Set Up Identity Orchestration between Oracle Access Governance and a Flat File

Introduction

Oracle Access Governance addresses the growing challenges security owners face in dealing with the increase in advanced security threats and regulations. This cloud-native solution helps enterprises meet governance and compliance requirements across multiple applications, workloads, infrastructures, and identity platforms.

Access Governance boosts identity administration efficiency by automating provisioning and access governance processes. This automation covers attribute-based, role-based, and policy-based access control, facilitating the seamless management and granting of access rights.

Oracle Access Governance can be integrated with the identity systems by defining a connected system. A connected system allows you to load identity and access data from the identity system to Oracle Access Governance. Once defined, the connected system enables integration and data synchronization between target identity systems and Oracle Access Governance, through either a direct connection or an agent. You can connect on-premises systems, flat files, and cloud services to Oracle Access Governance.

For more information on Oracle Access Governance, see:

Objective

In this tutorial, you will learn to:

Tutorial Scenario

Flat file integration lets you onboard identities, permissions, service accounts, and user accounts from disconnected applications to Oracle Access Governance.

In this tutorial, you’ll learn to set up identity orchestration between Oracle Access Governance and a flat file. For this tutorial, you’ll use the CSV files stored in the Object storage of your OCI tenancy.

Prerequisite

You must have:

Task 1: Create a bucket in the Oracle Cloud Infrastructure (OCI)

To load the data into the Oracle Access Governance you need to place the data files in a bucket created using OCI object storage service. The bucket can be created in any compartment of your OCI tenancy.

Follow these steps to create a bucket and a service user who has manage privileges to the bucket.

  1. Create a compartment. For example, accessgov. For details on creating a compartment, see Create a compartment.

Create a bucket

  1. Log onto the Oracle Cloud Infrastructure (OCI) console.

  2. Open the navigation menu icon and click Storage.

    Description of the illustration storage.png

  3. Under Object Storage & Archive Storage click Buckets.

    Description of the illustration bucketsoption.png

  4. Select the required compartment from the List scope.

  5. Click Create Bucket. The Create Bucket dialog box appears.

    Description of the illustration creatbucket.png

  6. Bucket Name: The system generates a default bucket name that reflects the current year, month, day, and time, for example bucket-2019030620230306-1359. If you change this default to any other bucket name, use letters, numbers, dashes, underscores, and periods. Avoid entering confidential information.

  7. Ignore or leave the other settings as is and click Create. To know more information about the different options on the Create Bucket screen, see Creating an Object Storage Bucket.

Create a service user and assign ‘manage’ privileges to the bucket

  1. Create a local identity user agcs_user in the same compartment as that of the bucket. In this example, the bucket is created in the accessgov compartment. For details on creating a user, see Creating a User.

  2. Create an identity group agcs_flatfilegroup in the same domain and compartment as that of the local identity user. In this example, the domain name is default and the compartment name is accessgov. For details on creating a group, see Creating a Group.

  3. Assign the identity user agcs_user to the identity group agcs_flatfilegroup.

  4. Create a policy, agcs_flatfilepolicy, with the following policy statement:

    Syntax

    allow group <groupname> to manage objects in compartment <compartmentname> where target.bucket.name = <’bucketname’>

    For example

    allow group agcs_flatfilegroup to manage objects in compartment accessgov where target.bucket.name = ‘bucket-20231130-1143’

For details on creating a policy, see Creating a Policy.

Generate API key for service user

  1. In the Oracle Cloud Infrastructure (OCI) console, select Identity & Security, and then Domains -> Default Domain, and then from the left pane, select Users.

  2. Select the agcs_user user name that was created previously.

  3. On the left navigation panel, in the Resources section, select API keys.

  4. Click Add API key then select Generate API key pair.

  5. Click Download private key and save it.

    Description of the illustration addapikey.png

  6. Click Add. The configuration file is created displaying fingerprint, and config file details. Save the information available on the configuration file in a separate text file.

    Description of the illustration APIpreview.png

A sample config file is listed here for your reference:

[DEFAULT]
user=abcd1.user.zyx1...
fingerprint=14:b5:a1:90:a1:d3:...
tenancy=abcd1.tenancy.ab1...
region=ab-sample-2..
key_file=<path to your private keyfile> # TODO

Task 2: Establish connection between bucket and Oracle Access Governance

You can establish a connection between your bucket and Oracle Access Governance by entering connection details. To achieve this, use the Connected Systems functionality available in the Oracle Access Governance Console.

  1. Log onto an Oracle Access Governance Instance.

  2. From the Oracle Access Governance navigation menu icon select Service Administration > Connected Systems.

  3. Click Add a connected system.

    Description of the illustration addconnectedsystem.png

  4. In the Select and configure a new Connected System step, select the Flat File tile and click Next.

    Description of the illustration flatfile.png

  5. In the Enter details step, enter a name for the application you want to connect to in the What do you want to call your Flat File? field.

  6. Enter a description for the application in the How do you want to describe this Flat File? field.

  7. Determine if this connected system is an authoritative source, and if Oracle Access Governance can manage permissions for existing users by setting the following checkboxes.

    • This is the authoritative source for my Identities - If selected, allows you to load the identities into the Access Governance system as a user.
    • I want to manage permissions for this Connected System - If selected, allows you to load the account and permissions into the Access Governance system.

    Note: A combination of both options would load the identities into the system, followed by the account details, and will create an interlink between the identities and the accounts.

  8. Click Next.

    Description of the illustration enterdetails.png

  9. In the Configure step, enter the following details and click Add.

    • In the What is the OCI user’s OCID? field, add the OCID for the OCI user owning the bucket containing the flat files you want to integrate. For example, the information in the user field.
    user=abcd1.user.zyx1...
    • In the What is the fingerprint of the OCI user’s API key? field enter the fingerprint for the OCU user’s API key. For example, the information in the fingerprint field.
    fingerprint=14:b5:a1:90:a1:d3:...

    • Enter the user’s private API key, in PEM format into the What is the OCI user’s private API key in PEM format? field. For example, open the previously downloaded private key in any text editor and copy the content of the file and place it in the What is the OCI user’s private API key in PEM format? field.

    • Enter the tenancy into the What is the tenancy of the OCI user? field. For example, the information present in the tenancy field.

    tenancy=abcd1.tenancy.ab1...
    • Enter the home region code of the tenancy into the What us the OCI tenancy’s home region code? field. For example, the information in the region field.
    region=ab-sample-2..

    • Enter the bucket namespace of the tenancy in the What is the namespace for the bucket? field.

      To get the bucket namespace details:

      1. In the Oracle Cloud Infrastructure (OCI) console, select Storage and then under Object Storage & Archive Storage click Buckets.

      2. Click on the previously created bucket. In this case bucket-2019030620230306-1359.

      3. From the Bucket Information tab copy the bucket namespace.

        Description of the illustration bucketnamespace.png

    • In the What is the name of the bucket? field, enter the name of the bucket where your flat file is stored in OCI object storage. In this case bucket-2019030620230306-1359.

    • Enter the encoding into the Encoding field. Default is UTF-8.

    • In the Field Delimiter field, enter the field delimiter character used in the flat file. Default is ,.

    • In the Sub Field Delimiter field, enter the sub field delimiter character used in the flat file. Default is #.

    • In the MultiValue Delimiter field, enter the multivalue delimiter character used in the flat file. Default is ;.

    • In the Text Qualifier field, enter the character used in the flat file to act as a text qualifier. Default is “.

    • If you want to check the connectivity to your Flat File, click the Test Connectivity button. Once you have confirmed the connectivity, click Add to save your configuration.

      Description of the illustration configureflatfile.png

Task 3: Check bucket folder structure

To check the bucket folder structure login to the OCI Console and navigate to Object Storage. Select your connected system bucket. Under the Resources menu, select Objects, and confirm the folder structure. <ServiceInstanceName>/<ConnectedSystemName> failed inbox outbox sample schema

Description of the illustration folderstructure.png

These folders fulfill the following purposes:

Task 4: Create CSV flat files

For this tutorial, we will use sample csv files that you can access from:

Note: To download the files, right-click the file name and select to open link in new tab.

Task 5: Place the CSV flat files in the bucket folder

Perform the following steps to upload the CSV flat files into the bucket object storage.

  1. Access the bucket on OCI and click the inbox folder to upload the CSV flat files.

    Description of the illustration inbox.png

  2. Click the three dots corresponding to the folders to upload the CSV flat files:

    • IDENTITY - To upload identity.csv
    • PERMISSION - To upload permission.csv
    • TARGETACCOUNT - To upload targetaccount.csv

  3. Click Upload.

  4. In the Upload Objects popup screen, click select files link in the Choose Files from your Computer field.

  5. Browse and locate the file and click Upload.

    Description of the illustration uploadidentityfiles.png

  6. Perform the similar steps to upload other required CSV flat files.

    Description of the illustration inboxuploadedfiles.png

Task 6: Run Dataload and Manage Identities in the Oracle Access Governance

After placing the relevant CSV flat files into the inbox folder we must run a dataload on demand. Each time you run a dataload it is always a full data load and there is no incremental data load.

If there is any kind of failure (single record or complete file failure), the data load operation will be marked as failed. The files that have been processed successfully will stay in the inbox while the failed files will be moved to the failed folder. After fixing the data issue, you are expected to put the files back in the inbox again and retry the dataload operation. Data integrity issues, such as a permission being assigned to an account that is missing in the CSV can cause the dataload operation to fail. However, in such cases the CSV files will not be moved to the failed folder. Files will be moved to the failed folder only when there are issues reading the data itself, such as missing mandatory data.

To run dataload

  1. Log onto the Oracle Access Governance console.

  2. From the Oracle Access Governance navigation menu icon select Service Administration > Connected Systems.

  3. Click the flat file connected system.

  4. Click Load data now button.

    Description of the illustration dataload.png

  5. Wait for the data load to complete and then access the integrated files.

To Manage Identities

  1. Log onto the Oracle Access Governance console.

  2. From the Oracle Access Governance navigation menu icon select Service Administrator > Manage Identities.

  3. Select Active from the Manage Identities page.

  4. Select Any if any one of the set conditions should be satisfied, or select All if all the set conditions must be satisfied for that identity. For this tutorial, select Any.

  5. Select the attribute name Status from the list.

  6. Select the Equals conditional operator.

  7. Select the Active attribute value.

    Description of the illustration manageidentities.png

  8. Continue to add the conditional statements or rules for more attributes.

  9. Once you have defined your rules, select Preview summary based on the rule above to go to the Preview Summary popup. This will display the following information, for the top 10 in each category:

    • Total number of matches based on the rules you have entered.
    • Total number of identities in the service.
    • Breakdown of the distribution of included identities based on:
      • Job code
      • Location
      • Employee type

    Description of the illustration previewsummary.png

  10. Click Save to save your included identities rules.

Upon successful execution of this rule, you can see a few more menu options, for example, Identity Attributes, enabled for you. You can verify the identities from Who has access to What > Enterprise-wide access.

To verify Who has access to what

  1. In the Oracle Access Governance console, From the Oracle Access Governance navigation menu icon select Who has Access to What > Enterprise-wide Access.

    Description of the illustration whohasaccesstowhat.png

  2. Click the View the identities that have access link corresponding to the connected system to view the data loads.

    Description of the illustration identitiesdataload.png

Acknowledgments

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.