Oracle® Cloud

What’s New for Oracle Identity Cloud Service

Release 19.2.1

E81008-37

September 2019

What’s New for Oracle Identity Cloud Service

When new and changed features become available, Oracle Identity Cloud Service instances are upgraded in the data centers where Oracle Cloud services are hosted. Here’s an overview of new features and enhancements added recently to improve your Oracle Identity Cloud Service experience.

This guide documents the complete set of new and changed features for Oracle Identity Cloud Service. Your localized version of Oracle Identity Cloud Service might contain a subset of these features. Therefore, you might find features in this documentation that are not available in your localized version of Oracle Identity Cloud Service.

Application Integration

To find out about the new applications and features that have been added to the Oracle Identity Cloud Service Application Catalog, see the What's New section of the Oracle Identity Cloud Service - Application Catalog.

Release 19.2.1 — August 2019

Category Feature Description

Applications

Customize OAuth Consent Page

Customize the information that appears in the OAuth consent page for custom applications that require consent to access application's resources. See Edit Consent Information for Custom Applications.

Applications

Enterprise Application

Learn what are enterprise applications and how to integrate them with Oracle Identity Cloud Service for authentication purposes using App Gateway. See Secure Enterprise Applications with App Gateway.

Applications

SAML assertion encryption support

Oracle Identity Cloud Service now supports assertion encryption for SAML applications. You can provide certificate and encryption algorithm. See Add a SAML Application.

Applications

Synchronization Failure Report

Learn about the reason behind the synchronization failures from a synchronization failure report of a provisioning application. See Work with the Synchronization Failure Report.

Applications

Personal Access Token

Generate and download your personal access tokens. A client application can use these tokens to access a specific resource application for a limited period. See Generate Personal Access Tokens.

Applications

Assign users and groups to custom applications

Use a form to enter values while assigning users and groups to provisioned applications. See Assign Users to Custom Applications and Assign Groups to Custom Applications.

Applications

Integrate your Linux environment with Oracle Identity Cloud Service.

A new Pluggable Authentication Module for Linux that allows you to integrate your Linux environment with Oracle Identity Cloud Service to perform end user authentication with first and second factor authentication.

See Manage Linux Authentication using the Identity Cloud Service Linux Pluggable Authentication Module.

Groups

Populate form fields for managed applications that you assign to groups.

If you assign a managed application to a group, then a form appears for the application. You can populate the fields of this form to reflect the values of your application. Or, if you assigned the managed application to the group, then you can modify the values of the application form.

See Assign Applications to the Group.

Settings

New notifications

Two new notifications have been added:
  • Exceeded Maximum Number of Account Recovery Attempts: After a user exceeds the maximum number of attempts to reset their password to recover their account, this notification is sent to the user’s primary email address.
  • New Device Login Detected with Your Account: If an attempt is made to log in to a user's account from a device, IP address, or web browser, and Oracle Identity Cloud Service doesn't recognize that the device, address, or browser is associated with the account, then this notification is sent to the user. The notification contains a link that the user can click to reset their SSO password in case the user doesn't recognize the login attempt.

See About User Notifications.

Settings

New Provisioning Bridge feature

A new bridge is available for Oracle Identity Cloud Service: the Provisioning Bridge. This bridge provides a link between your on-premises apps and Oracle Identity Cloud Service. Through synchronization, account data that’s created and updated directly on the apps is pulled into Oracle Identity Cloud Service and stored for the corresponding Oracle Identity Cloud Service users and groups. Any changes to these records will be transferred into Oracle Identity Cloud Service. So, if a user is deleted in one of your apps, then this change will be propagated into Oracle Identity Cloud Service. Because of this, the state of each record is synchronized between your apps and Oracle Identity Cloud Service.

See Understand the Provisioning Bridge.

Settings

Enhancements to the Microsoft Active Directory (AD) Bridge

There are now two types of imports that you can run by using the Microsoft Active Directory (AD) Bridge to import users and groups from AD into Oracle Identity Cloud Service:

  • Full import: The AD Bridge polls AD and retrieves data associated with all user and groups that you selected in the Select organizational units (OUs) for users and Select organizational units (OUs) for groups panes of the Configuration tab for the bridge. This data represents users and groups that were created, modified, or removed in AD.
  • Incremental import: Similar to a full import, but for this type of import, the AD Bridge polls AD and retrieves only user and group data that changed since you last used the AD Bridge to import users and groups into Oracle Identity Cloud Service.

After users are imported into Oracle Identity Cloud Service through the AD Bridge, if you activate or deactivate a user, modify a user's attribute values, or change group memberships for a user in Oracle Identity Cloud Service, then these changes will be reflected in AD.

See Manage Microsoft Active Directory (AD) Bridges for Oracle Identity Cloud Service.

Settings

Enable the Access for an unknown device event of Adaptive Security for your custom sign-in page.

Adaptive Security uses the concept of risk providers to allow administrators to configure various contextual and threat events to be analyzed within Oracle Identity Cloud Service. A default risk provider within Oracle Identity Cloud Service is seeded automatically with a list of supported contextual and threat events, such as Access from an unknown device. For this event, if a user accesses Oracle Identity Cloud Service from a device that hasn’t been previously used to access the service, then this event (commonly referred to as Device Fingerprinting) is triggered.

Although Oracle Identity Cloud Service has a sign-in page, you may prefer to use your own page. If so, then you can use the Identity Cloud Service Device Fingerprint Utility to enable the Access for an unknown device event of Adaptive Security for your custom sign-in page.

See Download Oracle Identity Cloud Service SDKs and Applications.

Settings

Handle on demand language support for email and SMS templates.

You can now select French (Canada) as the language for email and SMS notifications.

Security

New App Gateway Feature

App Gateway enables you to integrate web applications hosted on-premises or on a cloud infrastructure with Oracle Identity Cloud Service for authentication purposes. See Manage Oracle Identity Cloud Service App Gateways.

Security

New user manager administrator role

A new administrator role is available for Oracle Identity Cloud Service: user manager. A user manager can manage all users or users of selected groups in Oracle Identity Cloud Service. User managers can update, activate, deactivate, remove, and unlock user accounts. User managers can also reset passwords, reset authentication factors, and generate bypass codes for user accounts.

See Understand Administrator Roles.

Security

New Account Recovery feature

A new feature is available for Oracle Identity Cloud Service: account recovery. Account recovery is an automated process designed to help users regain access to their accounts if they have trouble signing in, they’re locked out, or they forget their passwords.

There are three account recovery factors that administrators can configure for users:

  • Security questions: You can allow a user to select and answer security questions, and provide hints for answers to these questions, to verify their identity. If they have to recover their account, then they must answer these questions correctly to regain access.

  • Email: By default, a user’s primary email address has been set as the email address that Oracle Identity Cloud Service will use to help the user recover their account. If the user has to regain access, then Oracle Identity Cloud Service will send a notification to this email address. The user follows the instructions in the notification to recover their account. Instead of their primary email address, you can allow the user to specify an alternate (recovery) email address to regain access to their account.

  • Text message (SMS): You can allow a user to provide a mobile number that Oracle Identity Cloud Service will use to help them recover access to their account. This way, if they have to regain access, then Oracle Identity Cloud Service will send a passcode in a text message (SMS) to this mobile number. The user enters this passcode to recover their account.

In addition to setting account recovery factors, administrators can specify:

  • How many consecutive, unsuccessful account recovery attempts a user can make before the user’s account is locked.

  • How long the user’s account will be locked before they can attempt to recover their account again.

See Manage Account Recovery in Oracle Identity Cloud Service.

Security

New events added to the default risk provider

There are three new events added to the risk provider that's associated with Oracle Identity Cloud Service actions. This risk provider, known as the default risk provider, evaluates these events to determine risk-based activity for Oracle Identity Cloud Service users.

  • Impossible travel between locations: Oracle Identity Cloud Service obtains the user’s current access location, using the IP address, and calculates the distance between this location and the user’s immediately preceding access location. If it determines that this distance can’t be covered at the speed specified in the threshold, then this event (commonly referred to as geo-velocity) is triggered.
  • Access from an unfamiliar location: If a user accesses Oracle Identity Cloud Service from a location that hasn’t been used previously to access the service, then this event is triggered. Oracle Identity Cloud Service obtains the user’s current access location, using the IP address, and determines if this location has been used previously. If it's a new location, then the service determines the distance between the current access location and the user’s immediately preceding access location. If the distance between these two locations exceeds the value specified in the threshold, then this event is triggered.
  • Access from suspicious IP addresses: If the IP address from where the user is accessing Oracle Identity Cloud Service is flagged as suspicious by the integrated IP reputation provider, then this event is triggered.

See Configure Oracle Identity Cloud Service Risk Events.

Security

See the cloud account name and instance name from the Identity Cloud Service console.

The names of both the primary or secondary instance and the Oracle Cloud account that was used to create this instance appear in the Identity Cloud Service console. To access this information, click the user icon in the upper-right corner of the console, and then select About from the drop-down menu. The Cloud Account Name and Instance Name fields display the names of the Oracle Cloud account and the instance.

See Identify and Switch Instances.

Security

Network Failure Handling in Delegated Authentication

Oracle Identity Cloud Service provides the local password caching functionality that helps delegated users to login into Oracle Identity Cloud Service even if Active Directory is not reachable.

See Handle Network Failure in Delegated Authentication.

Sign-In

Enhanced sign-in user experience

Oracle Identity Cloud Service has updated the sign-in user experience for the standard Identity Cloud Service sign-in pages for a fresh and more intuitive sign-in process. Users see this new look throughout the sign-in and password reset flows. Although the look is different and usability improvements have been incorporated, the functionality remains the same. This change will be seen by all users of the standard Identity Cloud Service sign-in pages, including Oracle IaaS and PaaS users leveraging Oracle Identity Cloud Service.

For customers who have branded the sign-in page by adding a custom logo and text, your logo and text will appear integrated into the new pages. For customers who have replaced Oracle Identity Cloud Service's default sign-in page with a custom one, your custom page won't be impacted as a result of the new sign-in experience.

See Oracle is updating the Identity Cloud Service sign-in experience.

User Settings

Change settings associated with user accounts.

You can now change settings associated with user accounts. For example, you can make the primary email address for a user account a required or optional attribute.

By making the primary email address optional, if Oracle Identity Cloud Service integrates with another cloud service or on-premises application, then a user’s email address can be propagated from that service or application back into Oracle Identity Cloud Service, and be designated as the user’s primary email address in Oracle Identity Cloud Service.

See Change User Settings.

Users

Use the My Profile console to edit attribute values for your user account.

You can no longer edit attribute values for your user account from the Identity Cloud Service console. To do this, access the My Profile Details tab of the My Profile console.

See Edit Attribute Values for the User Account.

Users

Oracle Identity Cloud Service unlocks all user accounts after 24 hours automatically.

If a user's account is locked, and the user or an administrator doesn't unlock the account within 24 hours, then Oracle Identity Cloud Service will unlock it automatically.

See Unlock User Accounts.

Users

See the Multi-Factor Authentication (MFA) status for users.

By accessing the Security tab for any user account, you can see whether the user is enrolled in Multi-Factor Authentication (MFA).

See View Details About User Accounts.

Users

See the statement of the terms of use associated with user's consents.

From the My Consents tab of the My Profile console, users can now see the terms of use they agreed upon accessing applications . See Access Your Consents.

REST APIs

New endpoints added to Oracle Identity Cloud Service REST APIs

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoints have been added:
  • UserAttributesSettings - Use this endpoint to set the User schema attribute.
  • AccountRecoverySettings - Use this endpoint to manage tenant-specific account recovery settings.
  • MePasswordRecoveryFactorValidator - Use this endpoint to validate the password recovery factors of a user.
  • MeRemovePendingEmailVerification - Use this endpoint to remove pending verification email(s) and to delete an associated user token.

See REST API for Oracle Identity Cloud Service..

REST APIs

Deprecated REST API endpoint

The following endpoints are deprecated in the 19.2.1 release:
  • /ManagedObjectSyncDetailedJobReport
  • /sso/v1/sdk/idp (Alternate endpoint /sso/v1/sdk/secure/idp)
  • /sso/v1/sdk/session (Alternate endpoint /sso/v1/sdk/session/secure/idp)

See REST API for Oracle Identity Cloud Service..

REST APIs

New Use cases

The Authenticate API's have added support for new features such as Account Recovery (SMS and Security Questions) and Terms of Use. If an administrator chooses to enable these new features, he must ensure that all custom code which uses these authenticate API's have been updated to support the payloads for these new features.

The following use cases have been added:
  • Authenticating User Name and Password with TOU Consent - This use case explains using IDCS authenticate API to authenticate user's credentials with TOU consent
  • Generate Access Token Using Authentication API - This use case explains how to generate access token using authentication API
  • Authenticating User Name and Password and Enrolling in Account Recovery - This use case explains using IDCS authenticate API to authenticate with user's credentials and enroll in Account Recovery

  • Authenticating User Name and Password and Enrolling in Account Recovery and MFA - This use case explains using IDCS authenticate API to authenticate with user's credentials and enroll in Account Recovery and Multi-Factor Authentication (MFA).

  • Factor Enrollment with Verification - This use case explains using IDCS Authenticate API that allow a user to enroll for various MFA factors.

See REST API for Oracle Identity Cloud Service..

REST APIs

OAuth Access Token Size

The OAuth access token size is set to 16000 characters by default.

Infrastructure

Use Oracle Cloud Infrastructure service gateway to communicate with other Oracle Cloud services.

Oracle Identity Cloud Service instances can use Oracle Cloud Infrastructure service gateway to communicate with other Oracle Cloud services within the same region, without the need of this communication to go over the internet.

See Supported Cloud Services in Oracle Services Network.

See Access to Oracle Services: Service Gateway to learn more about Oracle Cloud Infrastructure service gateway.

Other Noteworthy Changes

Category Feature Description
Reports PDF Deprecation From release 19.2.1 onward, PDF report generation is deprecated. Oracle Identity Cloud Service supports only CSV, JSON format for report generation.

Release 18.4.3 — July 2019

Category Feature Description

Infrastructure

Oracle Identity Cloud Service on Oracle Cloud Infrastructure

As a part of our efforts to improve service reliability and performance, the latest release of Oracle Identity Cloud Service now runs on Oracle Cloud Infrastructure (OCI), our next-gen infrastructure. Learn more about Oracle Cloud Infrastructure.

You can find more information about Oracle Identity Cloud Service in the Oracle Help Center. Technical assistance for Oracle Identity Cloud Service is available through Oracle Support.

Customer Migration to OCI

Oracle Identity Cloud Service on Oracle Cloud Infrastructure

For existing customers, Oracle Identity Cloud Service will be undergoing planned maintenance to migrate network infrastructure in multiple regions. Learn more about the benefits of Oracle Cloud Infrastructure. No action is required by customers to initiate the planned maintenance. Customers will receive an email notification in advance that indicates when the maintenance will occur, and another when the maintenance has completed. Once maintenance has completed, connectivity to Oracle Identity Cloud Service will continue automatically if you have configured your IP ranges in accordance with the instructions below.

  • If you have whitelisted the IP ranges of Oracle Identity Cloud Service, you are required to update your access rules with the IP ranges for each Oracle Cloud Infrastructure region. See Review the IP ranges for different Oracle Cloud Infrastructure regions.
  • Once the maintenance window has been completed, Oracle recommends you remove the old IP ranges from your access rules.

If this IP range update is not completed prior to the start of the maintenance window you may be unable to connect to Oracle Identity Cloud Service.

Self-Service Diagnostics

Set the diagnostics type to capture operational logs.

Diagnostic Data reporting has been added to the Oracle Identity Cloud Service user interface. See Run the Diagnostic Data Report.

Release 18.4.2 — December 2018

Category Feature Description

Adaptive Security

Activate and deactivate the default risk provider

In addition to third-party risk providers, you can now activate and deactivate the default risk provider.

See Activating and Deactivating Risk Providers.

Adaptive Security

Use the slider to set the weighting for events

Set the weighting for the Access from an unknown device, Too many unsuccessful login attempts, and Too many unsuccessful MFA attempts events to Low, Moderate, Severe, or Critical. Oracle Identity Cloud Service evaluates these events to determine risk-based activity for Oracle Identity Cloud Service users.

See Configuring the Default Risk Provider.

Applications

Enhancements to SAML Application Configuration

There are two enhancements to the SAML Application Configuration:

  • You can now collectively configure User and Group attributes under the Attributes section in SAML Application Configuration.

  • In addition to configuring an attribute to have one of the predefined user attribute values, you can also specify path expressions to define how the value of the assertion attribute should be calculated.

See Adding a SAML Application.

Applications

Support to allow access to OPC resources

You can now allow clients to access OPC resources using hierarchical scope matching. If the requested scope has similar urn:opc:resource:consumer prefix in any of the clients' Allowed Scopes, then the client can access the OPC resource. However, if the requested scope has a different qualifier (with the exception of ::all) that doesn't match with the Allowed Scopes, then the client can't access the OPC resource.

See Adding a Confidential Application and Configuring Authorized Resources.

Notifications

Oracle Identity Cloud Service now checks whether verification is done to the email address that will appear in the From Email field for all notifications.

A new feature of the Notifications page is the Check Status button. By clicking this button, Oracle Identity Cloud Service checks whether verification is done to this email address through the email sent to the postmaster (domain) or email account.

If the email address isn't verified, then access the notification that's sent to the email address you provided, click the verification link in the notification, and click Check Status again. The status will change to Email Verified.

If the domain isn't verified, then contact the postmaster of your company so that the postmaster can verify the domain associated with the email address.

See Activating Notifications.

Scenarios

Migrate from traditional Cloud accounts to Cloud accounts with Identity Cloud Service

You use an Oracle Cloud account to access your cloud services and log into the My Services Dashboard, which is where you manage your account and your services. When you sign in to your Oracle Cloud account, you can choose to sign in to two different types of Cloud accounts:

  • A traditional Cloud account (also known as a cloud service account)

  • A cloud account with Identity Cloud Service

Traditional Cloud accounts use one identity management system which is different from the identity management system associated with Cloud accounts with Identity Cloud Service.

You can migrate users and role memberships from traditional Cloud accounts for the following Oracle Cloud services:

  • Oracle Business Intelligence Cloud Service

  • Oracle Integration Cloud Service

  • Oracle Mobile Cloud Service

  • Oracle Process Cloud Service

  • Oracle Visual Builder Cloud Service

Each service has a corresponding Cloud account with Identity Cloud Service to which you can import the users and the application role memberships. By migrating services from a traditional Cloud account to a Cloud account with Identity Cloud Service, the services can use Oracle Identity Cloud Service to manage users and to control access to the services. For this reason, you want to migrate your traditional Cloud accounts to Cloud accounts with Identity Cloud Service.

See Migrating from Traditional Cloud Accounts to Cloud Accounts with Identity Cloud Service.

Terms of Use Customize Terms of Use for Users Configure customized disclaimers and acceptable use policies for users on an application basis. Also collect consent from users before allowing them access to their applications.

See Managing Terms of Use

Social Login

Add multiple instances of the same social identity provider

Some cloud services have applications that may have to connect to multiple instances of the same social identity provider. For example, for application A and application B, the Facebook social identity provider can be configured as an identity provider along with distinct configuration settings, such as a Client ID and Secret, social registration settings, and so on. To support such scenarios, Oracle Identity Cloud Service now allows you to add multiple instances of the same social identity provider with different configuration settings for each instance.

After adding multiple instances of a social identity provider, you can choose which instances can be used to sign in to Oracle Identity Cloud Service by using an identity provider policy.

See Adding a Social Identity Provider.

REST APIs New endpoints added to Oracle Identity Cloud Service REST APIs

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoints have been added:

  • /mfa/v1/requests - Use this endpoint to initiate and complete verification of a default Multi-Factor Authentication factor or a backup factor.

  • /FromEmailAddressValidator - Use this endpoint to validate the status of the From Email Address or Email Domain from the OPC Notification Service.

REST API for Oracle Identity Cloud Service.

Other Noteworthy Changes

Category Feature Description

AD Bridge

Set Permissions for Microsoft Active Directory Bridge

Read about how to set permissions for a Microsoft Active Directory user account to perform actions such as delegate password reset and synchronization between Microsoft Active Directory Bridge and Oracle Identity Cloud Service.

See Setting Permissions for the Microsoft Active Directory User Account.

Reports Change in reports download behavior

Oracle Identity Cloud Service supports CSV, JSON, and PDF report generation. However, the result count for the PDF report is restricted to 1000 rows. For any report exceeding 1000 rows, only the CSV download is available.

See Organize the Report Data.

Release 18.3.4 — August 2018

Category Feature Description

Reporting

Diagnostic Data Report

Diagnostic Data reporting has been removed from the Oracle Identity Cloud Service user interface. Use the REST API for Oracle Identity Cloud Service to capture diagnostic data.

See Diagnostic Records REST Endpoints

Release 18.2.6 — July 2018

Category Feature Description

Bridge

Enhancements to AD Bridge configuration

For version 18.2.6 of Oracle Identity Cloud Service, there are two enhancements to the bridge:
  • The Include hierarchy check box. If you select this check box, and then select a parent OU, all children OUs will be selected. The OUs contain the users and groups that you want to import into Oracle Identity Cloud Service.

  • The Filter text box. Use this text box to enter a custom filter to search for user or group OUs. For example, enter (&(objectClass=User)(sn=Smith)) to return all users with the last name of Smith. Or, enter (department=IT) to return the IT group.

See Configuring a Bridge.

Notifications

Validate the entire email address instead of the email domain only

Now, you can verify either the domain of an email address or the entire email address. When you configure notifications, there are two options: Domain and Email.

Use the Domain option to send a validation email to the postmaster account of the email’s domain or the Email option to send an email to an email address for verification purposes.

See Activating Notifications.

Administration

Support for editing Oracle Cloud Applications

As Service Administrators, you can now edit certain UI elements of Oracle Cloud Applications in Oracle Identity Cloud Service. You can also assign Oracle Cloud Applications to Sign-On Policies.

See Editing High-Level Information for Oracle Applications.

REST APIs

New endpoints added to Oracle Identity Cloud Service REST APIs

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoints have been added:
  • /TermsOfUse - Use this endpoint to manage terms of use, which maintains the terms of use statements for applications.

  • /TermsOfUseStatements - Use this endpoint to manage the terms of use statement, which maintains the terms of use statement that is associated with the terms of use.

  • /SocialIdentityProviderMetadata - Use this endpoint to manage metadata for defining interaction with various social identity providers such as Facebook, LinkedIn, and Google.

  • /UserAppsEnabledForAuthentication - Use this endpoint to return a list of all available target apps for a user on which delegated authentication can be performed.

See REST API for Oracle Identity Cloud Service.

REST APIs

Deprecated REST API endpoint

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoint will be removed in the upcoming release 18.2.6:
/ServiceProviders

In previous releases, the /ServiceProviders endpoint was used to configure SAML service provider partners. The introduction of SAML Apps in release 16.4.6 rendered this endpoint obsolete and it was deprecated. In the upcoming 18.2.6 release, the /ServiceProviders endpoint will be removed.

See REST API for Oracle Identity Cloud Service.

Security

Terms of Use

Terms of Use is a feature in Oracle Identity Cloud Service that help customers to set the conditions for the users to access the applications based on their consent.

This feature allows the identity domain administrators to set relevant disclaimers for legal or compliance requirements.

Release 18.2.4 — May 2018

See how to configure MFA, the factors available for use with MFA, and how to create a sign-on policy for MFA by watching the Configuring Multi-Factor Authentication video.

Learn how to configure a web application to authenticate with Oracle Identity Cloud Service by viewing the Use Secure Form Fill to Authenticate an Application with Oracle Identity Cloud Service Use Secure Form Fill to Authenticate an Application with Oracle Identity Cloud Service tutorial.

Category Feature Description

Applications

Update your SAML applications

If there are updates to your SAML applications, you can now choose to upgrade them starting with this release. If your SAML application has an update, you will see the Upgrade button visible in the UI. Click the button to upgrade the application.

See Upgrading a SAML Application.

Applications

Support for providing a Custom Error URL for applications.

You can now provide a Custom Error URL to redirect a user in case of a failure. If not provided, the tenant specific Error page URL will be used.

Applications

Support for configuring tenant specific Error page URL

You can now provide a tenant specific custom Error page Url to redirect a user in case of a failure. See Changing Session Settings

Applications

Support for providing Linking callback URL

You can now provide a Linking callback URL that Oracle Identity Cloud Service can redirect to after linking of a user between social providers and Oracle Identity Cloud Service is complete.

Applications

Use App Gate to access your on-premises applications securely and remotely

Use the App Gate together with Oracle Identity Cloud Service to give your employees the ability to access your on-premises applications securely and remotely.

Because the App Gate integrates with Oracle Identity Cloud Service seamlessly, your employees can connect to these applications, using SSO, without the hassles of a VPN or SSL client certificates. This integration provides you with an additional layer of security, which is crucial to protecting your on-premises applications.

In addition, the App Gate is an ideal solution for you if:
  • You want to unify all of your Identity and Access Management products under one Identity as a Service (IDaaS) platform, but you have to integrate with applications that don’t support federation (such as SAML or WS-Fed).

  • Your vendors, customers, or partners must access your internal business applications such as Oracle E-Business Suite from the Internet.

  • You want to restrict unauthorized network access to your applications.

  • You must comply with industry regulations, like Sarbanes-Oxley, HIPPA, and others.

  • Your enterprise has Web applications that lack a native authentication mechanism.

  • You’re looking for a cost-effective replacement for your on-premises Web-access management solution.

  • You need a supported replacement of Shibboleth.

From the App Gateway for Identity Cloud Service application, you can access the documentation for the App Gate. You can find this application on the Downloads page of the Identity Cloud Service console. To access this page, in the Identity Cloud Service console, expand the Navigation Drawer, click Settings, and then click Downloads.

Branding

Revert custom branding to default Oracle branding

If you have customized the Sign In page, the Admin Console, or the notifications for Oracle Identity Cloud Service, and want to revert to Oracle Branding (default), you can do so starting with this release.

See Branding the Oracle Identity Cloud Service Interface.

REST APIs

Deprecated REST API endpoint

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoint will be removed in the upcoming release 18.2.6:
/ServiceProviders

In previous releases, the /ServiceProviders endpoint was used to configure SAML service provider partners. The introduction of SAML Apps in release 16.4.6 rendered this endpoint obsolete and it was deprecated. In the upcoming 18.2.6 release, the /ServiceProviders endpoint will be removed.

See REST API for Oracle Identity Cloud Service.

REST APIs

New endpoints added to Oracle Identity Cloud Service REST APIs

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoints have been added:
  • /AppEntitlementCollection - Use this endpoint to manage collections of entitlements from Apps. For example, an administrator can grant an AppEntitlementCollection as a single gesture that causes the grantee to receive every entitlement in that collection.

  • /UserAuditEventsPurger - Use this endpoint to delete all of the audit events that are related to a deleted user.

  • /DBGroups - Use this endpoint to manage all group administrative tasks. A group contains one or more users and works as a role for the enterprise to apply security features.

See REST API for Oracle Identity Cloud Service.

Application Development SDKs

Updates to SDKs for web applications

There are updates to the software development kits (SDKs) that enable you to easily integrate and authenticate your .NET or PHP web applications with Oracle Identity Cloud Service.

Sample applications and tutorials on using these SDKs are available at the web-based Cloud Developer Portal.

Other Noteworthy Changes

Category Feature Description
REST APIs Read about OpenID Connect and see examples in the Oracle Identity Cloud Service REST API content.

Extensive OpenID Connect documentation and examples are now available in the Oracle Identity Cloud Service 18.2.4 REST API documentation.

OpenID Connect extends the OAuth 2.0 protocol to add a simple authentication and identity layer that sits on top of OAuth 2.0. Using OpenID Connect completes the picture by providing applications with information about the user, the context of their authentication, and access to their profile information. OpenID Connect allows clients of all types, including web-based, mobile, and JavaScript clients to request and receive information about authenticated sessions and end users.

See Using OpenID Connect to Extend OAuth 2.0.

Release 18.1.6 — March 2018

Category Feature Description

Delegated Authentication (On-demand)

Sign in with your Microsoft Active Directory password

With the Delegated Authentication feature in Oracle Identity Cloud Service, you no longer have to synchronize all your enterprise users' passwords between your on-premises Microsoft Active Directory and the cloud. Users can be configured to use their existing Microsoft Active Directory passwords to authenticate, and access resources and applications protected by Oracle Identity Cloud Service.

See Managing Delegated Authentication in Oracle Identity Cloud Service.

Adaptive Security

Risk- and context-based analysis to detect and remediate anomalous activities

Oracle Identity Cloud Service is excited to announce brand new functionality called Adaptive Security that can provide customers with strong authentication capabilities based on user behavior in Oracle Identity Cloud Service, and across multiple heterogeneous on-premises and cloud systems. When enabled, the Adaptive Security feature can analyze a user's risk profile within Oracle Identity Cloud Service, based on their historical behavior, such as too many unsuccessful login attempts, too many unsuccessful MFA attempts, and real-time device context, such as logins from unknown devices.

To evaluate a user's behavior across other systems with which Oracle Identity Cloud Service is not directly involved, the Adaptive Security feature enables you to configure your existing risk providers like Cloud Access Security Broker (CASB), Security Information and Event Management (SIEM), and so on, to obtain the user's risk score from these external providers.

With this enriched context and risk information, Adaptive Security risk profiles each and every user and arrives at its own risk score and an overall consolidated risk level (High, Medium, Low) that can be used with Oracle Identity Cloud Service policies to take remediation action, such as allow or deny the user from accessing Oracle Identity Cloud Service, requiring the user to provide a second factor, and so on. Administrators can also view how the user's risk profile trended over a period of time and drill-down to see each detail of the event.

See Managing Adaptive Security in Oracle Identity Cloud Service.

Schema Management

Extend the user schema by adding custom attributes to it

If you're creating your own user interface, and you don't find a user schema attribute that you need in the base Oracle Identity Cloud Service schema attributes, then add your own custom attribute to the schema from within the Oracle Identity Cloud Service console.

See Adding Custom Schema Attributes.

Application Development SDKs

New SDKs for Web and Mobile applications

Oracle Identity Cloud Service provides you with software development kits (SDKs) that enable you to easily integrate and authenticate your .NET or PHP web applications and your Android or iOS mobile applications with Oracle Identity Cloud Service.

Sample applications and tutorials on using these SDKs are available at the web-based Cloud Developer Portal.

Single Sign-On

Secure Form Fill Admin Client

You can use the Secure Form Fill feature if your web applications can't be modified to integrate with Oracle Identity Cloud Service for SSO. The new Secure Form Fill Admin Client helps you map the sign-in form for your web application so that Oracle Identity Cloud Service knows how to populate the user's user name and password automatically, and helps you to submit the user's credentials to the application's identity store. You can download this Secure Form Fill Admin Client from within the Oracle Identity Cloud Service console.

See Downloading Oracle Identity Cloud Service SDKs and Applications.

Identity Administration

Auto provision birthright applications

You can now configure a set of applications to be automatically provisioned for every user on-boarded to Oracle Identity Cloud Service.

Identity Administration

Synchronize User Accounts from a Flat File Using REST APIs

For target applications that don’t support synchronization of user accounts with Oracle Identity Cloud Service, you can now import user accounts from a flat file using REST APIs, providing a quick and error-free synchronization.

See Importing User Accounts from a Flat File Using REST APIs.

Identity Administration

Synchronize User Accounts from a Flat File using the Oracle Identity Cloud Service UI

For target applications that do not support synchronization of user accounts with Oracle Identity Cloud Service, you can now import and synchronize user accounts from a flat file using the Oracle Identity Cloud Service Administration console. You can also activate and deactivate these synchronized user accounts from the console. See Importing and Synchronizing User Accounts Using a Flat File in Oracle Identity Cloud Service UI.

Identity Administration

Manage Web Tier policies from the admin console

In the previous versions, there was no option in the admin console to create or edit Web Tier policies. You can now manage Web Tier policies from the admin console and specify a list of resource filters, such as, application URLs, the corresponding authentication method, and so on, to control and protect your corporate resources.

See Creating and Managing Web Tier Policies.

Note: Use the Web Tier Policy feature for Oracle Identity Cloud Service only. Customers should refer to the relevant documentation for their services to understand how to use this feature.

Identity Administration

Additional attributes to filter synchronization results

You can now use Situation and Synchronization Status as additional filter attributes to filter the user account import search results. Select values from the respective drop-down lists to view user accounts matching the search criteria.

See Synchronizing User Accounts.

Identity Administration

Apply Default Trust Scope from OAuth settings for Client Application configuration

In the previous versions, for a Trusted Application you can select All Resources, Allowed Tags or Allowed Scopes to configure Trust Scopes for your Client Application. By selecting the Default option, you can now apply the Default Trust Scope configured in the OAuth settings to your client application. See Adding a Trusted Application.

Bridge Installer

Enhanced Microsoft Active Directory Bridge installation

The bridge installer is streamlined and simplified for a better user experience.

See Creating a Bridge.

Administrative Settings

Set Norwegian as your preferred language

The Oracle Identity Cloud Service UI now supports the Norwegian language.

Administrators can set Norwegian as the default language for an identity domain. See Changing Default Settings.

Users can set Norwegian as the default language for their account. See Setting Up or Modifying Your Profile.

Security Settings

Support for Configuring OAuth Settings

You can now configure OAuth settings to either enable account-level trust for all token acquisition requests or configure one of the Default Trust Scopes.

See Configuring OAuth Settings.

REST APIs

Enhancements to Oracle Identity Cloud Service REST APIs

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoints were added:

  • /IDBridgeConfig - Use this endpoint to replace or update an IDBridge configuration. For example, replacing or updating a new feature name and the release in which the feature was introduced.

  • /TargetAuthenticationTester - Use this endpoint to test target authentication.

  • /Schemas - The PATCH operation is now supported. Use this endpoint to maintain the schema definition of resource types that are supported by Oracle Identity Cloud Service . Schema definitions contain standard SCIM schema attributes and additional Oracle Identity Cloud Service -specific attributes such as searchable, min/max length for validation, target attrname, and so on.

  • /RiskProviderProfile - Use this endpoint to manage risk provider configurations for Oracle Identity Cloud Service . The risk provider configuration manages all the fields that are required to connect with the provider and other relevant configurations.

  • /RiskProviderProfileValdation - Use this endpoint to validate a risk provider profile.

  • /ManagedObjectClassTemplates - Use this endpoint to work with managed object class template configurations for a connected managed app.

  • /ManagedObjectClasses - Use this endpoint to work with managed object class configurations for a connected managed app.

  • /Threats - Use this endpoint to manage adaptive access threats and violations.

  • /AdaptiveAccessSettings - Use this endpoint to manage tenant-specific adaptive access settings. There is a single pre-seeded instance of AdaptiveAccessSettings in Oracle Identity Cloud Service. New instances can't be created and an existing instance can't be removed. But, you can update a single instance using PUT or PATCH.

See REST API for Oracle Identity Cloud Service and Using the Oracle Identity Cloud Service REST APIs with Postman.

Other Noteworthy Changes

Category Feature Description

REST APIs

Enhancements to the Oracle Identity Cloud Service POSTMAN Collection

The Oracle Identity Cloud Service POSTMAN Collection has been updated. This release allows you to explore the relationships between Users, Groups, Clients, Apps, and AppRoles.

Look for new Search requests added for Users, Groups, Clients, Apps, and AppRoles in the Search folders for each, as well as the Membership folders.

See the Oracle Identity Cloud Service POSTMAN Collection.

Release 18.1.2 — February 2018

18.1.2 User Interface Changes

Watch the What’s New in 18.1.2 video to learn about the 18.1.2 user interface changes and other enhancements.

The Oracle Identity Cloud Service 18.1.2 release introduces several major interface changes to the Identity Cloud Service administrator console:
  1. In 17.4.6, the user menu displayed the user name. In 18.1.2, the user name is replaced with the user’s initials. This change is part of an update across all Oracle cloud products. All PaaS products are moving to a new design. The new avatar displays the logged in user's initials. No options for the menu have changed.

  2. In 17.4.6, the Dashboard, Users, and Notifications buttons appeared in the upper-right corner of the administrator console. These buttons are used to return to Oracle Public Cloud. In 18.1.2, those links are available on the new My Services page in the Navigation Drawer.

  3. In 17.4.6, dashboard navigation consisted of a series of tabs across the dashboard. In 18.1.2, these tabs are replaced with the Navigation Drawer. The Navigation Drawer maximizes the real estate of the Identity Cloud Service console. To display the Navigation Drawer, click the Navigation Drawer icon in the upper-left corner of the console. You'll see a listing of all folders and pages that compose the console. Click a folder to see the pages associated with the folder. Then, click the menu item that represents the page that you want to display in the Identity Cloud Service console. Click the Navigation Drawer icon again to close the Navigation Drawer.

18.1.2 User Interface Changes

17.4.6 Navigation (Old)

17.4.6 Navigation (Old) ScreenshotDescription of old-navigation-release-17.4.6.png follows
Description of the illustration old-navigation-release-17.4.6.png

18.1.2 Navigation (New)

18.1.2 Navigation (New) ScreenshotDescription of new-navigations-release-18.1.2.png follows
Description of the illustration new-navigations-release-18.1.2.png

See Accessing Service Consoles

Other UI Changes

  1. There's a new page in the Settings folder: Downloads. Use this page to download Java, Node.js, or Python SDKs or the EBS Asserter to integrate your web applications or Oracle E-Business Suite with Oracle Identity Cloud Service. See Downloading Oracle Identity Cloud Service SDKs and Applications.

  2. In the Security folder:

18.1.2 New Features— February 2018

Feature Description

Email as a Second Authentication Factor

Support for using email as a second authentication factor has been added to the Multi-Factor Authentication options. After email settings are configured, when the user selects Email as the authentication method, Oracle Identity Cloud Service sends a one-time passcode to the user’s primary email address for use as a second verification method.

See Configuring Email Settings.

Setting a Default Verification Method

A user can now set their default second factor verification method using the 2-Step Verification page of the My Profile console.

See Setting a Default Verification Method.

Enhancements to Oracle Identity Cloud Service REST APIs

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoints have been added:
  • /LatestBinaryFileInfoVersionRetriever - Use this endpoint to retrieve the latest version of binary file information.

  • /SFFCustomApps - Use this endpoint to manage tenant-specific Secure Form Fill custom apps.

The X-ORACLE-DMS-ECID and X-ORACLE-DMS-RID HTTP headers are now included in each REST API response. These headers correspond to the ECID and RID for a REST API request. The caller can use this information to track and correlate requests that originate with events arising in the Oracle Identity Cloud Service server. The client may also include these values as part of an error message, as it is important to correlate events on the client side with errors on the server side.

See REST API for Oracle Identity Cloud Service..

Manage Policies

Policy control, for securing and managing access to resources, is now available. Policy control makes access control flexible, enabling good policy management with flexible and extendable, contextual capabilities.

In this release, the following policy control features are available:

Define Identity Provider Policies. You can use identity provider policies to specify which identity providers are visible in the Sign In page when someone is trying to sign in to Oracle Identity Cloud Service, either when they're accessing a specific app or attempting to access resources that are protected by Oracle Identity Cloud Service, such as the My Profile console or the Identity Cloud Service console. You can also use identity provider policies to determine whether users authenticate into Oracle Identity Cloud Service with their local credentials or by using credentials associated with SAML or social identity providers. See Managing Oracle Identity Cloud Service Identity Provider Policies.

Define Network Perimeters. You can define network perimeters in Oracle Identity Cloud Service. A network perimeter contains a list of IP addresses. After creating a network perimeter, you can prevent users from signing in to Oracle Identity Cloud Service if they use one of the IP addresses in the network perimeter. This is known as blacklisting. You can also configure Oracle Identity Cloud Service so that users can log in, using only IP addresses contained in the network perimeter. This is known as white listing. See Managing Oracle Identity Cloud Service Network Perimeters.

Define Sign-On Policies. You can use sign-on policies in Oracle Identity Cloud Service to define criteria that Oracle Identity Cloud Service uses to determine whether to allow a user to sign in to Oracle Identity Cloud Service or prevent a user from accessing Oracle Identity Cloud Service. See Managing Oracle Identity Cloud Service Sign-On Policies.

App Development SDK

You can now enable your Java, Node.js, or Python web applications to authenticate with Oracle Identity Cloud Service by using software development kits (SDKs).

Oracle Identity Cloud Service provides you with a centralized location in the Identity Cloud Service console where you can download SDKs or the EBS Asserter to integrate your web applications or Oracle E-Business Suite with Oracle Identity Cloud Service.

See Downloading Oracle Identity Cloud Service SDKs and Applications.

EBS Asserter

Integrate your Oracle E-Business Suite environment with Oracle Identity Cloud Service for authentication and password management purposes by using a lightweight Java application known as the Oracle E-Business Suite (EBS) Asserter.

Oracle Identity Cloud Service provides you with a centralized location in the Identity Cloud Service console where you can download SDKs or the EBS Asserter to integrate your web applications or Oracle E-Business Suite with Oracle Identity Cloud Service.

See Downloading Oracle Identity Cloud Service SDKs and Applications.

Create custom secure form fill applications

If you don't find the secure form fill application that you need in the app catalog or you simply want to create your own, you can do so with Oracle Identity Cloud Service. Define your own secure form fill configuration using the ESSO Admin Console, export the configuration, and then import that configuration into your secure form fill app in Oracle Identity Cloud Service.

See Creating a Custom Secure Form Fill App.

Select Display in My Apps check box to display the app in My Apps page

In previous releases, when you select Display in My Apps check box, you can also enable SSO to the app.

In this release, when you select the Display in My Apps check box in applications, the app is then visible in the My Apps page, but selecting this check box no longer enables or disables SSO to the app.

The flag to enable or disable SSO comes from the app template. Use the Oracle Identity Cloud Service REST APIs to update this flag. You cannot set the SSO flag from the user interface. See REST API for Oracle Identity Cloud Service.

Updates to the Application Catalog

  • Over 100 Form Fill integrations, including banking, learning, and transportation apps.

  • SAML SSO with Workday, Ariba, and other apps.

See Oracle Identity Cloud Service - Application Catalog..

OpenID Connect support for Identity providers

Oracle Identity Cloud Service now supports integration with identity providers that are compliant with OpenID Connect. These identity providers support the OpenID Connect standard. You use this type of identity provider when you want to establish trust between an OpenID Connect-compatible identity provider, such as Google, Salesforce, and so on, with your Oracle Identity Cloud Service account. This is useful if you're creating a mobile or web application that requires access to Oracle Identity Cloud Service-protected resources, but you don't want to create custom sign-in code or manage your own user identities.

Release 17.4.6 — December 2017

Feature Description

Activate and deactivate user accounts for apps

User accounts provisioned/assigned to apps from Oracle Identity Cloud Service can now be individually activated or deactivated. This allows administrators to manually activate or deactivate user accounts as and when needed without impacting other accounts provisioned to the user. See Assigning Applications to the User Account and Assigning Users to Custom Applications.

Add tags to applications

If you want to create custom attributes for applications that can be used to search for the applications more effectively, then add tags to applications. Tags are key-value pairs that are used to organize and identify applications.

For example, suppose you're creating three versions of an application: one for development purposes, one for testing purposes, and one that will be used in production. You can create the following tags for these versions: Version: Development, Version: Testing; and Version: Production.

You can create tags for your trusted, mobile, SAML, and App Catalog applications or add existing tags from other applications.

See Adding Applications.

Enhancements to Oracle Identity Cloud ServiceREST APIs

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoints have been added:

  • /AppUpgrader

  • /CustomAllowedValues

  • /MappedActions

  • /MappedActionTemplates

  • /MyAccesses

  • /ResourceTypeSchemaAttributes

  • /SocialAccounts

  • /Tags

The attributeSets query parameter was added. Use this query parameter to get a group of attributes back in the response rather than specifying each attribute individually. This query parameter accepts comma-separated values from the following parameters:

  • all (returns all attributes)

  • always (returns all attributes marked as always in the schema)

  • default (returns all default attributes)

  • request (returns all attributes marked as request in the schema)

These values are not case-sensitive. If both "attributes" and "attributeSets" are specified in the request, then the values from both attribute sets are returned in the response.

See REST API for Oracle Identity Cloud Service.

OpenID Connect Support for Social Identity Providers

If you need to add a social identity provider that is OpenID Connect compliant, you can now define OpenID Connect compliant social identity providers as identity providers in Oracle Identity Cloud Service.

See Adding a Social Identity Provider and Deleting an Identity Provider.

Deleting Social Accounts Linked to an Identity Provider

When deleting an identity provider and there are social accounts referenced to that Identity Provider, you are prompted whether to delete the references as well.

If you do delete the social account references, Oracle Identity Cloud Service asynchronously deletes the references and then deletes the identity provider.

If you don't want to delete the social accounts references, you can deactivate the identity provider, which results in the identity provider not being used for social login. When the identity provider is deactivated, users can see their social accounts in their My Profile page but can't use the identity provider to login.

See Deleting an Identity Provider.

Release 17.4.2 — November 2017

Feature Description
User Interface Change: Delegated Administration You can now access the Delegated Administration page from the Security tab of the Identity Cloud Service console. See Accessing Service Consoles.
User Interface Change: Identity Providers You can now access the Identity Providers page from the Security tab of the Identity Cloud Service console. See Accessing Service Consoles.
User Import Enhancement

The Users.csv import file has been enhanced to include Locked, Locked Reason, and Locked Date fields. See Importing User Accounts.

${tenantName} replaced by ${companyName}

${tenantName} has been replaced by ${companyName} for all email templates and SMS templates. See Modifying Notification Templates.

Access Request Notifications Added

There are two new notifications added:

  • New Access Request submitted: This notification is sent to a user after they submit an access request.

  • Access Request fulfilled: This notification is sent to a user after their access request has been fulfilled.

See Understanding the Types of Notifications..

Support for Login URL, Cross-Origin Resource Sharing (CORS), and Allowed CORS Domain Names
The following new fields have been implemented on the Session Settings page to support this enhancement:
  • Login URL: You can specify the URL where you want the user redirected to log in.

  • Allow Cross-Origin Resource Sharing (CORS): You can allow client applications that run on one domain to obtain data from another domain.

  • Allowed CORS Domain Names: You can now list the external domain names that are allowed for CORS operations.

See Changing Session Settings.
Trust Scopes

The new Trust Scopes feature allows a trusted application to access either any resource within a domain or only those services where an explicit association between the client and the service exists.

The following new Trust Scopes options are available for only trusted applications:
  • All Resources: Select to allow your application to request an access token for services using the scope urn:opc:resource:consumer::all. This option provides a wide scope.

  • Allowed Scope: Leave selected (the default) to allow your application to acquire an access token with permissions based on an explicit association between the client and target services.

See Adding a Trusted Application.

MFA Pull Notifications Support

Pull Notifications support has been added to the Multi-Factor Authentication options. Pull notifications are updates that are delivered to a mobile device or computer in response to a user who is checking for login request notifications. Pull notifications are useful in scenarios where the GCM service (Android), APNS Service (iPhone), or WMS service (Windows) does not work. See Configuring Mobile OTP and Notifications.

Oracle Identity Cloud Service REST APIs

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoint has been deprecated:

/AppAllowedScopesChanger

Previously administrators couldn't edit OPC Apps because they were protected and read-only. In order to update the "allowedScopes" attribute, administrators were required to use this special REST endpoint: /AppAllowedScopesChanger. This REST endpoint has been deprecated in this release because OPC Apps are now editable, which allows administrators to use PATCH with the /Apps endpoint to add, remove, or replace the values of the allowedScopes attribute.

See REST API for Oracle Identity Cloud Service.

New App templates added to the App Catalog

For the latest additions to the supported list of applications in the App Catalog, take a look at Oracle Identity Cloud Service - Application Catalog.

Support for enhanced login experience

You can now experience the customized login by hosting a login application and redirecting Oracle Identity Cloud Service login to the new application. You can specify the custom login and logout URLs in the Login URL and Logout Page URL fields. These fields are available in the application, by default. See Adding a Trusted Application, Adding a SAML Application, and Adding a Mobile Application

17.4.2 REST API Changes

Feature Description
Trust Scope Attribute

The Trust Scope Attribute has been added to the REST examples where applicable. See Account Trust Scope.

17.4.2 User Interface Changes

The Delegated Administration page and the Identity Providers page have been moved from the Settings tab (17.3.6) to the Security tab (17.4.2) of the Identity Cloud Service console. This following table illustrates those changes.

Screen shots of 17.4.2 User Interface Changes
17.3.6 Settings Tab (Old)
17.3.6 Settings Tab (Old) ScreenshotDescription of old-settings-tab-release-17.3.6.png follows
Description of the illustration old-settings-tab-release-17.3.6.png
17.4.2 Security Tab (New)
17.4.2 Security Tab (New) ScreenshotDescription of new-security-tab-changes-release-17.4.2.png follows
Description of the illustration new-security-tab-changes-release-17.4.2.png

Release 17.3.6 — September 2017

Feature Description
Device Grant Flow

The new Device Code grant type provides a specific grant flow in which a device client executes on a device that doesn't have an easy data-entry method (for example, game consoles, streaming media players, and digital picture frames), and the device client is incapable of receiving incoming requests from the authorization server. See Adding a Trusted Application and Adding a Mobile Application.

Add/Remove Client Scopes for Oracle Applications

You can now add and remove client scopes for OPC apps using the Oracle Identity Cloud Service administration console.

See Adding a Trusted Application.

Icons for OPC Apps

Different OPC icons are available for each OPC app in the Oracle Identity Cloud Service administration console. Also, available app icons are now stored on the UI server and accessed using a URL, which improves performance fetching and displays the icons more quickly.

Support for Universal Credits Oracle Identity Cloud Service is now part of the new metered Universal Credit pricing models. These models include a Pay As You Go, Monthly, and Yearly.
Bridge Performance Improvement

Enhancements have been made to increase Bridge performance. To take advantage of these improvements, upgrade your Bridge client.

Use new Oracle Identity Cloud Service REST APIs

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoints are new:
  • /MappedAttributeTemplates

  • /MappedAttributes

  • /oauth2/v1/device

See REST API for Oracle Identity Cloud Service.

New App templates added to the App Catalog

For the latest additions to the supported list of applications in the App Catalog, take a look at Oracle Identity Cloud Service - Application Catalog.

Bridge Upgrade Needed After Client Secret Regeneration If you're using the 17.2.6 version of the client for the bridge, and you have regenerated the Client Secret, then you must upgrade your client to the latest version. See Creating a Bridge to install the updated client for the bridge.

Other Noteworthy Changes

Feature Description
Maximum Character Limit Increase for specific Users and Groups Fields
The maximum character length has been increased for the following user fields:
  • Display Name (201)

  • First Name (100)

  • Last Name (100)

  • Formatted Name (354)

In the Groups page, the maximum character length for the Description field has been increased to 4,000 characters.

In the Branding page, the maximum character length for the Login Text field has been increased to 250 characters.

Bare Metal Cloud Services Renamed Bare Metal Cloud Services has been renamed to Oracle Infrastructure Cloud Service.

Release 17.3.4 — September 2017

Feature Description

Secure Form Fill plug-in: Support for Google Chrome and Mozilla Firefox

If you are using Google Chrome, you are prompted to go to the Extensions on Google Chrome and install the Oracle Secure Form Fill Plugin. Users will be prompted to download the plug-in from the My Apps page the first time that they launch a secure form fill app.

If you are using Mozilla Firefox, instead of downloading the Secure Form Fill Mozilla Firefox plug-in from the Mozilla Store, install the Secure Form Fill Mozilla Firefox plug-in from the My Apps page. Users will be prompted to download the plug-in from the My Apps page the first time that they launch a secure form fill app.

Secure Form Fill is included as part of the Oracle Identity Cloud Service Standard license.

Public Access Tenant Signing Certificate Oracle Identity Cloud Service tenant administrators can allow clients to access the tenant signing certificate without logging in to Oracle Identity Cloud Service. See Changing Default Settings in Administering Oracle Identity Cloud Service.
Access Request

Administrators specify the groups and applications to which a user may request access.

Users can now request group and application access from the Catalog. Users can also view the groups and applications to which they have access as well as view their access requests. See Managing Group and Application Access in Administering Oracle Identity Cloud Service.

Use new Oracle Identity Cloud Service REST APIs

The REST APIs for Oracle Identity Cloud Service have been updated. The following endpoints are new:
  • /AppAllowedScopesChanger

  • /MyGroups

  • /MyRequestableApps

  • /MyRequestableGroups

  • /MyRequests

See REST API for Oracle Identity Cloud Service.

New App templates added to the App Catalog

For the latest additions to the App Catalog template list, take a look at Oracle Identity Cloud Service - Application Catalog

Release 17.3.2 — July 2017

This release contains mostly bug fixes and performance enhancements.


Oracle Cloud What’s New for Oracle Identity Cloud Service, Release 19.2.1

E81008-37

Copyright © 2016, 2019, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.