Oracle Identity Cloud Service integrates with Oracle Identity Manager to create
hybrid solutions that extend the advanced features of Oracle Identity
Manager to the cloud. In this video I'll show you how to integrate the Oracle
Identity Cloud Service with Oracle Identity Manager. Once integrated I'll
use Oracle Identity Manager, or OIM for short, to implement segregation of
duties, user certification and hybrid reporting. In this example I'll use
segregation of duties in OIM to restrict access to an Oracle Identity Cloud
Service administrative group. The policy will ensure that users can only be in
the Java Cloud Service administrators group if they're also in the IT
department. Next I'll configure certification in OIM to implement a
cloud access review process that allows us to certify or revoke access to the
cloud. Lastly I'll view certification and segregation of duties reports in the OIM
self-service console. Let's get started! Before the hybrid scenarios can be done
I need to integrate OIM with Oracle Identity Cloud Service. I'll complete the
integration by configuring the Oracle Identity Cloud Service connector in OIM.
The connector is used automatically and continuously provision and reconcile
users and groups between OIM and Oracle Identity Cloud Service. After I install
and configure the Oracle Identity Cloud Service connector I configure OIM as
an application in Oracle Identity Cloud Service. The application configuration
provides access to the Oracle Identity Cloud Service administrative API's. Next
I configure the Oracle Identity Cloud Service IT resource. The IT resource is
configured with OAuth authorization details to allow access to Oracle
Identity Cloud Service for OIM. The Oracle Identity Cloud Service and OIM
integration relies on the HTTPS protocol. I need to configure the certificates
used for the encryption to be in the OIM trust store. Once the integration is
complete I can then reconcile Oracle Identity Cloud Service groups and
managers. In OIM the reconciliation process results in the
generation of events that are applied to OIM based on changes in the target
system, which in this case is Oracle Identity
Cloud Service. The events in this scenario will contain information about
Oracle Identity Cloud Service user accounts and group membership. Next I
expose Oracle Identity Cloud Service in the OIM catalog. I create a new OIM
sandbox with a new form for Oracle Identity Cloud Service users. Next I
enable the new form by publishing the sandbox.
After the sandbox is published I need to run the catalog synchronization job.
Synchronizing the access request catalog allows users to search for and request
access to the Oracle Identity Cloud Service in the OIM self-service console.
After completing the OIM and Oracle Identity Cloud Service integration I
test it by requesting Oracle Identity Cloud Service access for OIM users. I
do this by requesting access to Oracle Identity Cloud Service in the OIM
self-service console and activating the account in the confirmation email. I'm
now able to login to Oracle Identity Cloud Service as the provisioned user.
Next I'll configure a hybrid segregation of duties scenario. This scenario
illustrates the use of specific OIM policy enforcement in Oracle Identity
Cloud Service. First I create a rule to start the policy configuration. In this
case the rule requires that only members of the IT department can be members of
the Java Cloud Service administrators group.
Next I add the rule to a new audit policy. The identity audit feature of OIM
detects segregation of duties violations in two ways. One way is by scanning all
users in detective mode to detect violations. The other way is by
preventing users from requesting access that would violate the policies. I
perform a scan with the new policy to check for segregation of duties policy
violations with the detective mode feature of identity audit. The results of
the scan are that the Kenney Westerdal user from finance is in the JCS
administrators group in violation of the policy. The policy also proactively
prevents a policy violation. In preventive mode the user can't gain
access to both groups from Oracle Identity Cloud Service. Next I'll show
the configuration of the OIM certification
feature in our hybrid scenario. The OIM certification feature allows the users
manager and also the owners of roles, applications and entitlements to either
approve or deny requested access. In our integrated environment we can extend
this OIM feature to Oracle Identity Cloud Service users. Certification is
configured by assigning risk levels to catalog resources in OIM. In this case we
assign a level of high to JCS administrators, medium to marketing cloud
users and low to the Oracle Identity Cloud Service application. Next i create
a certification definition. Identity certification is the process of
reviewing user entitlements and access privileges. Managers use this feature to
either certify that the user can have the access or revoke the access if the
user isn't authorized. For our scenario I create a policy called Cloud Access
Review to allow for managers to review all access to the Oracle Identity Cloud
Service instance. With the certification policy in place we can now perform
certification. The results of the certification show all users with Oracle
Identity Cloud Service access. I certify all the users with the exception of one
user who I'm revoking. This user isn't authorized for cloud access. Now let's
review the results of the certification actions in the dashboard. The OIM
certification dashboard displays the result of completed certifications. The
users we approved as well as the one revoked user are shown. Next I'll show
how the OIM and Oracle Identity Cloud Service integration allows for various
hybrid reporting scenarios. With the Oracle Identity Cloud Service user
entitlement configured in OIM, we can now produce a report of all Oracle Identity
Cloud Service users. The report shows the users name, user ID, status, organization,
manager and date of last change. A separate report also shows deleted users.
The user resource access report contains an individual users access. This report
shows all provisioned resources for a particular user. Per the report this user
has access to the Oracle Identity Cloud Service.
Since I configured identity certification and identity audit
policies, I can also access reports showing the results of the policy
enforcement. This is an example certification report. The report shows
that a user had requested access but was denied by the approver per the
certification policy. This report shows a policy violation for the segregation of
duties policy I implemented earlier. The user in this report violated the
segregation of duties policy for the JCS administrators group. Only members of the
IT department can be members of the JCS administrators group. In this video I've
shown you how the Oracle Identity Cloud service could be integrated with Oracle
Identity Manager. After completing the Oracle Identity
Cloud Service connector configuration in Oracle Identity Manager, I extended
several OIM features to the Oracle Identity Cloud Service environment. These
features are segregation of duties, user certification and hybrid reporting. This
video is based on Oracle By Example tutorials in the Oracle Learning Library.
To view the detailed steps for the tutorials you can access OLL and search
for the tutorials there. Thank you for watching