In this video, I'll discuss Federating with an Identity Provider and demonstrate how to
add an Identity Provider in Oracle Private Cloud Appliance.
Federation involves setting up a trust relationship between the identity provider (IdP) and Oracle
Private Cloud Appliance.
When the administrator has established this relationship, a user can log on to Oracle
Private Cloud Appliance using a single sign-on offered by the identity provider.
Identity federation is available for both the Compute Web UI and the Service Web UI.
Oracle Private Cloud Appliance supports the Security Assertion Markup Language (SAML)
2.0 protocol for identity federation.
However, the only identity provider supported in Oracle Private Cloud Appliance version
3.0.1 is Microsoft Active Directory, via Active Directory Federation Services.
Before you begin federating, make sure you have completed the following tasks.
You've installed and configured Microsoft Active Directory Federation Services for your
organization.
You've created groups in Active Directory that will map to groups in Oracle Private
Cloud Appliance.
And you've created users in Active Directory who will sign into Oracle Private Cloud Appliance.
In my demonstration environment, I'll show that I've created the groups and users in
Active Directory.
My group in Active Directory is named pca30-federated which I'll map to the Administrators group
in Oracle Private Cloud Appliance.
And you can see here that the pca30-federated group includes several users, including pcaFeduser1,
pcaFeduser2, and pcaFeduser3.
I'll demonstrate adding an Identify Provider from the Oracle Private Cloud Appliance Compute
Web UI but you also can, and would need to, add an Identity Provider from the Service
Web UI if you wanted to provide a single sign-on experience for the Service Enclave.
In the Compute Enclave, you need to provide a tenancy, which is pca3autotenant in my demonstration
environment.
I'll log on as the admin user and provide the password.
From the Dashboard, I'll click the hamburg menu, then select Identity, then Federation.
Note the text box at the bottom of this window.
You need to download this file and save it to the Active Directory server that is providing
the Federation Services.
You then use this file to add this tenancy as a trusted relying party in Active Directory
Federation Services.
If you have not already done so, you need to complete this step before proceeding.
See the 'Add Oracle Private Cloud Appliance as a Trusted Relying Party in Microsoft Active
Directory Federation Services' video for a demonstration of this procedure.
I'll click Create Identity Provider.
For the name, I'll enter demo and also enter demo for the description.
I'm going to scroll down and enable Encrypt Assertion.
Scrolling down further, I see the Metadata section.
Here I need to select the FederationMetadata.xml file or paste the content of the XML file.
The default location of the SAML metadata document for your ADFS is shown.
This file is also needed to add Identity Provider self-signed certificates.
See the 'Add Identity Provider Self-Signed Certificates to Oracle Private Cloud Appliance'
video for a demonstration of this procedure.
I've already downloaded this file so I'll click Drag and Drop and select the FederationMetadata.XML
file from my local system.
Next I'll click the Create Identity Provider button and we see the demo entry was created.
I need to map the Active Directory group to an Oracle Private Cloud Appliance group so
I'll click the demo link.
I'll scroll down to the Group Mappings section and click Add Mappings.
I'll provide the name of my Active Directory group, pca30-federated, and map it to the
Adminstrators group in Oracle Private Cloud Appliance.
I'll click Create IDP Group Mapping and I now see we have one group mapping.
I'll now log off as the admin user and I now have the additional Single Sign-On (SSO) option
for the demo Identity Provider that I just created.
To log on using the SSO option, I'll click demo.
After a few seconds, I'm prompted to sign in with your organizational account.
I'll enter my Active Directory user account, systest.internal\pcaFeduser1, and I'll enter
the password.
I'll click Sign in and see that I have now successfully logged on to the Compute Enclave
using my SSO account.
This concludes this demonstration.
Thank you for watching.
Please check our additional information on Oracle Private Cloud Appliance in the Oracle
Private Cloud Appliance Documentation or in the Oracle Private Cloud Appliance Learning
Library.