Identity and access management oracle cloud infrastructure identity and access management
lets you control who has access to your cloud resources you'll also be able to control what type
of access your group of users have and to which specific resources in order to start managing your
infrastructure environment you're going to need to open the navigation menu go ahead to identity
and security then select the identity tab before we begin it is worth mentioning here that oracle
is using the list privilege principle in terms of security meaning that if you just create a user
that user will not have access over any of your resources until you specifically assign the user
to a group and that group has a policy attached to it that will tell exactly what type of access
and where that access should be the best practices here would be to start by creating a compartment a
compartment is a collection of resources uh which will help in terms of segregating and
organizing your resources for specific projects or departments or specific teams and you're going
to see here the root compartment by default which will have the name of the cloud account
the name that you created that you choose when you created the cloud account and you're also
going to see the managed compartment for pas this will be a specific compartment created for
the platform services those two are by default and when you create compartment
you're gonna see those two as the available options for the parent compartment i recommend
choosing a name well this is those are actually mandatory fields you will need to choose a name
and a description then choose please choose the parent compile i do not recommend to provision
and create any resources directly onto the root compartment it is better to have a specific
compartment in order to isolate them we create this compartment then we go ahead to groups
and here we create a specific group for our networking admins
we also give it give the description
and and that's it that's all you need to do in order to create a group now we have the
compartment created we have the group created now in order to bind them we need to create a policy
which will do that by going on policies and clicking on create policy
again we need to give it a name and a description then we need to choose a compartment for the
location of the policy where the location will be stored i recommend choosing here the root
compartment because it will be easier for you later on to search and find the policies that you
created as well as maybe later on you decide to give access to a specific compartment over another
subcompartment that you have under the root which may not have been selected in the beginning
and that may become troublesome so the root compartment it will be the best way
the best way here uh then you have this awesome awesome policy builder uh where you have a lot of
policy templates to choose from we can search here something a policy for the networking uh
department let's see if we if we can find anything and yes we do we have the network admins that
are able to manage a cloud network this is perfect for this uh scenario and we're going to choose
we're going to choose our networking group that we created and as well the networking compartment
all right and there we are gonna have the policy statements here this is exactly how the policy
looks like uh you can imagine that by default you have deny all and whenever you create a policy
you allow you you allow the group to do a specific thing right uh you also have the
option if you don't have the luck to find any of your desired policies here desire permissions you
always have the option to click on show manual editor and create your own policy you have the
example here on how the policy is constructed and by clicking on any
of the hyperlinks it will get you to the documentation for for for the specific terms
right in order to maybe restrict access to a specific region you're gonna need the condition
uh you can also create multiple policies uh at a time by just entering a new line and
go going ahead and allowing another another group or the same group to a different set of rules
right after we create the policy all that is left is to create the user
and of course assign it to the networking administrator
so we go ahead and we click on create user in the users tab uh here you're gonna see two options
we're gonna have the worklight in the cloud services which is our default identity provider
this will be your federated identity if you choose to create the username with then you
also have the option to use a local identity or the identity and access management user
if we choose this and for this example we're going to go with this one
we're just going to give it a name and a description so for example we're going
to have network admin and again we're going to choose demo as the description
the email is optional here as opposed to do federated one where the email is a mandatory field
okay after we created our network admin group
we just need to go ahead on on the user uh on the user's page and add the user to
the networking admins group
okay uh we already added the user to the group by clicking on this blue button here
after we did this the user will leverage all the permissions all the policies that the network
admins has and by by doing that we have our first user which can or already start creating your
networking architecture now going back we have the other option for the federated identity here's
something very good to mention that you'll not be able to assign a federated identity to a group
that you created here okay this is only for the local user and we can refer to it as a local group
if we go on the federation tab and we choose our identity provider here uh we're gonna see another
set another tab with groups where we will need to create another group for the networking ad
okay but this will be on the idcs part okay so this group will be federated
and we're going to name it as as such
then it is again worth mentioning that we cannot attach a policy directly to an idcs group in order
to let's say bind them together we're gonna need to create a group mapping and the group mapping
it is exactly what what the name suggests it maps the local group with the federated group with
the idcs group so we're gonna search here for our network admins that we just created earlier in the
federation tab and we're gonna also search on the other part on the oci group we're gonna search for
the network items this is the first group created and the group that contains uh the policies
the set of rules uh selected for for it we just click on add mappings and we'll be able to see
it in the in the list here after we did that uh we just need to create a user we give it a a name
network admin let's say idcs because this one is federated uh here we are now obliged to uh to also
add the email address the first name and the last name the phone number is optional um one of the
great things by doing the by choosing a federated identity is that you can select the network admins
directly when you're creating the user so you don't have to go on the user's page
and edit manually you can assign it directly and you also can assign various other groups
the other two groups the idcs administrators which give admin access over the federation services
and the ocr administrators which will give access admin access over the oracle cloud infrastructure
services if you want to create like a second admin with the same privileges as yourself
i would recommend creating an idcs user and adding the user to both of these groups to idcs and oci
administrators and after you've done all this you just click on create and voila you just managed to
give access to your first federated user in order to start creating your networking architecture