someone in your company wants to use Oracle Cloud Infrastructure resources in the
Console, they must sign in with a user login and password.
An identity provider (IdP) is commonly used to manage user login/passwords and to authenticate
users for access to secure websites, services, and resources.
The federated login between an identity domain and an external identity provider - also known
as an authentication authority - allows users to sign in and access Oracle Cloud Infrastructure
resources by using their external provider’s credentials.
OCI covers federation with several identity providers that support the Security Assertion
Markup Language (SAML) 2.0 protocol.
When you sign up for Oracle Cloud Infrastructure, your tenancy is federated with Oracle Identity
Cloud Service (IDCS) as the identity provider.
Once you’ve configured SSO, you might want to grant another user, full administrator
privileges.
You can assign administrators in your organization, different levels of access to various tasks
and resources.
This is a common Support requirement for OCI customers but did you know that you can create
users and groups and give them permissions straight in the OCI Console?
Here’s how you can do it: Start by logging into your Oracle cloud account
as a Federated user Once in the OCI Console, access the main menu
Navigate to Identity and Security section And from the Identity section
Click on Federation Click on your default Oracle Identity Cloud
Service federation A list of all federated users is displayed
Click Create User.
Input the requested details such as Username, Email, First and Last Name
Assigning the user to Groups: You can add the user to the 2 default Administrators groups
at this step, or after the user is created.
Click Create.
The user is created in Oracle Identity Cloud Service
Click Close to close the dialog.
You are returned to the User Details page.
You can also access the Users list from the Identity Provider Details page.
Select the new user from the list.
You are taken to the User details page.
You can add the user to the 2 default Administrators groups at this step by clicking Add to IDCS
Group.
The User details page can also be accessed from the 3-dots menu
Add the federated user to the IDCS and OCI Administrators groups.
Group mapping is visible on the User details page.
Click Manage Roles.
Select the check box next to Add Cloud Account Administrator Role.
Click Apply Role Settings.
A dialog confirms the entitlements granted to the user.
To notify the user of these updates, click Send Email to User.
Click Close to close the dialog.
An alternative to creating a federated user is from the same
Identity and Security section Select Users
Click Create User You are prompted to establish the User type
Select the default IDCS User option and not IAM user, as this applies to Non-federated,
OCI native user And follow the same steps as before, by filling
out requested details such as Username, Email, First and Last Name
Click Create.
After the user is created, you are again prompted to the User details page
In the identity Provider Details page , the OCI synched User column will indicate which
users are part of the OCI_Administrators group.
Once the entitlements are granted to the user, they will be notified via email.
The newly-created federated user cannot access their account until they complete the password
reset steps.
Once the password has been set, the user logs in with the SSO.
It is important to know that when the new federated user signs in they can see the compartments
they have access to and they can only view, create, and manage resources in the Sandbox
compartment.
This user cannot create other users or groups unless they are added to the default administrators
group -> an authorization error would be displayed until this step is completed.
The Cloud account administrator must ensure the new admin is added to the default groups.
Let’s do a quick recap: If needed, the full administrator permissions
of the default administrator can be replicated This can be achieved by logging a Service
Request with OCI Customer Support, but it can also be done self-service
You can create your IDCS users and groups directly in the Console, and give them permissions
in Oracle Cloud Infrastructure.
Remember that one of the existing cloud account administrators must:
Create a federated user Assign the Cloud Account Administrator role
Add the user to the default administrators groups
For constant availability and a seamless experience, we strongly encourage you to add at least
one backup admin.
This will help you avoid access issues or being locked out of your tenancy.
We hope you enjoyed this video and found it useful.
Thank you for watching!