Welcome to this tutorial on how to enable multi-factor authentication on Oracle Cloud.
Recent reports have indicated a surge in the number of compromised cloud accounts across the
industry. Multi-factor authentication provides an additional layer of security by requiring users
to provide a second factor, such as a code sent to a phone, in addition to a password.
In this tutorial, we will cover three important variations in enabling multi-factor authentication
on Oracle Cloud, based on how your account is configured. Local users, Oracle Identity,
Cloud Service, and Identity Domains. So let's get started. We will first demonstrate how to
enable multi-factor authentication for OCI direct sign-in users. First, login with a direct user.
Select your tenancy and press Next.
Ignore for now any federated or SSO identity provider, and open the direct sign-in pane on
the bottom. Enter your username and password, then click the sign-in button.
Once the console is displayed, click on your profile icon in the top right corner,
then click on your username.
Wait for the Enable multi-factor authentication button to appear, then click it.
Next, launch your multi-factor authenticator app on a device and add a new entry by scanning
the QR code on the screen. Enter the verification code from the app into the verification code field
and hit verify. And that's it, it was that simple. To test, log out and log back in.
You'll now see that the MFA code is required. Simply use your authenticator app to retrieve it.
We will now show how to enable multi-factor authentication for IDCS users. Let's log in
first with a federated IDCS user. Now, let's expand the left menu bar and select identity and security,
and then Federation.
Now, click on the Oracle Identity Cloud Service item and then on the IDCS console link.
The services console will open in a separate tab. Let's once again expand the left menu by
clicking on the hamburger button and go to Security and MFA. There are several multi-factor
options available here. For this tutorial, let's select only mobile app passcode.
The dedicated Oracle MFA app is required. Please follow the link in the description to download
it on your device of choice. If the mobile app notification option is checked, it enables a
more seamless experience by allowing the user to directly open the app and accept the login
request without manually entering the pin. If you prefer a more standard user experience though,
leave it unchecked. Don't forget to save our work. Now, let's enforce the usage of MFA by
navigating to the Sign-on Policies menu. Click on the default policy, then on the Sign-on Rules tab
and finally edit the default rule. In the Action section, check the Prompt for Reauthentication
option to force the user to login again. Then check Prompt for an additional factor, checkbox.
Additional MFA settings appear for specifying whether the user is required to enroll in MFA
and how often this additional factor is to be used. After saving our changes, let's go back to our
cloud console to test the new policy. At the next login, we will be prompted to enable the
secure verification method we just set up. Open the Oracle Mobile Authenticator app on your mobile
device and scan the QR code. Once done, the IDCS server will accept your credentials.
After that, you will be required to provide the MFA code at each login,
whereas determined by the policies set in the previous step.
We will now set up multi-factor authentication for accounts using Identity domains.
From the hamburger menu, select Identity and Security, and then Domains.
Once the list of your available domains appears, click on the domain you want to configure.
From the menu, select Security and then multi-factor authentication.
This is the place where we only configure the possible authentication methods,
but be aware, this does not enable multi-factor authentication.
To enable it, we have to go to the Sign-on Policy's menu entry and create a new policy.
Enter a name, and then click Add Policy.
Now let's add a new sign-on rule for our brand new policy.
Click Add Sign-on Rule. Here is where all the magic happens.
Enter a name for our rule first, then enter or select All Identity Providers that will be used
to authenticate the user accounts evaluated by this rule. Use the Group Membership option to
enable multi-factor authentication for all users by entering or selecting the groups that users
must be a member of to meet the criteria of this rule. Then be sure Allow Access is checked.
This will ensure a user will be allowed to access the console if the user account meets the criteria
of this rule. Select the prompt for re-authentication checkbox to force the user to re-enter credentials
to access the assigned application, even when there's an existing Identity Domain session.
Select the prompt for an additional factor checkbox to prompt the user for an additional
factor to sign into the Identity Domain. Select Mobile App Passcode, and, while testing,
every time as the desired frequency. Save TE rule by clicking on the Add Sign-on Rule button.
Click Next to go to the last step, adding the console app to the scope of the policy.
Click Add App and select OCI Console. Click Close to finish saving our new policy.
Now, we have our policy, but it's not yet active. The only thing we have to do is to
click the Activate Sign-on Policy button at the top. And we're done.
Now, let's test it by logging out and logging back in, with a user belonging to our Identity Domain.
The first time they're logging in, the user will be prompted to enable the multi-factor
authentication device. Here, we could use either the Oracle Mobile Authenticator app,
you will find the link in the description, or any other authentication app available.
It worked. Multi-factor authentication is now enabled.