You can integrate Oracle Identity Cloud Service with your On-Premise identities currently stored in Microsoft Active Directory.
The Identity Bridge component of Oracle Identity Cloud Service enables synchronization of all identities and groups from Active Directory into its
own identity store residing in the cloud.
In addition, you can implement federated Single Sign-On between Cloud and On-Premise applications by configuring Active Directory as an
Identity Provider, using the SAML 2.0 open standard.
First, let’s synchronize users from your Microsoft Active Directory with the Oracle Identity Cloud Service by installing the Identity Bridge.
This enables you to setup a unidirectional synchronization from Active Directory to Oracle Identity Cloud Service.
Log in to the Console as an Administrator, and select Download and Configure from the Identity Bridge section.
Once you have downloaded the software, you are presented with a dialog box which contains a Client ID and Secret.
This is the credential which allows the Identity Bridge Agent to communicate securely with Oracle Identity Cloud Service.
Next we install and configure the Identity Bridge.
In the Setup Wizard enter the Oracle Identity Cloud Service URL, and Client ID and Secret that were issued earlier.
Connect to Oracle Identity Cloud Service and Active Directory by entering the credentials for each.
Once connected, select the organization units and groups we would like to synchronize from Active Directory.
In this case let’s select some of the Employees groups.
The first synchronization should now run.
Verify that the synchronization has completed successfully in the ‘Sync History’ tab.
Another way to verify that the synchronization is successful, is to select a user from Active Directory and ensure that their entry appears in
Oracle Identity Cloud Service.
In this case the user Clarence Saladna exists in both user stores.
Now we have synchronized Active Directory users with Oracle Identity Cloud Service let’s look at how to implement federated Single Sign-On to
applications in this hybrid environment.
Oracle Identity Cloud Services provides out-of- the-box integration with SAML 2.0 identity providers.
The SAML 2.0 specification defines three roles: the Principal (typically a user), the Identity Provider, and the Service provider.
In this example, the user csaladna@example.com is the principal, the Oracle Identity Cloud Service Console is the service provider, and Active
Directory the Identity Provider.
First, register Active Directory Federation Services, or ADFS, as an Identity Provider.
This requires us to download federation metadata from ADFS and register it in the Oracle Cloud Service Administration Console.
Download the Service Provider Metadata, so we can provide this to ADFS later in the configuration.
Next, register Oracle Identity Cloud Service as a Trusted Relying Party in ADFS, by importing the metadata downloaded previously from Oracle
Identity Cloud Service.
Then, add claim rules. These define what information about a logged in user is passed from ADFS to Oracle Identity Cloud Service following a
successful authentication.
Here we configure two claim rules for Oracle Identity Cloud Service as a relying party, Email and Name ID.
The Email rule defines that the email address from logged in users will be sent to Oracle Identity Cloud Service.
The Name ID rule defines that the email address will be presented as Name ID to Oracle Identity Cloud Service.
The configuration is complete
Let’s test the connection to our Identity Provider, ADFS, in the Oracle Identity Cloud Service Console, by selecting the Test Login option.
With the Test Login successful we can enable the connection, to complete the integration.
Now, let’s log into Oracle Identity Cloud Service using Active Directory Federation Service credentials.
Because the ‘Activate Login Chooser’ option was selected in the Identity Provider registration, we are presented with two login options, the Oracle
Cloud Identity Services login, and the Identity Provider login.
By selecting ‘Sign in with Identity Provider’ we are presented with the ADFS login page.
After login, the Identity Cloud Service Home page is displayed confirming that our integration is fully functional.
After configuring federated single sign-on, the user has the ability to perform certain tasks such as being able to login using the Oracle Identity
Cloud Service login, or change their password via the cloud interface.
To prevent users from performing these, and other such actions, you must mark the user as a federated entity.
This ensures that the federated users cannot circumvent security.
The simplest way to achieve this is to mark users as federated in the Identity Bridge.
This has the advantage of automatically setting users from Active Directory as federated.
Alternatively you can also manually set users as federated in the Oracle Identity Cloud Service Console.
Oracle Identity Cloud Service allows you to leverage your existing investment in Active Directory infrastructure with a hybrid on-premise
and Cloud environment.
You can automatically synchronize your Active Directory users with Oracle Identity Cloud Service and enable Single Sign-On to both
on-premise and cloud applications.
To learn more about what you have seen in this video, please visit our tutorials.
Thank you for watching.