In this video, I'll demonstrate adding Oracle Private Cloud Appliance as a Trusted Relying
Party in Active Directory Federation Service, or ADFS.
This video is part of a series of videos on Federating with Identity Providers.
Other videos in this series include, Federating with an Identity Provider, which you should
view first, and a video titled Adding Identity Provider Self-Signed Certificates to Oracle
Private Cloud Appliance.
Please view this video if necessary for your environment.
First I'll demonstrate this procedure from the Compute, or customer, enclave.
I'm logged on to the Compute Enclave as the admin user.
I'll click the hamburg menu and scroll down and select Identity and then Federation.
Notice the text at the bottom of this window which states, "You need the Private Cloud
Appliance Federation Metadata document when setting up a trust with Microsoft Active Directory
Federation Services or with other SAML 2.0-compliant identity providers.
This is an XML document that describes the Private Cloud Appliance endpoint and certificate
information."
I need to save this document, which currently exists only on the Oracle Private Cloud Appliance,
to the Active Directory server that is providing the Federation Services.
So I'll click here to view this document.
The document opens in another window.
I'll right-click and save it to a file named downloads.xml but you can name it whatever
you want.
You can transfer this file using whatever method you want but I'm going to open the
file with Notepad on my Windows laptop.
I'm going to select all and copy the entire file.
Next I'll show that I'm logged on to my Active Directory server.
I'll open Notepad on this server and paste the contents of the XML file.
I'll save the file in my Documents folder and name it broom15_ce.xml but you can name
it whatever you want, just make sure to use the .xml extension.
Now that I have the Private Cloud Appliance Federation Metadata document on my Active
Directory server, I can begin the process of adding my appliance as a trusted relying
party in AD FS.
From the AD FS console, I'll right-click on the top-level folder and select Add Relying
Party Trust from the drop-down menu.
The Add Relying Party Trust Wizard appears.
I'll select Claims aware, which is the default and click Start.
Next I need to select the Private Cloud Appliance Federation Metadata document that I transferred
from my appliance to this Active Directory server earlier in this demonstration.
I'll click Import data about the relying party from a file and then click Browse to select
the broom15_ce.xml file.
I'll click Next and then enter a display name of broom15 but you can name it whatever you
want.
For access control policy, I'll select Permit everyone which is the default.
I'll click Next, and then click Next again from this window.
Finally I want to check Configure claims issuance policy for this application which is the default.
I'll click Close and now I see my newly created relying party trusts appears in the list and
is highlighted.
The next step is to the claim rules so that the elements required, that is the Name ID
and groups, are added to the SAML authentication response.
With my broom15 trust selected, I'll click Edit Claim Issuance Policy on the right-hand
menu.
From the window, I'll click Add Rule.
From the drop-down Claim rule template menu, I'll select Transfrom an Incoming Claim.
Click Next then for the Claim rule name, enter nameid.
For Incoming claim type, select Windows account name.
For Outgoing claim type, select Name ID.
And for Outgoing name ID format, select Persistent Identifier.
Ensure Pass through all claim values is selected, which is the default.
Click Finish and you see the new Rule Name, nameid, is listed.
Click Add Rule again and for this rule, select Send Claims using a Custom Rule from select
the Claim rule template menu.
Click Next then for the Claim rule name, enter groups.
I'm going to paste the Custom rule which you can copy from the documentation at the URL
shown.
Click Finish and you see the new Rule Name groups is listed.
Click Apply then OK to complete the process of setting up a trust with Microsoft Active
Directory Federation Services.
One more thing I need to do in my demonstration environment is to disable certificate checking.
Customers wouldn't normally need to do this because they're using certificates that are
already known to Oracle.
This is just somthing that can be done to disable that check.
I've opened up PowerShell on the Active Directory server and type the command shown, substituting
the name of the Relying Party Trust I just added, broom15.
Finally, it's also important to know that the relying party trust I created in this
demonstration was for a specific tenancy in the compute enclave.
On the compute, or customer, enclave side, you're setting up the trust for the tenancy
only.
And since there can be multiple tenancies, each tenancy would need it's own relying party
trust.
I'll open up the Private Cloud Appliance Federation Metadata document we used to create this trust,
and see that it includes the OCID of the tenancy I was logged into when I downloaded this file.
You also have the option to create an Identity Provider for the Service Enclave, which requires
a Relying Party Trust for the Service Enclave.
Here I'm logged on to the Service Web UI, and from the Dashboard I'll click on Identity
Providers.
I'll click on the link to view the Private Cloud Appliance Federation Metadata document
and see that it has no tenancy information.
So to create a Relying Party Trust for the Service Enclave you would save this file on
to your Active Directory server, just as we demonstrated earlier in this video, and use
it as import data for the new relying party trust.
The remaining steps to add the Trust would be the same as I demonstrated in this video.
This concludes this demonstration.
Thank you for watching.
Please check our additional information on Oracle Private Cloud Appliance in the Oracle
Private Cloud Appliance Documentation or in the Oracle Private Cloud Appliance Learning
Library.