Use Identity Cloud Service to Provide Authorization for Interviews

Oracle Identity Cloud Service can be used to provide authorization for Intelligent Advisor interviews. This allows users and groups managed in Identity Cloud Service to be associated with Intelligent Advisor for interview access control purposes.

With Identity Cloud Service configured as an interview authorization provider, that provider can be associated with any workspace in Intelligent Advisor Hub. When any interview in that workspace is accessed, that user must present an Identity Cloud Service token for them to be given permission to access the interview. If they do not have that token, they will be redirected to log in to Identity Cloud Service first. In this way, only authorized users will be able to initiate an interview session.

Note that if the interview is not embedded (that is, the user is accessing the startsession or resumesession URL directly) and the user is not already authenticated with Identity Cloud Service, then they will be redirected to log in. If the interview is embedded (that is, using the OraclePolicyAutomationInterview.BatchStartOrResume API), then the site embedding the interview must provide the user’s existing access token to the API.

To configure the integration between an Identity Cloud Service and Intelligent Advisor you need to follow these steps:

  1. In Identity Cloud Service, set up the confidential application. This involves:

    1. Creating a confidential application.

    2. Assigning users or groups permission to access that confidential application.

    For more information, see Create a Confidential Application to Provide Authorization for Interviews.

  2. In Intelligent Advisor Hub:

    1. Create an Interview Authorization Provider.

    2. Create a new workspace or edit an existing workspace.

    3. Select the interview authorization provider for the workspace.

Interviews in that workspace accessed via the /startsession or /resumesession URLs should then redirect to Identity Cloud Service for user authentication before the interview is allowed to start. For more information on this process, see Authorization flow for an interview launched directly through a startsession or resume session URL.

For embedded interviews (that use the OraclePolicyAutomationInterview.BatchStartOrResume API), you also need to provide at least one JSON Web Key (JWK) which Intelligent Advisor will attempt to use to decrypt any JSON Web Encryption (JWE) in the OraclePolicyAutomationInterview.BatchStartOrResume API. If the JWK is missing, no redirection will occur and the user will see a message in place of the interview that says they are not authorized to access the interview.

The additional steps for embedded interviews are:

  1. Get the JWK for use with the OraclePolicyAutomationInterview API.

  2. Embed the interview with a JWE containing an Identity Cloud Service access token.

For more information on the process when a user starts an interview which is embedded on a customer's website and secured by Identity Cloud Service, see Authorization flow for an interview embedded in another application using the OraclePolicyAutomationInterview API.

Note: Identity Cloud Service can not be used to provide authorization if any interviews in the workspace are being used with Service Cloud connected interviews. Also, securing iframe embedded interviews with Identity Cloud Service is not supported.

Related Topics