You can manage user’s access to applications using Oracle Identity Cloud Service, by integrating
your applications for user provisioning and synchronization.
Oracle Identity Cloud Service’s Application Catalog templates help you provision and synchronize
users fast.
If your application isn’t listed, you can use one of the Generic SCIM Templates to enable
the integration.
In order to use the Generic SCIM Templates, your application needs to expose SCIM REST
APIs.
SCIM stands for ‘System for Cross-domain Identity Management’ which standardizes
the management of user identities across applications and services.
If your application doesn’t expose SCIM REST APIs, you can develop and deploy your
own SCIM REST API application to serve as the interface between Oracle Identity Cloud
Service and your application.
The Generic SCIM templates can be used to provision and synchronize user accounts to
applications.
Or you can use them to synchronize users from an authoritative application to Oracle Identity
Cloud Service. Let’s learn more about the templates.
If your application is an authoritative application, Oracle Identity Cloud Service periodically
contacts the application SCIM REST API to synchronize newly-created users from the application
and create their respective users in Oracle Identity Cloud Service.
If your application is integrated for user accounts provisioning and synchronization,
after you assign the application to a user in Oracle Identity Cloud Service, an account
for that user is created in the application.
If you deactivate, activate or revoke the user assignment to the application, Oracle
Identity Cloud Service contacts the application through its SCIM REST API to change the account
status or to remove the user account.
There are 4 Generic SCIM templates available in the application catalog: Basic Authentication,
Access Token, Client Credentials, and Resource Owner Password.
The templates differ based on the authentication method they implement and that the SCIM API
supports.
The Generic SCIM – Basic template requires the SCIM API to support Basic authentication.
During the template configuration, provide the administrator username and password, along
with other information.
The administrator credentials are sent to the SCIM API as an authorization header, every
time Oracle Identity Cloud Service executes an operation, so that the SCIM API can validate
it before executing the request.
The Generic SCIM – Bearer Token template requires the SCIM API to accept an access token
that you provide during the template configuration.
This token is sent to the SCIM API as an authorization header, every time Oracle Identity Cloud Service
executes an operation.
The Generic SCIM – Client Credentials template requires that you provide an authentication
server URL, along with the client ID, Secret, and scope.
Oracle Identity Cloud Service uses the client ID and secret to request an access token for
the authentication server.
Oracle Identity Cloud Service uses this token as an authorization header in every request
to the SCIM API.
The SCIM API validates the token before executing the requested operation.
The Generic SCIM – Resource Owner Password template is like the client credential one,
but you have to provide the Administrator username and password.
After you have configured the connectivity parameters, you can review and change the
attribute mapping for provisioning.
By default, Oracle Identity Cloud Service maps each user attribute to the corresponding
attribute in the SCIM specification.
The SCIM API associates these attributes to attributes for the user account in the application.
You can select the operations that are going to be performed by Oracle Identity Cloud Service
when provisioning users to the application.
Each operation corresponds to an endpoint exposed by the SCIM API.
Or you can select to synchronize users from an authoritative source.
If so, then the application’s SCIM REST API is used to collect user information from
the application to create users in Oracle Identity Cloud Service.
The Generic Scim templates support synchronization of user accounts.
This means that when a user account is created in the application, Oracle Identity Cloud
Service polls the application’s SCIM API, collects this account, and links the user
to the account by assigning the user to the application.
Let’s see the Generic SCIM template in action.
In this example, Oracle Identity Cloud Service contains 3 users and the application contains
2 user accounts which haven’t been synchronized to Oracle Identity Cloud Service yet.
After you have configured the Generic SCIM Basic template and tested the connectivity,
select the Import tab, and then click Import.
After the synchronization is complete, the list of user accounts that have been synchronized
to Oracle Identity Cloud Service appears.
These user accounts have been linked to users in Oracle Identity Cloud Service because their
user and application identifier values match.
In the user details page, click the Access tab. The application has been assigned to
the user, which means the user has an account in that application.
If you want to assign a new user to the application using the generic SCIM template, fill the
provisioning form with user information, and save the form.
Oracle Identity Cloud Service assigns the user to the application, which means an account
for the user is created in the application.
In this example, the REST API logs of the application have the POST HTTP JSON message
body from Oracle Identity Cloud Service containing information of the user account that was created.
If the user is deactivated, reactivated, or has their assignment to the application revoked,
then Oracle Identity Cloud Service makes the corresponding HTTP call to the application’s
REST API to deactivate, reactivate, or delete the user account.
Learn more at cloud.oracle.com